In my opinion, one of the most worrying hacks that would be fairly easy to target a UNIX or Solaris system is the well known xspy hack. If you can get a user to run a program (perhaps by getting them to click on an attachment, or convincing a user to download and install some "cool new freware" patched with a little extra code or via other trojan techniques), then you can easily snoop on all keyboard entry, even password entry into lockscreen programs.
http://www.acm.vt.edu/~jmaxwell/programs/xspy/xspy.html If the user runs things like "su -" in their X windows terminal programs, it wouldn't be to hard to automatically figure out the keystrokes that follows are the root password. Then this sensitive information could easily be logged somewhere or automatically emailed/ftped/uploaded to someone malicious. That's probably why some people say that it's a bit dangerous to enter the root password while running X. Since it's fairly easy to embed the xspy code into other programs, it would be hard to identify your system has been compromised by running "ps". Isn't this the sort of problem that got Microsoft into a lot of trouble a few years ago and made a mess of their security reputation? All we're missing on Solaris is some nasty exploit to automatically launch attachments in your favorite mail reader. Brian _______________________________________________ opensolaris-discuss mailing list [email protected]
