RE: chkrootkit and LKM?

From: Andrew Ruef (jabberwocky_at_mediasoft.net)
Date: 06/20/03

  • Next message: Brad: "Re: Unusual registry entries" 
    To: <incidents@securityfocus.com>
Date: Thu, 19 Jun 2003 23:34:59 -0400

    Actually the best way to do that is to turn off module support within
    the kernel and then use some device (the grsecurity kernel patches and
    the StJude LKM both have these) to close down things like access to
    /dev/kmem, /dev/ports, privileged I/O, so on. This closes down other
    avenues for code to be loaded into the kernel.

    A. Ruef

    -----Original Message-----
    From: Tim Greer [mailto:chatmaster@charter.net]
    Sent: Wednesday, June 18, 2003 12:22 PM
    To: Rob Shein; 'Janus N. Tøndering'; incidents@securityfocus.com
    Subject: Re: chkrootkit and LKM?

    > ----- Original Message -----
    > From: "Rob Shein" <shoten@starpower.net>
    > To: "'Tim Greer'" <chatmaster@charter.net>; "'Janus N. Tøndering'"
    <janus@bananus.dk>; <incidents@securityfocus.com>
    > Sent: Wednesday, June 18, 2003 12:47 AM
    > Subject: RE: chkrootkit and LKM?
    >

    > This won't help if it's an LKM...LKM stands for "Linux Kernel Module,"

    For some reason, I just saw 'chrootroot' and not LKM; hence my response.
    Anyway, I always recommend people not compile in loadable module support
    if
    they want a more secure kernel and to avoid this type of problem in the
    future. 

    --
Regards,
Tim Greer  chatmaster@charter.net
Server administration, security, programming, consulting.
------------------------------------------------------------------------
----
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas,
the 
world's premier technical IT security event! 10 tracks, 15 training
sessions, 
1,800 delegates from 30 nations including all of the top experts, from
CSO's to 
"underground" security specialists.  See for yourself what the buzz is
about!  
Early-bird registration ends July 3.  This event will sell out.
www.blackhat.com
------------------------------------------------------------------------
----
----------------------------------------------------------------------------
Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
world's premier technical IT security event! 10 tracks, 15 training sessions, 
1,800 delegates from 30 nations including all of the top experts, from CSO's to 
"underground" security specialists.  See for yourself what the buzz is about!  
Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
----------------------------------------------------------------------------
  • Next message: Brad: "Re: Unusual registry entries"

    Relevant Pages

    • Re: chkrootkit and LKM?
      ... Server administration, security, programming, consulting. ... Subject: chkrootkit and LKM? ... the kernel and then use some device (the grsecurity kernel patches and ... world's premier technical IT security event! ...
      (Incidents)
    • [UNIX] Flaws Found in Recent Linux Kernels (newgrp, symblinks)
      ... Flaws Found in Recent Linux Kernels (newgrp, ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... An attacker can force the kernel to spend almost arbitrary amount of time ... script creates 5 symlinks, each of them containing 2*N+1 path elements. ...
      (Securiteam)
    • [UNIX] Linux Kernel File Offset Pointer Handling
      ... Get your security news from a reliable source. ... The Linux kernel offers a file handling API to the userland applications. ... One of the properties of the file object is something called 'file offset' ... about one page of un-initialized kernel memory and can be exploited to ...
      (Securiteam)
    • [UNIX] Kmail HTML Support Allows Spoofing of Emails Content
      ... Get your security news from a reliable source. ... system call handler in the 2.4 Linux Kernel on the AMD64 platform a local attacker can gain root access using a simple program. ... it contains the sources that the binary kernel rpm packages are created from. ... Since the kernel-source.rpm is an installable package that contains sources for the linux kernel, it is not the source RPM for the kernel RPM binary packages. ...
      (Securiteam)
    • Re: thoughts on kernel security issues
      ... major security figure and/or haven't donated your life to security and ... the developer and more focus on the development. ... That's pretty complex in terms of kernel code, ... > most of the extra patches that distribution kernels apply are patches ...
      (Linux-Kernel)