Dave Feustel wrote:
And
there are also still numerous ways of breaking OpenBSD inspite of sane
defaults and exploit mitigation techniques in place.
Is there any way I can tell whether my system has been broken as you describe?
This really depends ... I can't tell specifics. I mentioned this because
of this anecdote: A pal once had to deal with a probably-owned OpenBSD
box, because his clueless co-admin installed an outdated, vulnerable
MySQL server by hand (not related to ports/packages at all), and likely
configured it in a bad way, too. Some script kiddie managed to exploit
whatever was going on there. He found out quickly because of an
/etc/shadow file and maybe some other signs, IIRC ... I suspect that the
cluelessness/idiocy of the s'kiddie, or simply the nature of the attack,
resulted in no further damage, however, he reinstalled the box anyways
and bitchslapped the co-admin.
I'd like to be more specific, but there wasn't done any forensic
analysis of the attack, and it's been a while, too. I think it was an
OBSD 3.4 installation.
My point is mostly that, if you try really hard, you can make an OpenBSD
box insecure. OpenBSD can also not help you when you run an
OpenBSD-aware trojan as root, for example.
Moritz
