[lkml]   [2008]   [Sep]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [patch] Add basic sanity checks to the syscall execution patch
    On 5 Sep 2008 at 13:42, Ingo Molnar wrote:
    > The other, more fundamental problem that nobody has mentioned so far is
    > that the check returns -ENOSYS and thus makes rootkit attacks _more
    > robust_ and hence more likely!
    > The far better solution would be to insert uncertainty into the picture:
    > some sort of low-frequency watchdog [runs once a second or so] that
    > tries to hide itself from the general kernel scope as much as possible,
    > perhaps as ELF-PIC code at some randomized location, triggered by some
    > frequently used and opaque kernel facility that an attacker can not
    > afford to block or fully filter, and which would just check integrity
    > periodically and with little cost.

    there's that adage about history being repeated by those not knowing it ;)
    for details see the series based around bypassing Vista's PatchGuard at:

    > A good benchmark for such a silent alarm facility would be whether an
    > experienced kernel developer could reliably tell it via a kgdb session
    > and full access to memory and system symbols that such a silent alarm is
    > running on a box. If he cannot do it reliably then there's probably no
    > good way for an attacker either.

    i believe the above mentioned papers prove that it's not a good benchmark ;)

     \ /
      Last update: 2008-09-05 14:03    [W:0.021 / U:40.104 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site