Re: [inbox] Re: RE: Linux (in)security

[Valdis.Kletnieks () vt edu]

On Fri, 24 Oct 2003 06:09:12 PDT, dwr3ck () hushmail com  said:

> How do you determine if you have a KLM on your Linux box?  (serious question
> from someone who does not know)  I'm asking specifically about Red Hat
> because I am a Corporate America slave and IBM has made this the distribution
> that most of corp America will use.

How do you prove there's an invisible cat in your living room.  Simple - you can't
see him, therefore he must be invisible...  

Actually, this has a lot of relevance to the question.  Why do you suspect a
box MIGHT have a KLM on it?  Are you seeing symptoms that can't be explained
otherwise?  Remember that once a KLM gets in control, any program that tries to
detect the KLM is basically "in the Matrix" and can be lied to.  The only
reason the KLM is detectable is because of glitches in the KLM's lying - most
of them aren't very thorough and leave signs of their glitchyness.

Although there are plenty of known ways to detect KLM that's not designed to be
stealthy enough, the only *sure* way is to boot the machine from known clean
media and perform the check from there (and even THAT might not suffice if your
paranoia level is high enough - see below).

I think the stuff at http://www.chkrootkit.org will look for the better-known
KLM's, but note that it does its work in (mostly) chkproc.c and chkdirs.c, and
it won't find a LKM that's written to evade/obfuscate those checks.

It all comes down to a matter of paranoia level - what is the threat model, and
what are the risks involved?

It's not *just* the kernel either - how do you know that the attacker didn't
backdoor your LILO/Grub/whatever to load the kernel and then patch a backdoor
into it before starting it running?  How do you know your BIOS didn't get
reprogrammed?  It's questions like these that end up meaning that things like
Palladium need hardware support on-chip.

You probably should have either some tinfoil for a helmet, a blue pill, or a red pill. :)

Attachment: _bin
Description: