4 ms·
If you look beneath /var/lib/dpkg/info/ you'll find a set of checksums for binaries in, for example, `zip.md5sums`. It wouldn't take much effort to extract all
by stevekemp 10y ago
If you look beneath /var/lib/dpkg/info/ you'll find a set of checksums for binaries in, for example, `zip.md5sums`.
It wouldn't take much effort to extract all the packages from a release-archive and make that searchable.
I once processed the Debian archive in such a manner, but the problem is security updates will release every now and again and cause you to need to update things. Not a problem to store a set of hashes for binaries, with a floating "most recent" value.
But given that the information is already available to you I'd suspect not many people would pay for the service, or use it.
- HD142245b 10y agoThis goes back to the problem of maintaining your own whitelist, though. The problem is that maintaining your own whitelist is a lot of work. For example, if you update your system, but don't update your rkhunter database, your next report is totally inaccurate. I just want a solution where I can boot up any system from a live CD, and inspect an existing installation, based on an external verified database.
- stevekemp 10y agoEven if you paid for access to a list of known-good binaries you would still need to have your own local list. e.g. Malicious exploit drops in /etc/cron.d/botnet. You might also feel safe if you have "good" copy of bash, but your version matched a checksum from pre-shellshock. Really making the list is easy, you could do it yourself, or you could pay somebody to give you one, but it doesn't solve the problem because you'll still have local changes you need to flag/whitelist/update.
- HD142245b 10y agoWell, I'm not denying that config-file trojans exist, but whitelisting all executables massively reduces the haystack. Thx for the tips.