Re: UnBodyGuard a.k.a Bouncer (Solaris kernel function hijacking)(fwd)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 2002-07-04 at 09:06, noir sin wrote:
> 
> Resend:
> attachment moved to http://gsu.linux.org.tr/~noir/b.tar.gz
> since no more than 100K is allowed
> 
> Hi,
> 
> Recently, Dave Aitel posted a link to a loadable kernel module for the
> Solaris operating system to check its kernel integrity against backdoors.
> I downloaded and do some quick analysis on the "product". Simply it does
> md5 checksuming on the sysent32 table where pointers to syscall handling
> kernel functions reside. These pointers are well known to be manipulated by
> backdoor lkm's to change the execution order and pre-execute some hacker
> code that will hide things or feed false information.

<lots of really interesting and cool stuff cut for brevity>

Well, BG 1.0 Free Demo (http://www.immunitysec.com/bodyguard.html) does
do the dereference. E.G. It checks the system call code itself, not the
sysent32 table. So theoretically adding exece to BodyGuard's checksum
table _would_ catch this method, at least for the moment. :> (I'll try
this later today to make sure.) Did you check to see if you could do the
same trick to stat64?

The demo version is somewhat limited in what it checks, but DOES work on
many "popular" kernel level rootkits. A lot of the goal was to give
people at least SOME recourse. I recognize the it becomes an escalating
game of SPY vs SPY, but BG does at least give non-hackers a chip to
spend in the game - something they didn't have until Monday :>. 

There's definitely a window of time where BG will detect a rootkit. This
is why BG, to be successful, will have

1. Limited distribution
2. slightly different executables for each customer
3. be sold only on a subscription basis - new versions due out
periodically throughout the year.

Dave Aitel
Immunity, Inc
www.immunitysec.com







-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDz2MywRBADZ25zAnkqMlSFnSui9JXWse3qYySlo1lTjrJmyIlN8lJNxw/5n
8mrP/4z8HAzbMVfoAnYmHkBfZg9YuWx5GLP3HZwECXY0o82W6GgQph2Z4ylDEAC+
+3IrWweSReWqTA+ME0aL3UeMTnphYGUFF4RWK64cDgs6B3s3IHE28Bq4ewCg8YsO
9HJOR2GeH/bDpZIzcXE2uP0D/ilH5GeSBxNdlRQLP2rrcC4skXwmsn9dNH6uHtYx
+EDLNumhO1evB6wBs4rKnwCas7PphAHriNAmtLOvVXshLeue7xHzRX3/0gs5QKOw
tQcM80RoZFX0Vzq+LqtRrBFQ9xZI1JZmzA/T+9rZjTfXTWCQt5J2g9K/rVYhvb84
iwAdBADWpJRwIxMaL2+Be+NodOz4iegadU8e45iLjqB1YVDva2zOthfuaeeHJGSZ
g7xL2egavp0fN0ekQn3DRmhaMHInk8Zfspp2wD+v3pTBXulT1RnZXpgqlmj6q1En
7FxcFqZt0vKrzwwD03UEKcGcFr2LMwEqHnvS6T72p+G01YYXqLQxRGF2ZSBBaXRl
bCAoSW1tdW5pdHksIEluYykgPGRhdmVAaW1tdW5pdHlzZWMuY29tPohXBBMRAgAX
BQI89jMsBQsHCgMEAxUDAgMWAgECF4AACgkQB8JNm+PA+iXUMwCfUS1m4/6qGyCu
p6DzFmHmVUt4n+QAn3PNlcAwuxHQEZFXSNinaGqeaOh/uQQNBDz2NDsQEADUTJtg
Ka1HREaF5V3nhSLCtidFltjaSGWP8mn6JBy9wbRrhuC0jopg8VrCqTrFYoJtA5H8
AE5lZIKkEEDZoQxhF5saS0+tKm2n7r+UnMSxa/faUvWsdCv79oLY7/812fwoIb18
6OwooTw8qzHZ2SXsFCl+J3ySPsJk8D27sedjQ7xfMu7ZMhiuqY3jX/11MG4Rex5X
FvDRViVImC/fI/g9khV7MxazjEf1YYoz1zXZmhI2ImrZMmeLCp+RBGoGEJJsHhq3
yYnPj7JObe1CDRZbdX2pRs415c+WnDCFEqRUB0beHIe3Cv5DsQMHIiC6LUq5U5tu
qzE6Y03QXW7P6wRWb83pJHO9A0X0JeKaun7LjcRp5/8R24GQY5mFjuhFwPxMFVX9
CnZaJBIhIPFaY+XE4RRKyrmWZzDp91aMFuG53YO9fx9I4YhBT73fFX/Q1jf17uzD
m55ZNv2lDcsPQUm66f96190E2TvUg/VB47LOSpaxB9qqOKNYzU2iE1BjB7t4c1+d
Bp5wG1E9JP2V7ZwI2/KfJ9SIPoQ0l+8MhwiFqD9j7eZ6/d9G9+ojJQrXuEY7dYxr
Z9w1FchEKREKM84ZE5v+cSxAk7VvpASIg4n66nvYM4VEz/cJhkE7v7kLYgOoqY/g
NFKa4UWhmO+eRTti0wXAitLC/xTfeDKEn9riCwADBQ//dj5eZ1Bll8toOGZzNkqJ
YOSQEqltY6DXR3UHPeABit8MnSngDvHrpUZ9961q7ZhDV8MpUg0xTDWBfHuAvBfq
aQzV+5vig3bQHl7EM+KiSaEnXfydxAsHcRTI7PlAf9QuzBeIYWRaaf/HpmJsnWoe
Kv2HUFdyRN3lyycCfqTq0DPgMpueIgkpzbr/K69+x5MlC5yorrfTqlPz1bM1e2V2
25hnzXa2olLK6dza24zx/vJ2yuERZcCEg4Z/Vc4zG+YM04v18KxL8ydVjxGObAyq
brHZUg7202OgO/wyWYBfzkK2EZdtcfscprgg89p8uqQo/rXL921xAsRfHIJW4UKb
0lhGaYyB9dTeKJgpB5qb3N0ZTl+xLW6MGQ+7PazgM0AMyXPvJ9+q8tvT4KWu9H7L
yvkQ8d21GovI2p7y2U9vwriDFnttyCCcLbtqhbS52WlY8yNxSrrXSrX6gJqQnZNx
U34hJniLAvkyqVXScz3EkZV5oswab2p6+jtCYh0VCT1Fu9evRdSGjt8daG8KUxiw
KYTy6ZFSe/4NYkXbkJB0A3kWzCXxc9jzGcmRPuMxrnkAT+2owo0xluIVrGtav/RR
K/2R3P/EIo8BoIgHZn4uj4yZfvWrbtoZY6Eu3viz1Iengl8xnk3o5PjcTe78aHFL
9rAcrnhl+c/giJIGi3gYbXqIRgQYEQIABgUCPPY0OwAKCRAHwk2b48D6JZy5AJsE
oSCgQcZkkqfxocvt2Aa9GNM0NwCfdNmulDQgACapPQ44n0gfr4RJf50=
=b7FC
-----END PGP PUBLIC KEY BLOCK-----

Attachment: signature.asc
Description: This is a digitally signed message part


[Index of Archives]     [Linux Security]     [Netfilter]     [PHP]     [Yosemite News]     [Linux Kernel]

  Powered by Linux