[lkml]   [1999]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: malware defense

I had a few random thoughts on the subject, probably unworkable..

- If binaries were signed with public key crypto, the kernel could
keep a list of authorized keys. To run your own code, sign it
yourself (preferably on a "secure" airgapped machine ...)
The procesing overhead to check keys might be crippling, though,
if done at every invocation.

- A MD5 daemon could be made part of a watchdog daemon. If it is killed,
the machine reboots (and hopefully comes up firewalled until
integrity verified). Still have to figure out how to stop said
daemon being killed and replaced with a double before the
watchdog has a chance to trip.

- Critical code could be randomized by re-ordering instructions
and inserting NOPs (like, I think, polymorphic viruses). Then
targeting a running binary becomes a bit more tricky than
just building the same version and mapping the data structures.

Douglas Kilpatrick mentioned LOMAC - I had a quick look.
Seems LOMAC uses a tainting-type model where data from an untrusted NIC
can taint a process causing it to be demoted to a lower access level.
Not sure how to use this and allow remote maintenence by root.
Also no protection of objects from objects at the same level, e.g.
one CGI script from another.

LOMAC documentation refers to a number of other projects, listed below

loadable module

Rule Set Based Access Control (RSBAC) for Linux
kernel patch

kernel patch

Generic Software Wrappers Toolkit - NAI
restricitive conditions at present

Seems other people are working on this if only I'd known where
to look. I guess if malware gets to be a serious problem some of
these solutions will suddenly become mainstream.

Andrew Daviel

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:55    [W:0.027 / U:10.728 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site