3 ms·

How can it run packet dumping as a non-root user?

• tedunangst 12y ago
  LD_PRELOAD? ptrace? Updated: Actually, I have no idea. The securelist link says "It uses techniques that don't require root access" but then later says "The module statically links PCAP libraries, and uses this code to get a raw socket". I have no idea how one gets a raw socket without root, but I'm not in the business of creating raw sockets on linux...
  • 0x0 12y ago
    Not sure I follow, can a non-root user observe raw packets (like SYN packets and sequence numbers) through these facilities? Edit: well, a statically linked pcap is still just a bunch of user-mode assembly code. I didn't think linux kernel security hinged on keeping libraries secret :P
    • tedunangst 12y ago
      I tried interpreting the ars article (rookie mistake) and assumed it was stealing traffic from other programs running as the same user.
      • 0x0 12y ago
        Aha, now I see why you brought up ptrace. But they were talking about magic syn packets etc (in the securelist post linked from another comment, I got the sources mixed up)
• jerf 12y ago
  In addition to tedunagnst, as we're talking malware, consider also "kernel exploits". Even if the malware doesn't ship with an exploit, a normal UNIX user has enough privs to examine the kernel version and download and execute code that may exploit the given kernel.
  • 0x0 12y ago
    That's slightly less interesting. If you gain root then there's not much to it for dumping packets or hiding processes and open files and sockets or anything, really. Why would the article highlight "intercept network packets as a non-root user" of all things (paraphrased)
    • jerf 12y ago
      My words "in addition to" were not extraneous.
• nisa 12y ago
  No idea.. I've found a reference to cd00r and the source documents various techniques quite well: https://www.phenoelit.org/stuff/cd00r.c https://www.phenoelit.org/stuff/cd00r.c