5 ms·

Thank you! Linux desktop is far from secure, even with all these suggested solutions. The lack of popularity by attackers means defenders and coders alike focus

Thank you! Linux desktop is far from secure, even with all these suggested solutions. The lack of popularity by attackers means defenders and coders alike focus on mitigations based on assumptions or a small amount of historical data. From a bad guy's perspective, they just need a foot in the door and move laterally if possible. In my opinon, while all these hardening features are great, nothing beats behavioral detection and prevention. This isn't easy on linux to be honest, but a way for admins(power users?) To define rules like "a process tree with firefox as a parent is running unusual commands or processes" , more or less what is done with sysmon except with perhaps the audit subsystem would be of tremendous use. Assuming you can't prevent initial access or exploitation, what can be done to detect attacker activity on Linux Desktop?

staticassertion 7y ago
Disclaimer: I'm the author of Grapl[0], which aims to do what you're talking about. Normally I don't really comment on the product on HN, but you're describing Grapl's raison d'être. So, audit is one subsystem people use. ebpf is another. OSQuery[1] is a tool that'll make it pretty easy to hook into audit and collect things like process executions. Once you have instrumentation you want to start writing those rules. This is where systems like ElasticSearch, Splunk, or in the case of my product, Grapl, come in. What Grapl makes particularly easy, and what other systems make quite hard, is the type of detection you're talking about - process tree analysis, or generally any kind of analysis that spans many events/ entities. This is because Grapl will take the instrumentation output and generate a graph, which makes joins across the data quite efficient, and it exposes the graph via Python, so you can express pretty arbitrary logic. Other systems make joins quite painful and slow[2][3] Grapl's not at the point where a power user could just get it up and running - though it will be very soon. I've written detection logic very much like what you're describing though[4]. Linux is actually doing fairly well here, in my opinion. OSX was probably the worst, but the ESF will change this. Windows, with Sysmon, is still probably the simplest and best solution for instrumentation (though ETW is pretty strong too). [0]https://github.com/insanitybit/grapl https://github.com/insanitybit/grapl [1]https://osquery.readthedocs.io/en/stable/ https://osquery.readthedocs.io/en/stable/ [2]https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTutorial/Useasubsearch https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTut... (ctrl + f 'In large production environments, it is possible that the subsearch in this example will timeout before it completes.') [3]https://www.elastic.co/guide/en/elasticsearch/reference/current/parent-join.html#_parent_join_and_performance https://www.elastic.co/guide/en/elasticsearch/reference/curr... [4] https://github.com/insanitybit/grapl-analyzers/blob/master/analyzers/suspicious_svchost/main.py#L9 https://github.com/insanitybit/grapl-analyzers/blob/master/a... , https://github.com/insanitybit/grapl-analyzers/blob/master/analyzers/word_child_process/main.py#L8 https://github.com/insanitybit/grapl-analyzers/blob/master/a...
- badrabbit 7y ago
  Very interesting, I hope to see your work mature. Expensive EDRs already do this well. The UI,rules and having a place to put the data is hardest part imho. Linux makes things difficult because so many componets are by design reused extensively. I will look into Grapl, thanks for sharing.
pdonis 7y ago
> From a bad guy's perspective, they just need a foot in the door and move laterally if possible. How does the bad guy get a foot in the door?
- deleted 7y ago
  [deleted]
- badrabbit 7y ago
  Depends on the bad guy. Social engineering is the best way on desktops. And this is what I meant by assumptions, on windows I can tell you phishing and removable drives are the easiest way. On Linux desktop it simply isn't targeted enough to be confident which attack vectors are common. But you're missing the point, there will always be vulnerabilities. Even if everything is written in Rust, logical vulns exist, default config issues will exist (mongodb and internet exposure for example) and even the smartest people can be phished. Even with a yubikey,if I can trick you into opening a link that will have you download and open a file that will execute code on your machine, I don't need your login because I have your session cookies and I can reverse tunnel traffic through your IP. And I may not even care about that, maybe I just want your ssh private key and I will be on my way.
  - pdonis 7y ago
    > Social engineering is the best way on desktops. Nobody uses my Linux desktop/laptop computers but me, and I have no reason to tell anyone else anything about them, so I don't. So I'm not vulnerable to this attack vector. > if I can trick you into opening a link that will have you download and open a file that will execute code on your machine I never click on links unless I know their source. So I'm not vulnerable to this attack vector either. If all that is wrong with the desktop Linux security model is "some users do dumb things", then that's not fixable by any OS. And even with that said, Linux is much better at containing the damage from doing dumb things than, say, Windows.
    - badrabbit 7y ago
      I guarantee you, you will fall for a clever phish. You can't outsmart a good spearphish. You are wrong when you think stupidity is the vuln, the vuln is basic human psychology. But even if you're right, it's not like Linux desktop is made only for people like you right? It wouldn't be "some people are dumb" it would be "almost all people are dumb" even if being dumb was the issue.
swiley 7y ago
It doesn’t have to be; desktop Linux users tend to behave. Go installing random blobs and running scripts from people that download other scripts? Yes you’ll get owned, don’t do that. Even if all your friends are doing it don’t do that.
- badrabbit 7y ago
  It doesn't work that way. You're assuming. People are people, you can't assume "they'll behave". Let's use China or Russia who switched to Linux desktop for their operations, will their users be any less susceptible to social engineering just because they use linux? Look, what you have to understand is, even in the world of Linux Desktops it is a much bigger world than the echo chambers we're used to where the only other users are tech workers and enthusiasts.
- pjmlp 7y ago
  You mean behave like the usual curl ... | sh advice that is so prevalent nowadays?
- badrabbit 7y ago
  No,see that's your assumption I talked about. That's not a targeted attack for example, if someone is targeting you or your org, they will not wait for you to open a random malicious script somewhere. Example: let's say you are not very technical or fairly new to Linux. You visit a hotel and their legitimate captive portal asks you to install a package with a download link which when installed allows secure access, most people in the category i described will install it. Or let's say you visit ubuntiforums or Linux questions a lot and you receive an email from them(you don't know email can be spoofed like 99% of people) about an emergency security advisory for some package,distros are working on a fix but here's a link to a patched package if you want to help test it's stability, good chance majority of users in the category I described would install that package since it came from a trusted source. And fyi, I just described two TTPs of the APT darkhotel: https://attack.mitre.org/groups/G0012/ https://attack.mitre.org/groups/G0012/ My point is, if someone studies you well enough to know what you trust and don't trust, their attacks will tuned to work against you. There are many ways to get pwned and attackers need only one to work. Your expectation that everyone should know all the attack vectors well enough to defend themselves is impractical. Even seasoned pros will overlook verifying downloads with GPG here and therr for example. This isn't just my opinion, you have to assume if targeted, they will at least get initial access.

