Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
News

Crack LinuxPPC Day 3:It Gets Better 461

Posted by CmdrTaco from the crazy-games-people-play dept.
So this ought to amuse ya: Its Day 3 of the Crack LinuxPPC, Win PPC Contest that Jeff Carr has been doing. During that time, The Win2k crack box has gone down several times... yet the LinuxPPC box remains stable. Jeff has decided to make the game more interesting. The machine is still crack.linuxppc.org, but the world now may know that the Root Password is "linuxppc". If you can crack the stock LinuxPPC box in a reproducable manner, you get the machine.
This discussion has been archived. No new comments can be posted.

Crack LinuxPPC Day 3:It Gets Better More

Crack LinuxPPC Day 3:It Gets Better

Comments Filter:
  • Its a stock linux install, so I doubt this is in place, but it can also be set up so su doesn't work for certain (or for that matter ANY users). If this IS set up, then there would be no way to log in as root unless you were at the console or you find an exploit.

    But, being a stock install, this is probably not the case and therefore getting access to any shell account would be sufficient.

    -Restil
  • That's an application, not Windows 2000

    Nonsense. Just like a web browser, the Win2000 guest book is an integral part of the operating system.

  • You could try to use traceroute.
  • Tried a number of times... can't get there. Still replies to pings, though.

  • Re:NT != DOS (Score:1)

    by Anonymous Coward
    You dumb twinky molester. How can you possibly use a web browser with your IQ? Are you high? Sick freak. Sick people.
  • NARC!
    MS_COINTELPRO?

    I wouldn't be the least bit surprised. It would only be a slightly more negative attitude than is often expressed in some of their AstroTurf campaigns they've run in the past over things like streaming media ("I can't use that Really Medium player or whatver. Why can't you use Windows Media Player instead? It always works for me!" (followed by M$ literally throwing money at the content company to as an 'incentive' to switch)).
  • I think you may have misunderstood his point. Although It is possible to compromise the security of an individual user with these methods, it is not so for the OS/computer as a whole.

    1. Because of protected memory, you don't have access to kernal memory as a user. So, any virus would have to somehow launch as ROOT.
    2. A back orifice like tool would probably be able to compromise individual user security, but again, do little damage to the system as a whole, without adequate user permissions.
    3. Same thing with macro attacks. Individual users only, unless the application did stupid 'suid' stuff.

    Basically, to REALLY compromise security on a *nix boxc, you've got to have root access. When this is the case, I find the 'rm -rf /' is usually the best way to completely destroy the system.

    But that's just me.
  • I don't know what Microsoft is thinking, but, er...changing the application protection (which is actually a dropdown list, if I remember correctly) doesn't require a reboot. You don't even need to shutdown and restart the service. You just do it and click okay. I don't know why they're rebooting.

    --
    Wonko the Sane

  • Look, myself and some others spent the last night scrutenizing this Windows box, here is what we found... 1) ONLY port 80 is active 2) The web server is only accepting "GET" requests. "PUT" appears to be disabled. and 3)it looks like they're truncating URL line length as their fix to overflow bugs. That's it.

    Take one and two and tell me how this equates to any real world server. Sure I can put up any OS serving only port 80 and consider it secure!

    What about realworld where your server is not on-site and must be remote administrated, or atleast, not on-site in your office, but in another building where your ISD group maintains it.

    IMHO this whole set-up is a scam.
  • The goal is to get root priveliges not the root password. The root password doesn't give you crap if you can't figure out a way to log-in. There's more than one way to get there, ie buffer overflows, r00t kits etc.


  • "The press are picking up on this, including some non-IT rags (see Linux Today). This is going to be a PR disaster of the finest water.

    "Expect a(nother) name change for NT5/W2K sometime during the fall. That'll let them pretend it's a different product."

    No, they'll merely change the slogan (drumroll please):

    It just doesn't work.

  • a nice convention is:

    DoS = Denial of Service
    DOS = Disk Operating System
  • Oh I don't know about that... nobody cares too much about the Win2000 machine, but if I had any cracking skills whatsoever I'd try my hand at the linuxppc in order to win the machine.

    Doug
  • now all you need to crack it is its physical location, a crowbar, lockpick, and possibly a spare monitor/keyboard.
  • He's kidding, right?

    Has ESR forgotten that the internet worm of the late 80's used a bug in sendmail?

