[lkml]   [2008]   [Sep]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [patch] Add basic sanity checks to the syscall execution patch

* Willy Tarreau <> wrote:

> Then they will simply proceed like this :
> - patch /boot/vmlinuz
> - sync
> - crash system
> => user says "oh crap" and presses the reset button. Patched kernel boots.
> Game over. Patching vmlinuz for known targetted distros is even easier
> because the attacker just has to embed binary changes for the most
> common distro kernels.

a reboot often raises attention. But yes, in terms of end user boxes,
probably not. Anyway, my points were about transparent rootkits
installed on a running system without anyone noticing - obviously if the
attacker can modify the kernel image and the user does not mind a reboot
it's game over.


 \ /
  Last update: 2008-09-06 17:49    [W:0.067 / U:0.112 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site