Cc: <davecb@...>, <rmeijer@...>, Alan Cox <alan@...>, <capibara@...>, Eric Paris <eparis@...>, Theodore Tso <tytso@...>, Rik van Riel <riel@...>, <linux-security-module@...>, Adrian Bunk <bunk@...>, Mihai Don??u <mdontu@...>, <linux-kernel@...>, <malware-list@...>, Pavel Machek <pavel@...>, Arjan van de Ven <arjan@...>
On Mon, Aug 18, 2008 at 11:44 AM, <david@lang.hm> wrote:
Matters directly for 2 cases to the Linux system itself.
First case HIDS spotting alteration to something like if someone
places signature files on a NTFS partition for some reason when it was
placed there it was X permission now its Y better inform the user that
this has happened. Without being able to see the disk permissions
this could be missed due to no translation of permissions to vfs. We
have Ubuntu users in this mix they will put it on NTFS if they are low
of disk space.
Second case is file system mount options changing the files that are
displayed in vfs so a full partition scan by a scanner running in
Linux is a full disk scan not some files missed here or there due to
hidden permissions and processing in the file system driver.
Next bits I think is not understanding how some defence tech works and
lack of experience in forensics.
Full hids monitoring does not depend on known how the OS will
interpret it picking up that month after month something has never
been changed and then all of a sudden something is changed to alert
you to look deeper. Its more of a warning bell so that works without
ever understanding 100 percent how the permissions work. When
compared to other machines setup in the same kind of way more fine
defects can turn up. Same software Same applications same profiles
sent from server should be a 99 percent match other than SID number
being different. Most of that variation from each other should turn
up in the first week of usage. HIDS is basically anything stepping
out side normal go off.
Doing forensic recoveries on things I have learnt yes you can
duplicate how a OS will interpret its disk permissions. Complexity
is directly linked to how tidy the OS's permission system is.
Windows is surprisingly not that bad. Linux and BSD are level 10
pricks due to the fact config file over here may completely provide
access where disk permissions say no then you have the LSM permissions
to over lay. So its a pain in tail to duplicate how some OS's would
interpret it but 100 percent do able if you know the software on top
even how that reacts is predictable without running it. Forensic
working out a attack you do it. Since running the OS only makes the
threat active worse let the threat cover its trail. Lot of white
listing is performed in the process to confirm that programs have not
been messed with. So there configuration files processing can be
trusted. Its simply another myth that it cannot be done. Off-line
scanning can be done if the scanner is setup for it yes more complex
process having to read stuff like the windows registry that is poorly
documented. For fully documented OS's 100 its nothing more than
processing time. Complete work out of course need the applications on
top that is of course documentation of operation again. So no
magical non understandable stuff here.
Peter Dolding.
--