    How is that any different than the Melissa virus on Windows? Both problems spread via an insecurity in the mail program.
  • Nobody is stopping Microsoft from setting up a 4.0 server. This isn't an organized contest--just put your machine online and say "Crack me!".

    I'm sure if they ask Bill real nice he could shell out some dough for a server and an NT4 license...

    The only people stopping Microsoft from putting out a non-beta crack test is Microsoft. We can only guess why they aren't. My guess is that they think that W2K is more secure than NT4.

  • >assuming that the jpeg wasn't put thru the GIMP first...)?

    Well, I posted the link straight from crack.linuxppc.org so I can't vouch for how it was created. The link from the main page mentions SheepShaver.
  • Actually, they didn't change any real programs either. They just spoofed the (poorly written) bboard program. They tricked it to play back javascript code.

  • Mindcraft again, but this time... (Score:1)

    by Anonymous Coward
    It seems that Linux is winning this round against Windows. When Mindcraft did those benchmarks, those were under controlled conditions where the MS guys could tweak to their hearts desire and take advantage of what they knew would work right. The problem with the test was that it simulated network usage which is unreal when you compare it to a regular server hooked up to the Internet. Here we finally get a test of real server usage and Microsoft seems to be losing on this benchmark. I hope the media picks up on this just as it did on Mindcraft so that it can be said that just because Windows may transfer crazy amounts of information better than Linux, it doesn;t mean its a reliable server for hosting services on the Internet.
  • Andy Grove would kick Bill Gates in the nuts if they did that.

    "The number of suckers born each minute doubles every 18 months."
    -jafac's law
  • But it's DEAD now.

    Damn, third day of thunder or what..?

  • hehe (Score:1)

    by David ( 1368 )
    If only the stock LinuxPPC install came with secure shell. :)
  • for the rest of this go to whatis.com [whatis.com]

    "Bogomips is a measurement provided in the Linux operating system that indicates in a relative way how fast the computer processor runs. The program that provides the measurement is called BogoMips. Written by Linus Torvalds, the main developer of Linux, ..."

  • To force reload even of cached pages and cached inline images in Netscape Navigator/Communicator, use Shift-Reload, or View|Reload.

    Netscape's Reload button is crippled by design [netscape.com]. Also see this page [netscape.com] for more details.

  • Excerpt from the Status Log on the Win2k box:

    1:00pm - Tuned IIS' performance options reset application protection to Medium, and rebooted.

    8:54am - Changed IIS' application protection to Low and rebooted, site back up

    In other words, "Dragged slider bar in IIS window to a different setting, and waited five minutes while the system rebooted and restarted most of the services."

    "Tuned" my ass.

  • No, it won't slow down sales a bit. It might improve them. I wasn't even going to think of Win2K before. but if it is released before the first snow, I'll buy half a dozen, grind up the CDs, and scatter them over my lawn. Should come up nice and green next spring;^>
  • Actually, not the flipdown model (introduced with the 9600) or IDE (introduced in non-performas with the G3 towers), just plainol' 50 pin fast SCSI and possibly the worst case ever made by Apple. unscrew, yank case, rip out every cable and pull M/B to fiddle with RAM. ugh. still pretty nice machines, though.
  • I believe that He's using BOCHS to run Win95 in this shot...
  • The Windows 2000 server must be getting much more attention than the LinuxPPC server, so we aren't exactly comparing oranges and apples (macintoshes?). Of course, the LinuxPPC server has more service ports open and a well-known root password. :-) The web server at windows2000test.com [windows2000test.com] is offline. The server responds to pings, but IIS doesn't serve any pages..
  • On the other hand, the fact that this is Windows 2000 (a relatively new operating system) means there might not be as many known exploits out there as there would be otherwise.

    Pardon me for butting in... what do you mean, Windows 2000 is a relatively new operating system??? Correct me if I'm wrong (please!) but isn't Win2k a.k.a. NT 5? I'm pretty sure that it's "built on NT technology" (which is redundant, given what NT stands for, but that's okay, this is MS). What does this mean? Windows 2000 is not new, it's using a kernel that's been around for several years (I'm sure NT is at least as old as Linux, but I don't know, can anybody help me out here?). Of course, it has supposedly been improved over time, but I'm not sure...

  • I'm a bit confused now. How can it be called "cracking" when you have been given the root password by the owner? I thought the whole point of cracking was to *get* the root password (or some equivalent).
  • If this article were written about Linux we would be righteous in our anger

    Non-Microsoft operating systems such as
    Linux are invulnerable to macro attacks, immune to viruses, and can laugh at Back Orifice.

