Re: RPM aware rootkits?

From: Chris Green (cmg@uab.edu)
Date: 02/13/02 

To: Anton Chuvakin <anton@chuvakin.org>
From: Chris Green <cmg@uab.edu>
Date: Wed, 13 Feb 2002 15:32:17 -0600

Anton Chuvakin <anton@chuvakin.org> writes:
>
> Do you know any of the RPM-aware rootkits for Linux which will not be
> detected by "rpm --verify". I would prefer direct edit of /var/lib/rpm
> rather to trojaned rpm binary, but what the heck - whatever will do.

Just create a modified rpm and install it instead of the first one.
RPM will do all the edits for you.

> I need to deploy something on Linux which will pass the "rpm -V", but will
> involve replacing some binaries. I can rebuild the stuff from source
> RPMs, recreate the package and then replace the stock RPM., but it is too
> messy (GPG sig will be different, but that will hopefully be OK for the
> honeypot).

rpm --checksig is a preinstallation check that will check the signed
package but not the signed extracted contents.

The rpm -V quick check should still come back silent. -V is really
meant to be more of a "did I change anything" than a "did an attacker
change anything".

What won't work in this situation is attackers that have the md5sums
or signatures for various binaries on the machine that you are
intending to replace.

HTH, 

-- 
Chris Green <cmg@uab.edu>
I've had a perfectly wonderful evening. But this wasn't it.
     -- Groucho Marx

Relevant Pages

  • [PATCH 1/2] kbuil: add deb-pkg target
    ... # To prepare kbuild for more kernel packaging formats move all packaging ... # In top-level Makefile introduce generic support for all package ... Included the old rpm target for backward ... # and builddeb scripts. ...
    (Linux-Kernel)
  • Re: Conventions for NFS sharing of binaries
    ... Do you have distro & local packages with same name? ... mount it r/w on your "master installation machine" (with RPM management). ... If you replace a package with a different one with the same name, hmm, you ...
    (comp.os.linux.misc)
  • Re: ./configure command
    ... The package is not available. ... machines which don't even have an OS at all, let alone RPM, ... There is not a "the tool to package and install on Fedora". ... If he wants to avoid trouble, ...
    (Fedora)
  • Re: Redhat to Freebsd
    ... >>researching security updates or in performing kernel or package updates. ... >>I assume it is only the Redhat distro that has the ease of RPM installation? ... So you can build from sources with ports, or install binaries ...
    (comp.unix.bsd.freebsd.misc)
  • Re: checkinstall type utility for binary distributions
    ... >deb) package from source distributed in a tarred format. ... >advantage of rpm wrt un-installation, etc, where no rpm source ... Well, I see it at sunsite as part of the Slackware 'slack390' distribution, ... I never recommend them trying to install anything ...
    (comp.os.linux)