3 ms·

> Keep in mind that, if the attacker gets code execution on your box, everything the box says is a lie if he wants it to be. Sure, but in real life that's extr

by atmosx 12y ago

> Keep in mind that, if the attacker gets code execution on your box, everything the box says is a lie if he wants it to be. Sure, but in real life that's extremely unlikely. I never seen such a 'rootkit', meaning a rk complete at every level that disguises EVERYTHING (processes, connections, evades anti-rk software, etc.). It's been many years since the last time I was interested in security so things might have changed, but given the amount, time and effort that such a rootkit would take (to target specific OSes/versions) I'd say that it's highly unlikely unless it's gov-founded.

walterbell 12y ago
How would you know, unless you booted from read-only media that contained signatures of known-good files?
- atmosx 12y ago
  I can only judge by what I see, I can't judge real life applications by theorising about what's possible and I remember playing around with rootkits since adore-ng (by TT), which was fairly sophisticated back in the day.
  - walterbell 12y ago
    If you're going to judge, that implies you have at least looked for information on which to base a judgement. In this case, "looking" is not possible with a compromised OS, it requires booting from forensic media. Edit: to downvoter, you may want to read Phrack April 2014, http://www.phrack.org/papers/revisiting-mac-os-x-kernel-rootkits.html http://www.phrack.org/papers/revisiting-mac-os-x-kernel-root...
acdha 12y ago
> I never seen such a 'rootkit', meaning a rk complete at every level that disguises EVERYTHING Isn't that the same as saying you'd only notice an incompetent attack? I've seen this twice (public web server running a student's exploitable PHP followed by a kernel 0-day) – once it was possible to see it due to a bug in the hiding logic (IIRC it compromised ps but not /proc) but the other was unnoticeable on the box itself. This was a decade ago and it was neither uncommon nor particularly sophisticated back then – the actual kernel exploit used to install it was novel but the rootkit code was widely available. I caught both of these attacks quickly because they were foolish enough to use IRC as a control channel and our IDS immediately caught the traffic – want to bet against someone realizing there are stealthier ways to report home?

by atmosx 12y ago

walterbell 12y ago

How would you know, unless you booted from read-only media that contained signatures of known-good files?

atmosx 12y ago
I can only judge by what I see, I can't judge real life applications by theorising about what's possible and I remember playing around with rootkits since adore-ng (by TT), which was fairly sophisticated back in the day.
- walterbell 12y ago
  If you're going to judge, that implies you have at least looked for information on which to base a judgement. In this case, "looking" is not possible with a compromised OS, it requires booting from forensic media. Edit: to downvoter, you may want to read Phrack April 2014, http://www.phrack.org/papers/revisiting-mac-os-x-kernel-rootkits.html http://www.phrack.org/papers/revisiting-mac-os-x-kernel-root...

acdha 12y ago

> I never seen such a 'rootkit', meaning a rk complete at every level that disguises EVERYTHING Isn't that the same as saying you'd only notice an incompetent attack? I've seen this twice (public web server running a student's exploitable PHP followed by a kernel 0-day) – once it was possible to see it due to a bug in the hiding logic (IIRC it compromised ps but not /proc) but the other was unnoticeable on the box itself. This was a decade ago and it was neither uncommon nor particularly sophisticated back then – the actual kernel exploit used to install it was novel but the rootkit code was widely available. I caught both of these attacks quickly because they were foolish enough to use IRC as a control channel and our IDS immediately caught the traffic – want to bet against someone realizing there are stealthier ways to report home?