    This is pure unadulterated bullshit and ESR knows it. I couldn't bring myself to read any further to see if he redeems himself so my apologies if he said "just kidding" later on. In his attempt to build up alternative OS's he has falsely stated that MS is vulnerable to attacks that are unthinkable in _all_ other OS's (or at leas Linux). What makes it all the worse is that Linux is far superior to Windows (especially 9x) in terms of real security. Let's stick to the facts and win on the level instead of trying to bead MS at their game of lies and half-truths.

    To those who don't see the problems in ESR's statements, here's a quick rebuttal of the sentence above:

    Vi has had macro attacks in the past and any application can have a design that allows macro attacks. They simply have to treat data files as scripts. While I can't think of an application that has such a vulnerability at the moment it does not make non-MS OS's immune since it is not an OS issue. MS has the responsibilty for Mellissa et al. not because they made the OS but because they made the programs (Outlook and Word) that were the vector for the worm.

    Linux may be less vulnerable to viruses due to more attention to kernel security and memory protection, but it is also fair to say that not many people have tried. I would hesitate to call it invulnerable, but I'll concede the point if a security expert can convince me otherwise.

    Laughing at Back Orifice is pure and complete BS. Crackers don't need to install BO, it's already there!!! Seriously, all BO is is a remote GUI. Most linux servers have X installed and everything can be configured with a terminal anyway, all they need is root access. BO may be a more stealthy, but a cracker needs to get Administrator access in the first place to install it and it is slightly easier to monitor for BO listening on one of your ports than it is to monitor all telnet and X connections for root activity.

    In any case the name of the game is to prevent root access in the first place. I believe that Linux does a more comprehensive job of this, but we need real arguments, not lies, to win the fight.




    --
  • Many unicies (sp?) disallow root login from network terminals. In *BSD, you even have to be in the wheel group to su root.

  • Re:Crack with the root password? (Score:3)

    by Maciej Stachowiak ( 14282 ) on Friday August 06, 1999 @08:37AM (#1760371)
    On most stock Linux installs you can't log
    in directly as root remotely. You'd still
    need to get at least a non-root shell somehow.

    Basically he is just lowering the barrier of entry from "get a root shell" to "get a shell", but given the number of rootkits out for Linux, these are already pretty equivalent (penetrating a Linux box remotely is a lot harder than getting root once you are in).
  • Idiot anonymous Crawford

    In ANY context, "Denial of Service" is abbreviated DoS, not DOS. The poster made a mistake.
  • This whole concept seems very pointless to me. Much like the Mindcraft test, how many real-world situations reflect the kind of test we are currently seeing. If you have a box that only runs 2 or 3 services, and serving up static web pages, it isn't that hard to make them secure.

    What would make a more interesting test is to have a competition between NT/2K and Linux where they would run a standard set of services (web, mail, maybe directory services). Then you unleash crackers on it and see what gets broken.

    Really all this is doing is testing the security of TCP/IP stacks on both OS's, and the security of Apache vs. IIS serving up static pages. It's much more an Apache vs. IIS thing than a Linux vs. Windoze thing.

    ---

  • Isn't exp(j*PI) = 1?
    i.e. exp(j*PI) - 1 = 0

    So you are giving -2 cents?
  • >If they want the full range of skilled crackers

    Who is 'they'? Lunux/PPC put one of their own boxes on the line for this. You were expecting maybe an PIII-500 running Slackware?

  • God I must be tired!

    You're right of course!

    I basically meant I wonder if Win2000 would run on a similar spec machine...
  • I love that commercial. I couldn't believe my ears when I heard it...especially coming from HP!
  • port 111 port 23 port 80
    (sunrpc) (t-net) (httpd)

  • Bullshit. A *real* OS will fail gracefully and simply not respond to all those packets. It will NOT crash not matter what the load.

    We've had a lot of experience with these kind of DoS attacks. Our experience is that various NTs and Linux boxes bog down or eventually become non responsive; although the Linux doesn't usually crash per se. However, our BSDI boxes chug right along without even so much as a blink.

    FWIW.

