linux-kernel - Re: [PATCH 1/9] Known exploit detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 12 Dec 2013 15:55:33 -0800
From:	Kees Cook <keescook@...omium.org>
To:	Ryan Mallon <rmallon@...il.com>
Cc:	"Theodore Ts'o" <tytso@....edu>, vegard.nossum@...cle.com,
	LKML <linux-kernel@...r.kernel.org>,
	Tommi Rantala <tt.rantala@...il.com>,
	Ingo Molnar <mingo@...nel.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Andy Lutomirski <luto@...capital.net>,
	Daniel Vetter <daniel.vetter@...ll.ch>,
	Alan Cox <alan@...ux.intel.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jason Wang <jasowang@...hat.com>,
	"David S. Miller" <davem@...emloft.net>,
	Dan Carpenter <dan.carpenter@...cle.com>,
	James Morris <james.l.morris@...cle.com>
Subject: Re: [PATCH 1/9] Known exploit detection

On Thu, Dec 12, 2013 at 3:50 PM, Ryan Mallon <rmallon@...il.com> wrote:
> On 13/12/13 08:13, Kees Cook wrote:
>> On Thu, Dec 12, 2013 at 11:06 AM, Theodore Ts'o <tytso@....edu> wrote:
>>> On Thu, Dec 12, 2013 at 05:52:24PM +0100, vegard.nossum@...cle.com wrote:
>>>> From: Vegard Nossum <vegard.nossum@...cle.com>
>>>>
>>>> The idea is simple -- since different kernel versions are vulnerable to
>>>> different root exploits, hackers most likely try multiple exploits before
>>>> they actually succeed.
>>
>> I like this idea. It serves a few purposes, not the least of which is
>> very clearly marking in code where we've had problems, regardless of
>> the fact that it reports badness to the system owner. And I think
>> getting any additional notifications about bad behavior is a nice idea
>> too.
>
> Though, if an attacker is running through a series of exploits, and one
> eventually succeeds then the first thing to do would be to clean traces
> of the _exploit() notifications from the syslog. Since running through a
> series of exploits is pretty quick, this can probably all be done before
> the sysadmin ever notices.

Sure, but many organizations have centralized network syslog, so
unless the attack can spread to those machines too (which are usually
more locked down), the attacker will leave traces.

> The _exploit() notifications could also be used to spam the syslogs.
> Although they are individually ratelimited, if there are enough
> _exploit() markers in the kernel then an annoying person can cycle
> through them all to generate large amounts of useless syslog.

Totally true, but there's a million way to DoS a local machine. At
least this way shows who's doing it. It's the DoSes that don't include
attribution that I worry about. :)

-Kees

-- 
Kees Cook
Chrome OS Security
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/