Re: one of my servers has been compromized

[Paul Schmehl <pschmehl_lists () tx rr com>]

> From a computer science standpoint there's a difference, of course, but not 
from an investigation standpoint.  Say the kernel has a rootkit and is 
creating files.  How do you find those files?  If it's opening network 
connections, how do you find out what those connections are and what 
process is tied to them?

--On December 7, 2011 10:13:42 AM -0800 Gage Bystrom 
<themadichib0d () gmail com> wrote:

> Oh it certainly is a distinction, and that very distinction is important
> enough to have caused the creation of kernel rootkits in the first place:
> the kernel is absolute. There is nothing any software can do without the
> kernel.
>
> For instance say you got a guy with a userland rootkit. He wants to hide
> a file so ls, and several other binaries were modified. You load up
> python, whip up a quick script and boom you can see all the previously
> hidden files. Kernel kit and you have to hook a few system calls and
> monitor the incoming values. If it would return your file and the
> 'password' wasn't given, you can return bogus information and EVERY tool
> will fall for it.
>
> Also not everything has to be done in userland to get done. The kernel is
> fully capable of sending out packets, creating files, etc. Userland in
> fact relies on the kernel for all of these. If you get to the kernel you
> control all of both worlds. You get the userland and in truth you only
> control a portion of the userland.
>
> Mighty difference indeed.
> On Dec 7, 2011 7:20 AM, "Paul Schmehl" <pschmehl_lists () tx rr com> wrote:
>
> But whether you have a kernel rootkit or not isn't all that important.
>  In either case the system is going to be doing unwanted things, and you
> detect those unwanted things with the usual system utilities.  If a
> kernel rootkit didn't affect userland, what would be its purpose?  Even
> to transmit data offsite you have to invoke network capabilities, file
> system capabilities, etc.
>
> IOW, it's a distinction without difference.
>
> --On December 6, 2011 11:48:02 AM -0800 Gage Bystrom
> <themadichib0d () gmail com> wrote:
>
>
>
>
> My bad, should have said that you can't trust the md5sum tampering(since
> you stated to have a static copy on the flash drive) but you couldn't
> trust it since you couldn't trust the system calls.
>
> The immediate moment you have to worry about a legit userland rootkit you
> have to worry about a kernel rootkit. After all you have to consider the
> psychology of the attacker. If you were to compromise a box, and cared
> enough to hide a backdoor they cannot detect without static, write proof
> media, then you care enough to go the extra step for a kernel rootkit.
> Otherwise you would be spending even more time and effort to make your
> userland kit work to satisfaction for a far weaker hold on the box. It
> would simply be idiotic. And I think we can all agree that an attacker
> able to do either of the above is not an idiot.
>
> On Dec 6, 2011 10:19 AM, "Paul Schmehl" <pschmehl_lists () tx rr com> wrote:
>
>
> A "poor man's" root kit detector is to take md5sums of critical system
> binaries (you'd have to redo these after patching), and keep the list on
> an inaccessible media (such as a thumb drive).  If you think the system
> is compromised, run md5sum against those files, and you will quickly
> know. You could even keep statically compiled copies on the thumb drive
> to use in an investigation.



-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson
"There are some ideas so wrong that only a very
intelligent person could believe in them." George Orwell

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/