  • "Get Real" (Score:1)

    by Anonymous Coward
    Hello? You haven't been following very well. Few serious crackers are impressed with the W2K challenge and are willing to mess with it. Why bother - Windows creates it's own problems without being cracked, and no one want's to give Microsoft free testing when Microsoft does so little in return. What's the incentive? Has Microsoft published everything that's happened? No, they've tried to brush it under the rug with outright lies and deception. Plus the box has been down more than it's been up, so it's not like there's much opportunity to crack it (which may have been done way before they expected it, hence the unavailability and shush factor). Microsoft's big media ploy has blundered and exposed them for the bumbling idiots that they are.

    Meanwhile, the LinuxPPC has been chugging along, being attacked 2 million times an hour with no success. He's even tried to make it easier for people. No faltering, no crashing - even the Slashdot effect hasn't killed it. LinuxPPC has multiple processes open and even telnet - the W2K only had the webserver open. LinuxPPC is still cooking along, W2K couldn't even handle having one process happening and died multiple times.

    "The router's down" - but a test confirmed that it was up. Weather? Other systems in the area at the same time were up, and the weather wasn't a factor in the entire time that the computer was crashing (what - 9 times now?). Excuses - if a company can't come out and say that they failed and will work to correct the problem, then they are dishonest and people shouldn't do business with them. You're going to trust your business and mission critical applications to these yokels? You never know when they're telling the truth or feeding you a line. At least with Linux you know exactly where you stand and where to go to fix any problem that may arise. No one is hiding anything in the Linux community - that's not how our software was developed. Open Source means Open. No lies, no deception. That's something I want to base my business on and something I want to base my mission critical apps on...

    Get with the real world - dump your Microsoft fantasies and get on a real OS. Why do you think so many major computer manufacturers are supporting Linux? (Remember - Microsoft doesn't manufacture hardware - only software - so the industry leaders are still the hardware manufacturers that choose which OS to use). SGI is even talking about dumping Irix in favor of Linux. Can you seriously attempt to compare NT to Irix??? Sun is putting Linux alongside Solaris in their support. NT doesn't hold a candle to Solaris, regardless of what the proprietory benchmarks make out. The real world is Unix and Linux. The fantasy world is Microsoft. Sooner or later you're going to have to wake up and face reality...

  • Sure, that would make sense. But I checked at least a half-dozen web sites running LinuxPPC and none of the Apache's matched the behavior crack.linuxppc.org had.

    --
  • Hmmmm...nope!
    You eigther have both boxes DoSed in equal measure to give us all a neat insight into how they cope under the same strain or you don't Dos either box at all.
    Clearly the latter option is far easier to achieve, and is inherently more sensible as the entire competition is about cracking and not DoSing.
    Anyone who attempts to DoS either machine is clearly a bit of a no-brainer as they're seeing a contest designed to be constructive and doing something destructive instead.
  • palantir:~> dlocate -s ssh
    Package: ssh
    Status: install ok installed
    Priority: optional
    Section: non-US/non-free

    Case closed :)

    Daniel
  • Note the difference in loads:
    linux ppc:
    load average: 0.22, 0.25, 0.23 (equals about 25% processor usage, right?)

    windows:
    % Processor Time Avg: 30-47






  • Of course it is all over if he opens up fingerd.

    That doesn't follow. Assuming you aren't talking about exploiting a bug in fingerd itself, simply knowing valid user names won't help much because you must still crack the password for that account (good luck).

    Even if you manage to get in (not necessarily by brute-forcing the password), the shell may be a flytrap - a potemkin shell while the system logs everything it can about you while paging the sysop.

    Worse, it's trivial to write a potemkin shell that escapes to a real shell only if the client is in a magic IP address range and the user knows the magic command. That means *every* shell could be trapped, but only people on the local subnet could enter the command "O$ks&*%kk1!" and escape to a real shell.

    I don't know of any potemkin shells in a standard distribution, but a non-responsive one is trivial to write if you know basic socket programming. Even a responsive one can be quickly built if you use chroot() and are careful what commands you copy into your sandtrap.

  • For everything you ever wanted to know about this topic, visit the BogoMIPS mini-HOWTO [unc.edu]
  • Melissa worked because it used actual features of the system, such as treating data files (spreadsheets, documents, etc.) as programs, and without any security checking. (You see how well warning the user that there is a macro worked.)

    The difference is they fixed sendmail. Another Melissa can come along any day. Next time it probably won't be a Macro. There is now a problem in excel 97 that uses ODBC to take over the machine, without any warning.
  • > they are going to have a MAJOR PR coup.

