This is a issue that most admins take care off and so if you are a admin and don't know about this threat then pay attention.

What are Symbolic links and Hard links in linux file system?

• Symbolic/Soft links:- These links can be created by executing the following command.
  
  ln -s original-file symbolic-file
  Here the -s option specifies that the link is symbolic. and when we invoke the ls -il command on it we can see that the inode numbers on the files will be different and the symbolic file would be pointing to the original file like this.
  symbolic-file->original-file
  
  When we delete the original file and try to do a read operation on the symbolic file it will raise an error because the original file does not exist but if we try to write to the symbolic-file this leads to recreation of the original file (this is what you don't want).


• Hard links :- This type of link can be created by using the following command.
  
  ln original-file new-file
  
  In this case if you execute the ls -il command you will see that the inode numbers of both the files are same which shows that the file names are both references to the same location and in case you delete the original file only the original reference is destroyed but still the file name new-file points to that location and the file can still be accessed.

Ok, So now what's the risk or hack in it ?

The hard link trouble :- When someone obtains a hard link to your file then he/she gets the same access rights to the file as the file itself has. So if the file has read, write and executable rights then you get to have those rights to.

Generating Soft link's is a fatuous mistake:- when somebody is able to make a soft link to your file, then he/she gets all the access rights to the file (all means all) , even those rights which are not set for the file which effectively means that they have more access rights to the file than the file has.

Scenario 1 :- the user creates a symbolic link to your /etc/passwd or /etc/shadow file . Hmm, considering the case with soft link's that implies the user can edit, delete entries or make new ones into the file, the user can take both your /etc/passwd and /etc/shadow file and can then use a cracking tool like John the ripper to crack the password's in it and hence the user will be able to own the system.

Solution:-
The basic solution is that if you are a power user then don't create symbolic link's to the sensitive files and even if you do want to create them, you should use the chmod command to change the default permissions of the symbolic link files to somewhat more restrictive permissions.

Secondly you can make sure that an average user does not have rights to access the directories like etc (containing most of the configuration files including the passwd and shadow files). So that they cannot create soft links on them.

"Linux is a safe platform but just requires the configuration's to make it safe"