Re: RPM aware rootkits?

From: Chris Green (cmg@uab.edu)
Date: 02/13/02 

To: Anton Chuvakin <anton@chuvakin.org>
From: Chris Green <cmg@uab.edu>
Date: Wed, 13 Feb 2002 15:32:17 -0600

Anton Chuvakin <anton@chuvakin.org> writes:
>
> Do you know any of the RPM-aware rootkits for Linux which will not be
> detected by "rpm --verify". I would prefer direct edit of /var/lib/rpm
> rather to trojaned rpm binary, but what the heck - whatever will do.

Just create a modified rpm and install it instead of the first one.
RPM will do all the edits for you.

> I need to deploy something on Linux which will pass the "rpm -V", but will
> involve replacing some binaries. I can rebuild the stuff from source
> RPMs, recreate the package and then replace the stock RPM., but it is too
> messy (GPG sig will be different, but that will hopefully be OK for the
> honeypot).

rpm --checksig is a preinstallation check that will check the signed
package but not the signed extracted contents.

The rpm -V quick check should still come back silent. -V is really
meant to be more of a "did I change anything" than a "did an attacker
change anything".

What won't work in this situation is attackers that have the md5sums
or signatures for various binaries on the machine that you are
intending to replace.

HTH, 

-- 
Chris Green <cmg@uab.edu>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx

Relevant Pages

  • Re: TeX Live, Fedora and tlmgr
    ... doesn't update binaries between releases. ... What TeXLive would bring me is a package manager. ... For Red Hat and similar rpm based systems you can use the dummy rpm ...
    (comp.text.tex)
  • [PATCH 1/2] kbuil: add deb-pkg target
    ... # To prepare kbuild for more kernel packaging formats move all packaging ... # In top-level Makefile introduce generic support for all package ... Included the old rpm target for backward ... # and builddeb scripts. ...
    (Linux-Kernel)
  • Re: Conventions for NFS sharing of binaries
    ... Do you have distro & local packages with same name? ... mount it r/w on your "master installation machine" (with RPM management). ... If you replace a package with a different one with the same name, hmm, you ...
    (comp.os.linux.misc)
  • Re: ./configure command
    ... The package is not available. ... machines which don't even have an OS at all, let alone RPM, ... There is not a "the tool to package and install on Fedora". ... If he wants to avoid trouble, ...
    (Fedora)
  • Re: Backing up whole system
    ... Amanda is packaged by Fedora and if Gene feels that the packages are ... fedora's rpm is/was incapable of handling the nuances of using only enough ... When an rpm package can build a complete user from scratch, ... Do you really believe that rpm can install every package under the sun, ...
    (Fedora)