    I disagree. Remember that the audience for these stunts is the world's PHBs. They don't know the difference between a crack and a DOS attack (or a crack on the DNServers).

    Sure, MS will have some excuses -- maybe even some good ones -- but the outstanding fact for the PHBs will be that MS put up the challenge and the box did go down. Repeatedly. And after the fiasco of the DOJ trial, where they were repeatedly shown to be liars and falsifiers of evidence, those excuses/reasons are apt to ring slightly hollow in ears that don't know how to weigh them. The seeds of doubt have been sown.

    Also, those PHBs will hear that the content of the Web site was changed by 'hackers'. We all know that it was a BFD, but the PHBs don't. Or, if some few happen to know it, they'll be asking themselves: Have I been buying software from a company that is stupid enough to leave such a simple and obvious leak when setting up a security challenge?

    Ditto for all the other downs, even if a few PHBs believe MS's explanations and realize that none(?) of the problems really represent cracks [see, even I can't say 'none' with full confidence!]. PHB: Have I been buying software from a company stupid enough to leave so many simple and obvious failure modes when setting up a high profile demonstration of their newest flagship product?

    No, the egg won't be on any penguins' faces.

    The only question now is deniability. How will MS wriggle out of this one? My prediction is that they will say it was an unauthorized test by a subcontractor or a couple of rogue employees, that MS proper had nothing to do with it, and that besides, it wasn't an up-to-date build anyway. The real thang is secure and it don't never crash. (Remember, you heard it first on /.!)

  • Nah... People will buy shit, even when they know its shit, especially from M$! '98 crashed during a big demo right before its release. Did that slow down sales?

  • You are a fscking moron who obvously doesn't have anything better to do than post anonymous messages on /. attempting to showcase his feeble intellect by being the tenth person to imply that he knows the difference between DoS and DOS.

    You people make me downright nauseous.
  • Can't stop is if you can't start it, eh?
  • Microsoft started this whole affair. With all the former DEC employees they hired, Does anyone seriously think that an Alpha machine was unavailable? If Microsoft deliberately chose to use a machine that did does not use an Alpha cpu, I do not feel sorry for them. They made their choice, now let them live with it.


    For my choice, I run Linux at home on my new AMD K6-III 450 toy.

  • Apparently its down again at 1855 CDT. Not much of a test on my part, I just followed the links from the news article. linuxppc replied and loaded immediately, whereas MS never even replied.
  • I think this "BOCHS Lite" you are talking about is known as Freemware. Find the link on the right side of bochs.com
  • Read the stats:
    Memory Usage:

    MemTotal: 158760 kB
    MemFree: 19468 kB
    MemShared: 123140 kB
    Buffers: 9432 kB
    Cached: 72416 kB
    SwapTotal: 67468 kB
    SwapFree: 67468 kB

    There's 72M of memory being used as cache.
    Notice that the swap has not been touched. We
    don't get a ps to see how many copies of httpd
    or anything else are running...
  • Well, based on the same logic Linux must be DOS because it also has a command line and I can use some DOS commands (like `dir' and `echo') there.
  • Well then, by your analogy, Microsoft should be running the test on a NT4.0 system, because as you said, "Many exploits are platform specific." W2K is different than NT4.0, and the same exploits most likely aren't going to work.

    How many people use Linux on PPC versus the number of people who use W2K on Intel?

    --
  • Why so much? How do they expect you to run StarOffice if Linux takes up 160MB? Another example of Linux Bloatware...

    160MB of ram?
  • . . . never mind the 600 meg MINIMUM disk space required.

    "The number of suckers born each minute doubles every 18 months."
    -jafac's law
  • This type of Media Stunts(tm) have no ``real industry value''. It just takes a couple of losers with DoS scripts to completely wreck the comparison, and there seems to be pretty many of that kind around...
    I wouldn't be surprised if someone at M$ could predict this outcome, only to be trampled by marketoids.



    ____
  • I think you mean http://www.linuxppc.com/crack [linuxppc.com]. The link you gave doesn't go anywhere. Fully qualified URLs are your friend!

    You're welcome. :)

    --Tom

  • Try posting some pro-M$ blather

    Blather really should get moderated down. Now if someone posts something thoughtful and intelligent that is pro-MS and they get moderated down, then something is wrong. I don't see that happen much (people posting anything intelligent that is pro-MS, let alone it getting moderated down), and when it does happen, someone else will usually moderate it back up.

    no one here owns MicroSloth stock

    I certainly don't own any, but I'd bet there are quite a few people who read and even post on Slashdot that own Microsoft stock. And I'm not just talking AC's or obvious Microsoft apologists either.