staticassertion 7y ago

Disclaimer: I'm the author of Grapl[0], which aims to do what you're talking about. Normally I don't really comment on the product on HN, but you're describing Grapl's raison d'être. So, audit is one subsystem people use. ebpf is another. OSQuery[1] is a tool that'll make it pretty easy to hook into audit and collect things like process executions. Once you have instrumentation you want to start writing those rules. This is where systems like ElasticSearch, Splunk, or in the case of my product, Grapl, come in. What Grapl makes particularly easy, and what other systems make quite hard, is the type of detection you're talking about - process tree analysis, or generally any kind of analysis that spans many events/ entities. This is because Grapl will take the instrumentation output and generate a graph, which makes joins across the data quite efficient, and it exposes the graph via Python, so you can express pretty arbitrary logic. Other systems make joins quite painful and slow[2][3] Grapl's not at the point where a power user could just get it up and running - though it will be very soon. I've written detection logic very much like what you're describing though[4]. Linux is actually doing fairly well here, in my opinion. OSX was probably the worst, but the ESF will change this. Windows, with Sysmon, is still probably the simplest and best solution for instrumentation (though ETW is pretty strong too). [0]https://github.com/insanitybit/grapl https://github.com/insanitybit/grapl [1]https://osquery.readthedocs.io/en/stable/ https://osquery.readthedocs.io/en/stable/ [2]https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTutorial/Useasubsearch https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTut... (ctrl + f 'In large production environments, it is possible that the subsearch in this example will timeout before it completes.') [3]https://www.elastic.co/guide/en/elasticsearch/reference/current/parent-join.html#_parent_join_and_performance https://www.elastic.co/guide/en/elasticsearch/reference/curr... [4] https://github.com/insanitybit/grapl-analyzers/blob/master/analyzers/suspicious_svchost/main.py#L9 https://github.com/insanitybit/grapl-analyzers/blob/master/a... , https://github.com/insanitybit/grapl-analyzers/blob/master/analyzers/word_child_process/main.py#L8 https://github.com/insanitybit/grapl-analyzers/blob/master/a...

