Glenn Brunette's Security WeblogRambling musings and practical tips (mostly related to security).Interesting File Discovery Tool version 0.5- July 30, 2007 As promised, I have uploaded version 0.5 of the Interesting File Discovery Tool (or ifd for short). This update includes fixes and enhancements that were contributed by Perley and Joe Moore. Thank you both for your contributions! The biggest change in this version is the introduction of the -D parameter which enables you to change the program used to calculate the file digests (or fingerprints): .ifd-v0.5.sh -h .ifd-v0.5.sh - Interesting File Discovery Tool ifd -ugnw -ds -q -D.http://blogs.sun.com/gbrunett/entry/interesting_file_discovery_tool_version1 Solaris Non-Executable Stack Continued- July 26, 2007 Previously, we covered some of the history and basics of Solaris non-executable stacks and how they can be enabled globally on both SPARC and x86x64 systems. In this article, we extend that foundation by talking about how developers can configure their own programs to have non-executable stacks, regardless of the value of the global system setting, noexec_user_stack. This little bit of magic is accomplished through the use of a linker map file. In the case of non-executable stacks, the...http://blogs.sun.com/gbrunett/entry/solaris_non_executable_stack_continued Solaris Non-Executable Stack Overview- July 25, 2007 The ability to configure a Solaris system to run with non-executable stacks is not overly new. That functionality was originally introduced into the Solaris 2.6 operating system with the noexec_user_stack kernel parameter. Looking at the source code, this is how this parameter was documented (in usrsrcutscommonvmseg_vn.c): 207 208 Patching this variable to non-zero allows the system to run with 209 stacks marked as "not executable". It's a bit of a kludge, but is 210 ...http://blogs.sun.com/gbrunett/entry/solaris_non_executable_stack_overview Fuzzing around with Nevada- July 24, 2007 I guess that it is time for another of my pet projects to come to light. For the last seven months or so (on and off), I have been conducting some rudimentary fuzz testing on Solaris Nevada. Initially it started off as my winter (break) project with build 42 and has continued through a few other builds with my most recent being build 68. For those unfamiliar with the concept, the goal of fuzz testing is to provide random input to programs and see how they behave. The results thus far...http://blogs.sun.com/gbrunett/entry/fuzzing_around_with_nevada Interesting File Discovery Tool version 0.4- July 23, 2007 Way back when, I did a post that introduced the Solaris Interesting File Discovery Tool. Being a fan of automation, I had written the tool mainly for myself, but I was pleasantly surprised to hear that people were happily using it. This leads me to today's posting. A month or so ago, Fredrich Maney dropped me an e-mail letting me know of his experience running the tool and what tweaks he had made to improve it for his environment. In particular, he wanted to run this tool on Solaris 9. ..http://blogs.sun.com/gbrunett/entry/interesting_file_discovery_tool_version |