    As for your assertation that people aren't working as hard to get into the Linux box, I don't know if that is true. They are offering a real, tangible incentive (you get to keep the box if you get in). That is a pretty good reason. And unlike Microsoft, whom many wouldn't care to do debugging work for gratis, lots of people are happy to help out Linux developers.

  • It would be kinda hard for the LinuxPPC people to run LinuxPPC on a non-PPC platform, wouldn't it?

    not mad or anything, but last I checked LinuxPPC ran on non-intel processors.

    In case you ["didn\'t notice","have no sense of humour"] this message was posted completely out of fun.
  • On the other hand, the fact that this is Windows 2000 (a relatively new operating system) means there might not be as many known exploits out there as there would be otherwise.

    This is a big issue. It is really unfair for MS to put out a "special test version" of Windows and challenge everyone to crack it. It means nothing. Just assume that nobody gets in, because they have done their homework and fixed all of the NT4 holes. MS claims victory. Win2k gets released. Crackers install it on their home machines, look it over from the advantage of home court, and find the holes. Two weeks later, the OS that crackers couldn't crack is wide open, with scripts for the script kiddies on all the hot web sites. Just because you win when your opponent is fighting blind doesn't mean you are invincible. Just wait until you have to fight again on fair terms, and then you can say you are, well, not invincible, but at least "tough."

    Of cource, even fighting blind, the guys working on it (I'm not one of them) seem to have done pretty darn well. I don't know what more to expect than periodic system crashes. With MS admins watching over the system, as soon as anything screwball happens, they are going to reboot, change the accounts, and remove the crack. A watched pot never boils, especially if you take it off the burner every time it starts to simmer.

    On the other hand, the source code for the Linux box is out there. The guys setting up the contest, without going into specifics, have pretty much told everyone how the thing was set up: stock install, with apache added and Telnet enabled. This is a fair test of a system's security. It may go down. Maybe not. Who knows?

    I'm not taking a position for or against MS or Linux. I think they both have good things to offer. I wouldn't put mission-critical stuff on an NT box, but it has a lot of good uses. I like Linux, too, but it isn't for everything, either. Heck, even Macs have strengths! :P

    MS's challenge is pretty much worthless. (I hope they get torched, though!)
  • As has been stated before, ssh allows root login by default, but that can easily be disabled in /etc/sshd_config. just say "PermitRootLogin no" Easy...
  • It depends on your distribution. Debian, for example, does prompt for a non-root username and password upon install (though you can bypass it if you want). Some others do not.
  • As a matter of fact, I could care less if some kid breaks out a bunch of spray cans and does a graffiti mural - provided it's tasteful and not just a bunch of gang/hatred symbols thrown together. I could care less if someone wants to throw a DoS attack at a box or spoof their IP all day long.
    Hackers hack, crackers crack, and me... I write code and manage the systems here at where I work. Never once have I had break out a DoS or Spoof to do something productive. Do I know how to do these things? Yes. Do I see a need to do these things? No. Am I going to campaign to take away someone's rights to do these things? Hell no. It's a free country - do whatever the hell you want. Just don't come bitching to me if you do something illegal and the law clamps down on you...

  • If I could post something good about Microsoft I would.

    Let me say they are on my mind, but Linux is on my computer. That is good enough for me, was it good for you?

  • ports (Score:1)

    by unitron ( 5733 )
    Could some kind soul point me toward a link with an explanation of this whole port number thing? I'm assuming this is something entirely else than serial or parallel ports.

  • DoS against the Windows machine is encouraged because it camplies with the stated objective of the "contest" - to stress-test the machine. DoS against the Linux machine is discouraged because it does not comply with the objective - to break into the machine.
    Ok, so that was sort of weak because Microsoft only asked us to stress test it in a specific way which did not include DoS, but my next point is better.
    DoS against the Linux machine impedes the ability of others to attack it, and thereby reduces their ability to get a free machine.
    DoS against the Windows machine impedes the ability of others to attack it, and thereby reduces the amount of free testing Microsoft gets (of the kind it wants).
    If the cracker's aim is not to work for Microsoft for free, he or she should aim DoS attacks against the Windows machine, but not against the Linux machine.
  • This is probably a stunt for LinuxPPC to show that it's more secure than Linux x86 - for that very reason. Not a bad argument.