badrabbit 7y ago
Very interesting, I hope to see your work mature. Expensive EDRs already do this well. The UI,rules and having a place to put the data is hardest part imho. Linux makes things difficult because so many componets are by design reused extensively. I will look into Grapl, thanks for sharing.

pdonis 7y ago

> From a bad guy's perspective, they just need a foot in the door and move laterally if possible. How does the bad guy get a foot in the door?

deleted 7y ago
[deleted]
badrabbit 7y ago
Depends on the bad guy. Social engineering is the best way on desktops. And this is what I meant by assumptions, on windows I can tell you phishing and removable drives are the easiest way. On Linux desktop it simply isn't targeted enough to be confident which attack vectors are common. But you're missing the point, there will always be vulnerabilities. Even if everything is written in Rust, logical vulns exist, default config issues will exist (mongodb and internet exposure for example) and even the smartest people can be phished. Even with a yubikey,if I can trick you into opening a link that will have you download and open a file that will execute code on your machine, I don't need your login because I have your session cookies and I can reverse tunnel traffic through your IP. And I may not even care about that, maybe I just want your ssh private key and I will be on my way.
- pdonis 7y ago
  > Social engineering is the best way on desktops. Nobody uses my Linux desktop/laptop computers but me, and I have no reason to tell anyone else anything about them, so I don't. So I'm not vulnerable to this attack vector. > if I can trick you into opening a link that will have you download and open a file that will execute code on your machine I never click on links unless I know their source. So I'm not vulnerable to this attack vector either. If all that is wrong with the desktop Linux security model is "some users do dumb things", then that's not fixable by any OS. And even with that said, Linux is much better at containing the damage from doing dumb things than, say, Windows.
  - badrabbit 7y ago
    I guarantee you, you will fall for a clever phish. You can't outsmart a good spearphish. You are wrong when you think stupidity is the vuln, the vuln is basic human psychology. But even if you're right, it's not like Linux desktop is made only for people like you right? It wouldn't be "some people are dumb" it would be "almost all people are dumb" even if being dumb was the issue.

swiley 7y ago

It doesn’t have to be; desktop Linux users tend to behave. Go installing random blobs and running scripts from people that download other scripts? Yes you’ll get owned, don’t do that. Even if all your friends are doing it don’t do that.

badrabbit 7y ago
It doesn't work that way. You're assuming. People are people, you can't assume "they'll behave". Let's use China or Russia who switched to Linux desktop for their operations, will their users be any less susceptible to social engineering just because they use linux? Look, what you have to understand is, even in the world of Linux Desktops it is a much bigger world than the echo chambers we're used to where the only other users are tech workers and enthusiasts.
pjmlp 7y ago
You mean behave like the usual curl ... | sh advice that is so prevalent nowadays?
badrabbit 7y ago
No,see that's your assumption I talked about. That's not a targeted attack for example, if someone is targeting you or your org, they will not wait for you to open a random malicious script somewhere. Example: let's say you are not very technical or fairly new to Linux. You visit a hotel and their legitimate captive portal asks you to install a package with a download link which when installed allows secure access, most people in the category i described will install it. Or let's say you visit ubuntiforums or Linux questions a lot and you receive an email from them(you don't know email can be spoofed like 99% of people) about an emergency security advisory for some package,distros are working on a fix but here's a link to a patched package if you want to help test it's stability, good chance majority of users in the category I described would install that package since it came from a trusted source. And fyi, I just described two TTPs of the APT darkhotel: https://attack.mitre.org/groups/G0012/ https://attack.mitre.org/groups/G0012/ My point is, if someone studies you well enough to know what you trust and don't trust, their attacks will tuned to work against you. There are many ways to get pwned and attackers need only one to work. Your expectation that everyone should know all the attack vectors well enough to defend themselves is impractical. Even seasoned pros will overlook verifying downloads with GPG here and therr for example. This isn't just my opinion, you have to assume if targeted, they will at least get initial access.