[lkml]   [2008]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [patch] Add basic sanity checks to the syscall execution patch

* Willy Tarreau <> wrote:

> Then they will simply proceed like this :
> - patch /boot/vmlinuz
> - sync
> - crash system
> => user says "oh crap" and presses the reset button. Patched kernel boots.
> Game over. Patching vmlinuz for known targetted distros is even easier
> because the attacker just has to embed binary changes for the most
> common distro kernels.

a reboot often raises attention. But yes, in terms of end user boxes,
probably not. Anyway, my points were about transparent rootkits
installed on a running system without anyone noticing - obviously if the
attacker can modify the kernel image and the user does not mind a reboot
it's game over.


 \ /
  Last update: 2008-09-06 17:49    [W:0.071 / U:9.688 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site