[lkml]   [1997]   [Oct]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [linux-security] Malicious Linux modules (fwd)
    > Loading modules lets potentially untrustworthy code into your trusted
    > environment so the modules need checked first. A possible approach is
    > to use code signing so the kernel can check that the code really was
    > compiled by you.

    Modules operate on _the same_ trust level as the kernel itself. If a
    hacker can install a malicious module, he can as well install a
    malicious kernel. (I.e. this attack is neither new nor a special Linux
    risk, it just makes patching the kernel easier.)

    So it is futile for the kernel to check module integrity - you need a
    _higher_ trust level. "Higher trust level than the kernel" implies
    media the kernel couldn't physically write to after the attack. I.e.
    boot from a floppy and re-install everything from trusted media (CD,
    backup tapes), check file signatures against separately stored media,

    This applies above all to the kernel and module including their
    respecitve sources. The next likely target are the standard system
    utilities and compiler (as Thompson has proved, the compiler can never
    be completely trusted, and this is an old hat too, but the probability
    of a Thompson attack actually occuring is much lower than someone just
    poking in the kernel sources...)


     \ /
      Last update: 2005-03-22 13:40    [W:0.018 / U:1.028 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site