    "The number of suckers born each minute doubles every 18 months."
    -jafac's law

  • Re: Unompressed by both, but more impressed by (Score:3)

    by IvanR ( 56651 ) on Friday August 06, 1999 @10:46AM (#1760442)
    Actually, it looks like the PR folks are already starting up the spin machine. In this new article on CNET [news.com], the ground rules of "Change something you shouldn't have access to" are listed. It goes on to mention that the guestbook had been changed. The article then quotes a director of marketing for MS:
    "That's an application, not Windows 2000," he said.

    "It's been up for most of the day today," he added.

    Now that's comedy.

    Ivan.

  • I don't have an axe to grind against Microsoft. I'm simply a business user looking for a secure and robust operating system for Internet applications. I've run both WinNT and Linux for years.

    I look at the Windows 2K log and what I see mirrors my experience with WinNT: a lot of reboots for fairly minor things (tweaking the web server and tweaking tcp/ip). I look at the Linux log and I see stability.

    The bottom line is that NT is not as stable as Linux for Internet applications.

  • I'm a bit confused now. How can it be called "cracking" when you have been given the root password by the owner? I thought the whole point of cracking was to *get* the root password (or some equivalent).

    Having the root password isn't useful if you can't get to a prompt to use it.

    You can't login as root from a remote machine, you'd have to be able to get into the system *first* and *then* su root for the password to be useful. So some crackery needs to be employed to get that far.

  • Re:??? If we know the root password... (Score:3)

    by GeorgieBoy ( 6120 ) on Friday August 06, 1999 @08:41AM (#1760498) Homepage
    It's not that simple. You can't login as root over telnet/rlogin, ftp, etc. unless you specifically set that to be allowed (an obvious security hazard). Without a user account, it's harder, and some kind of exploit needs to be found. Having the root password only makes it easier once you have some sort of access to the system.
  • Tell me how to crash a machine by overwhelming it with too many packets. I have a 486/20 Linux box on my ethernet and I can saturate it with complete garbage and only raise its load average. I have even tried injecting raw noise with a pulser and other nonsense and it had no problems. I was unable to find an exploit on one of my boxes. Perhaps you can?
  • There is a project called lsh with the goal of implementing the ssh protocols in open source. Is anyone familiar with this project or the current quality of the software? This sounds like something that should eventually be in every distribution!
  • If you go follow the link that I gave it says that. :P

  • I've been collating articles and various observations at
    www.linuxppc.com/crack/ [linuxppc.com],

    which is not the same as the crack target server, crack.linuxppc.org. :) Please don't confuse them. ;)
  • It's just an attempt to be cute. The machine's name is crack, so it's just a cute way of saying - "Break into this machine and you can have this machine" -- "crack crack win crack" :)

    If the machine is ever compromised, I can see the winner saying, "Oh, you mean I get this LinuxPPC machine? I thought I was going to get *crack*!" :)
  • You forget the sheer hatred of Windows factor. I'd bet there are more people trying to crack the Windows box (or were on the day the test was announced, anyway - today it seems to be up again).

    D

    ----

  • Re:No (Score:2)

    by scrytch ( 9198 )
    > and the K in KDE is just "K" now, no longer standing for "Kool."

    Actually I was under the impression that it originally stood for "Kalle's Desktop Environment".
  • >So is the server at crack.linuxppc.org.

    Not so (at least as of 1:50 Central)

    Current Server Statistics:
    Uptime and Load Average:

    1:49pm up 3 days, 2:11, 3 users, load average: 0.32, 0.37, 0.26

    Memory Usage:

    total: used: free: shared: buffers: cached:
    Mem: 162570240 105615360 56954880 99618816 4542464 55717888
    Swap: 69087232 0 69087232
    MemTotal: 158760 kB
    MemFree: 55620 kB
    MemShared: 97284 kB
    Buffers: 4436 kB
    Cached: 54412 kB
    SwapTotal: 67468 kB
    SwapFree: 67468 kB

    Processor Info:

    processor : 0
    cpu : 604
    clock : 132MHz
    revision : 3.3
    bogomips : 263.78
    zero pages : total 0 (0Kb) current: 0 (0Kb) hits: 0/222364 (0%)
    machine : Power Macintosh
    motherboard : AAPL,9500 MacRISC
    L2 cache : 512K unified
    memory : 160MB

    I just refreshed and got it (dns doesn't have it but I have the ip)
  • Just doing some basic tests, the version of LinuxPPC on www.linuxppc.org doesn't match what's on crack.linuxppc.org.

