[lkml]   [2008]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [patch] Add basic sanity checks to the syscall execution patch

    * Willy Tarreau <> wrote:

    > Then they will simply proceed like this :
    > - patch /boot/vmlinuz
    > - sync
    > - crash system
    > => user says "oh crap" and presses the reset button. Patched kernel boots.
    > Game over. Patching vmlinuz for known targetted distros is even easier
    > because the attacker just has to embed binary changes for the most
    > common distro kernels.

    a reboot often raises attention. But yes, in terms of end user boxes,
    probably not. Anyway, my points were about transparent rootkits
    installed on a running system without anyone noticing - obviously if the
    attacker can modify the kernel image and the user does not mind a reboot
    it's game over.


     \ /
      Last update: 2008-09-06 17:49    [W:0.030 / U:5.796 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site