Re: [coldsync-hackers] Re: Security considerations

[JD Smith <jdsmith@astro.cornell.edu>]

Alex Tronin wrote:
> 
> I wouldn't bother too much about security with ColdSync.
> Most of the time person who makes a connection with the machine has physical
> access to it ( may be it less the case if you have infrared connection ), so
> why bother too much ?
> So I would assign to sync process non-priviliged user like "nobody" and
> chroot-ed it to designated directory.
> Main problems, IMHO, are in connection.
> Alex Tronin
> P.S. I still didn't managed to get USB cradle for Mac to test MacOS X and
> coldsync :-(
> 
> --
> This message was sent through the coldsync-hackers mailing list.  To remove
> yourself from this mailing list, send a message to majordomo@thedotin.net
> with the words "unsubscribe coldsync-hackers" in the message body.  For more
> information on Coldsync, send mail to coldsync-hackers-owner@thedotin.net.

The issue of course is not so simple.  If coldsync is run in daemon
mode, listening on the network for a connection, and has vulnerabilities
which could be exploited over that connection, they will be.  If it has
vulnerabilities in the non-network portion of its codebase, which could
be used to gain root access once a non-priveleged account is
compromised, this is also a problem (but it shouldn't be running as root
then anyway).

Crackers of course don't care what tool it is they're exploiting, but
just how easy it is to exploit.  Given that the user base of coldsync is
so small, you won't see any scanning tools or script-kit cracks
published for it.  This does not relieve our burden of securing it,
however.

JD

-- 
This message was sent through the coldsync-hackers mailing list.  To remove
yourself from this mailing list, send a message to majordomo@thedotin.net
with the words "unsubscribe coldsync-hackers" in the message body.  For more
information on Coldsync, send mail to coldsync-hackers-owner@thedotin.net.