    For one thing the Apache server has been modified.

    I thought this was supposed to be a clean install?

    --
  • Well no, Unix is the OS, Unixen are several instances of the OS. Unix boxen are several boxes running perhaps one flavor of Unix or several Unixen (or "flavors of Unix" if that's your preference).

    Unices sounds too much like Unisys.
  • I think the answer is that the guestbook wasn't compromised. Instead, someone took advantage of the fact that the guestbook let you put in arbitrary HTML. So they put in a to go to another site after a specified delay. So we had people sending us to crack.linuxppc.org, slashdot.org, etc. This was not a compromise of the system, just a sneaky use of the guestbook. They seem to have finally fixed this problem by stripping characters from the input.

    However, I remember reading yesterday that someone got backorifice on it, and that's a genuine crack. I don't know the details, though.

    D

    ----
  • Well, Win9x sucks.

    The question might be why have Microsoft's business customers consistantly chose to run crappy DOS/Win over better alternatives such as OS/2 and Windows NT. (Although, everyone runs as root under OS/2 also.)
    --
  • EROS sure is secure: it doesn't run on anything and there are no usable apps for it.

    My paperweight is pretty secure too.

    Nice theory though, perhaps we'll see it in practice someday.
  • Any sensible install of sshd has these options in the config file:

    PermitRootLogin no
    IgnoreRhosts yes
    PermitEmptyPasswords no

    --

  • ...who would have thunk?

    This is morbidly cool

    screenshot [linuxppc.org]
  • crack is running LPPC 1999, the current glibc 2.1-based distro. it's a plain installation from the cd-rom, with the X-based installer. only difference is that telnet's been enabled; it's not on in the default install.

  • No. According to Intel Payola W2K requires a PII. As a workstation, the beta seems faster than NT4 on my P-133.

    As for the 64MB part - try 128MB instead. Maybe the faster processor is an attempt to make up for all of the swapping.
    --
  • Me thinks you've been using Windows 9x too long. NT has account security.
    --
  • According to the virus scanner logs at the mail gateway, we haven't got a Windows virus mailed in for several months that wasn't either a MS Office macro virus or some sort of trojan that attacks IE or Netscape. These viruses all run on NT in user space -- If the workstations are properly set up (of course here they're not), NT is no more vulerable to these sorts of 'viruses' than a unix workstation. We haven't got a boot virus or any of the classic DOS types in a long time.

    The attitude in the unix security community seems to be "oh that's only user space - the *system* wasn't comprimised", but that's litte condolence if some VP is pissed because lost all of his porn files and his account spammed the entire company.

    Basically the only virus protection advantage that Linux has over NT is that MS Office doesn't run on Linux. You can get the same 'protection' on Windows by running corel, Lotus, Star or something else.
    --
  • Y'know, I'm hoping that the original post on this thread was a troll, 'cause I'd really hate to think anyone's mind works in this way...

    Okay, let me get this straight... In your mind, it's okay to use a DoS to nearly knock another machine down, just so you can spoof it, but it's not right to use a DoS to totally knock a machine off the net?

    Riiiiiiiiiigghhhttt....

    Did the thought ever cross your mind that Spoofing is just as heinous as a DoS? That neither of them has any real use in an active and productive society?

    Here's a buck... go buy a clue.

  • I can't believe the stats on the Windoze box

    It says memory usage around 114Mbs...
    Perfmon info from 8/6/99 10:00am
    Datagrams Received/sec Avg: 250
    Fragments Received/sec Avg: 4
    Total Fragment Reassembly Errors 30000 in the last hour
    Connections Avg: 500
    % Processor Time Avg: 40

    Memory use steady at about 114000K

    They also posted a new support document explaining how what is happening to the machine is normal :
    http://support.microsoft.com/support/kb/articles /q142/6/41.asp

    I would like to learn some more on this mega server, more specs (steady size of the swap file, cpu idle time, if someone can use the machine to play minesweeper right now...) :^P

    This really is fun to see... Happy happy joy joy!!

Slashdot Top Deals

Life is cheap, but the accessories can kill you.

Close