full-disclosure - Re: one of my servers has been compromized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 07 Dec 2011 09:20:46 -0600
From: Paul Schmehl <pschmehl_lists@...rr.com>
To: Gage Bystrom <themadichib0d@...il.com>, full-disclosure@...ts.grok.org.uk
Subject: Re: one of my servers has been compromized

But whether you have a kernel rootkit or not isn't all that important.  In 
either case the system is going to be doing unwanted things, and you detect 
those unwanted things with the usual system utilities.  If a kernel rootkit 
didn't affect userland, what would be its purpose?  Even to transmit data 
offsite you have to invoke network capabilities, file system capabilities, 
etc.

IOW, it's a distinction without difference.

--On December 6, 2011 11:48:02 AM -0800 Gage Bystrom 
<themadichib0d@...il.com> wrote:

>
>
> My bad, should have said that you can't trust the md5sum tampering(since
> you stated to have a static copy on the flash drive) but you couldn't
> trust it since you couldn't trust the system calls.
>
> The immediate moment you have to worry about a legit userland rootkit you
> have to worry about a kernel rootkit. After all you have to consider the
> psychology of the attacker. If you were to compromise a box, and cared
> enough to hide a backdoor they cannot detect without static, write proof
> media, then you care enough to go the extra step for a kernel rootkit.
> Otherwise you would be spending even more time and effort to make your
> userland kit work to satisfaction for a far weaker hold on the box. It
> would simply be idiotic. And I think we can all agree that an attacker
> able to do either of the above is not an idiot.
>
> On Dec 6, 2011 10:19 AM, "Paul Schmehl" <pschmehl_lists@...rr.com> wrote:
>>
>> A "poor man's" root kit detector is to take md5sums of critical system
>> binaries (you'd have to redo these after patching), and keep the list on
>> an inaccessible media (such as a thumb drive).  If you think the system
>> is compromised, run md5sum against those files, and you will quickly
>> know. You could even keep statically compiled copies on the thumb drive
>> to use in an investigation.



-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/