lkml.org 
[lkml]   [2008]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch] Add basic sanity checks to the syscall execution patch

* Willy Tarreau <w@1wt.eu> wrote:

> Then they will simply proceed like this :
> - patch /boot/vmlinuz
> - sync
> - crash system
>
> => user says "oh crap" and presses the reset button. Patched kernel boots.
> Game over. Patching vmlinuz for known targetted distros is even easier
> because the attacker just has to embed binary changes for the most
> common distro kernels.

a reboot often raises attention. But yes, in terms of end user boxes,
probably not. Anyway, my points were about transparent rootkits
installed on a running system without anyone noticing - obviously if the
attacker can modify the kernel image and the user does not mind a reboot
it's game over.

Ingo


\
 
 \ /
  Last update: 2008-09-06 17:49    [from the cache]
©2003-2011 Jasper Spaans