This is not true. If the "hacker" can upload to any spot on the machine
through a firewall, it can be hacked. It is possible to open up a single port on
a machine behind a firewall, and if that port has a mud running all the time, it
cannot be hacked.
However, if the attacker can bring down the game itself (not hard to do,
with floodpings), then the port will sit open with enough time to upload a
modified
/lib/c directory to the machine.
When someone telnets into a machine, during the time the machine
asks for
username/passwd, it is running out of the /root/bin/bash directory. Once a login
and passwd are given, it then switches to the access of the user.
If one is crafty (dont write back on how to do it), they can tell
the current
bin/bash root login prompt to look in the new /lib/c directory for access,
which of
course has been modified with a backdoor root passwd, and therefore get a
true root
on the box.
So it _IS_ possible to hack any machine behind a firewall that has
an open port.
Most machines that are firewalled still have one major security hole, port
25 or sendmail,
but I'll let you figure that one out on your own.
Franco
awe@ieway.com
>UNIX pretty much takes care of itself. Allowing access through ports higher
than
>1024, doesn't give the user much access at all. I'm not sure what you mean by a
>pre-determined host. You can't do anything without knowing an account and
passwd
>and UNIX passwords are _IMPOSSIBLE_ to crack. (I know, you have heard the same
>bullshit I have about someone claiming they can crack them)i. A person would
>have a greater chance guessing a passwd than cracking it. (not the same BTW)
>
>Of course, if some asshole uses a password that is in any language dictionary,
>you can't do anything about that. I require 8 char passwd's with at least
>2 numbers, 2 upper case letters, and one shift key (excliuding & % @). I then
>run a 4 hr dic-o-cracker(simply runs through dictionaries and nickname files
>trying to guess the passwd)
>
>I would say you have nothing to worry about.
>
>Chuck
>
>
>+-----------------------------------------------------------+
>| Ensure that you have read the CircleMUD Mailing List FAQ: |
>| http://cspo.queensu.ca/~fletcher/Circle/list_faq.html |
>+-----------------------------------------------------------+
>
>
+-----------------------------------------------------------+
| Ensure that you have read the CircleMUD Mailing List FAQ: |
| http://cspo.queensu.ca/~fletcher/Circle/list_faq.html |
+-----------------------------------------------------------+
This archive was generated by hypermail 2b30 : 12/18/00 PST