3 ms·

Keep in mind that, if the attacker gets code execution on your box, everything the box says is a lie if he wants it to be. You may catch some dumb attackers wh

by patio11 12y ago

Keep in mind that, if the attacker gets code execution on your box, everything the box says is a lie if he wants it to be. You may catch some dumb attackers who leave readily available evidence of compromise, but there exists off-the-shelf ratware which is not amenable to discovery via simply diffing. As to where else a worm/virus can hide in your Mac: everywhere. Got a hard disk with writable firmware? It could be in the firmware. If you ask the firmware "Hey, apropos of nothing, do you contain a virus?" it will say "No, no, only totally authorized hard disk firmware here. Feel absolutely safe about reading executable instructions from me."

atmosx 12y ago
> Keep in mind that, if the attacker gets code execution on your box, everything the box says is a lie if he wants it to be. Sure, but in real life that's extremely unlikely. I never seen such a 'rootkit', meaning a rk complete at every level that disguises EVERYTHING (processes, connections, evades anti-rk software, etc.). It's been many years since the last time I was interested in security so things might have changed, but given the amount, time and effort that such a rootkit would take (to target specific OSes/versions) I'd say that it's highly unlikely unless it's gov-founded.
- walterbell 12y ago
  How would you know, unless you booted from read-only media that contained signatures of known-good files?
  - atmosx 12y ago
    I can only judge by what I see, I can't judge real life applications by theorising about what's possible and I remember playing around with rootkits since adore-ng (by TT), which was fairly sophisticated back in the day.
    - walterbell 12y ago
      If you're going to judge, that implies you have at least looked for information on which to base a judgement. In this case, "looking" is not possible with a compromised OS, it requires booting from forensic media. Edit: to downvoter, you may want to read Phrack April 2014, http://www.phrack.org/papers/revisiting-mac-os-x-kernel-rootkits.html http://www.phrack.org/papers/revisiting-mac-os-x-kernel-root...
- acdha 12y ago
  > I never seen such a 'rootkit', meaning a rk complete at every level that disguises EVERYTHING Isn't that the same as saying you'd only notice an incompetent attack? I've seen this twice (public web server running a student's exploitable PHP followed by a kernel 0-day) – once it was possible to see it due to a bug in the hiding logic (IIRC it compromised ps but not /proc) but the other was unnoticeable on the box itself. This was a decade ago and it was neither uncommon nor particularly sophisticated back then – the actual kernel exploit used to install it was novel but the rootkit code was widely available. I caught both of these attacks quickly because they were foolish enough to use IRC as a control channel and our IDS immediately caught the traffic – want to bet against someone realizing there are stealthier ways to report home?
tonyplee 12y ago
That's why I trust git more than anything else, especially compare to the typical "Anti-virus" software. git is written by Linus, open source, whole algorithm is based on file content change detection, base on hashes, etc. If my server software is corrupted initially by XXX gov agency at the Debian website, well, I can't do anything about it. If someone did management to add any additional software to the server after I add all file contents to git and clone it to a different server, I have strong confident I can detect any changes happen in the system with ease. Patio11, I have great respect for you works, blogs, etc. Assume you can hack/overwrite any piece of code in that server to anyway you want, what kind of changes can make so my git clone/backup system failed to detect your changes? Even if you can hack the git executable to tell me nothing has changes, I think when I do a remote git pull with the original git binaries, I can see the modifications. Right?

by patio11 12y ago

atmosx 12y ago

> Keep in mind that, if the attacker gets code execution on your box, everything the box says is a lie if he wants it to be. Sure, but in real life that's extremely unlikely. I never seen such a 'rootkit', meaning a rk complete at every level that disguises EVERYTHING (processes, connections, evades anti-rk software, etc.). It's been many years since the last time I was interested in security so things might have changed, but given the amount, time and effort that such a rootkit would take (to target specific OSes/versions) I'd say that it's highly unlikely unless it's gov-founded.

walterbell 12y ago
How would you know, unless you booted from read-only media that contained signatures of known-good files?
- atmosx 12y ago
  I can only judge by what I see, I can't judge real life applications by theorising about what's possible and I remember playing around with rootkits since adore-ng (by TT), which was fairly sophisticated back in the day.
  - walterbell 12y ago
    If you're going to judge, that implies you have at least looked for information on which to base a judgement. In this case, "looking" is not possible with a compromised OS, it requires booting from forensic media. Edit: to downvoter, you may want to read Phrack April 2014, http://www.phrack.org/papers/revisiting-mac-os-x-kernel-rootkits.html http://www.phrack.org/papers/revisiting-mac-os-x-kernel-root...
acdha 12y ago
> I never seen such a 'rootkit', meaning a rk complete at every level that disguises EVERYTHING Isn't that the same as saying you'd only notice an incompetent attack? I've seen this twice (public web server running a student's exploitable PHP followed by a kernel 0-day) – once it was possible to see it due to a bug in the hiding logic (IIRC it compromised ps but not /proc) but the other was unnoticeable on the box itself. This was a decade ago and it was neither uncommon nor particularly sophisticated back then – the actual kernel exploit used to install it was novel but the rootkit code was widely available. I caught both of these attacks quickly because they were foolish enough to use IRC as a control channel and our IDS immediately caught the traffic – want to bet against someone realizing there are stealthier ways to report home?

tonyplee 12y ago

That's why I trust git more than anything else, especially compare to the typical "Anti-virus" software. git is written by Linus, open source, whole algorithm is based on file content change detection, base on hashes, etc. If my server software is corrupted initially by XXX gov agency at the Debian website, well, I can't do anything about it. If someone did management to add any additional software to the server after I add all file contents to git and clone it to a different server, I have strong confident I can detect any changes happen in the system with ease. Patio11, I have great respect for you works, blogs, etc. Assume you can hack/overwrite any piece of code in that server to anyway you want, what kind of changes can make so my git clone/backup system failed to detect your changes? Even if you can hack the git executable to tell me nothing has changes, I think when I do a remote git pull with the original git binaries, I can see the modifications. Right?