At Bloxfest 2016, Kevin Mitnick talked about reverse shell. How can I secure my Ubuntu from this type of penetration?

Kevin Mitnick, the World’s Most Famous Hacker, Answers Audience Questions at Bloxfest 2016 (2:05)


For a reverse shell to be able to be used your network has to be broken already.

  • So don't install a rootkit and you will be fine ;) Stick to repositories and if really needed PPAs from launchpad. Make sure what you install is from a secure source. Don't install software you do not need, disable services you do not need, keep your system up to date. Keep an eye on the log files and keep an eye on your logs from your router. And turn the machine off when you are not using it (don't keep it on during the night for instance).

  • Simple answer: If you let your system get hacked you are not going to be able to prevent a reverse shell.

  • More elaborate answer: Prevent creation of outbound TCP connections, excepted for trusted addresses is a way to make it more difficult to have someone create a reversed shell. But you will seriously limit your system: that will also prevent browsing the internet, patches installed over HTTP and if you use it, updating antivirus so is basically good for a server, lousy for a desktop.

This will prevent anything but DNS lookups (source):

iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -j REJECT
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 23 -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 139 -j ACCEPT
iptables -A INPUT -p tcp --dport 445 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp --dport 5432 -j ACCEPT
iptables -A INPUT -p tcp --dport 8009 -j ACCEPT
iptables -A INPUT -p tcp --dport 8180 -j ACCEPT
iptables -A INPUT -p tcp --dport 21107 -j ACCEPT
iptables -A input -j REJECT

But port 53 ...

$ grep Domain /etc/services 
domain      53/tcp              # Domain Name Server

will still allow for a reverse shell over this port basically making it impossible to prevent it without making your system totally unusable.

So to come back to the 1st part: leave the system as it currently is and don't let a malicious user get access to your system. Then you do not need to worry about reverse shells.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.