Unix/Linux Security Myth ~

Unix/Linux Security Myth ~ - Security & Cryptography

Users browsing this thread: 1 Guest(s)

	pvtmert Offline \| 15-07-2014, 04:36 PM \| #18

first things first, sorry to resurrect old thread.

lets suppose you have downloaded an unknown application that's precompiled.
that program waches and sends keystrokes to remote server... for that it needs root access. it should ask for access... why that program needs root... you wont allow it problem solved.

Code:
crw-r----- 1 root root 13, 64 Jul 15 19:00 event0

crw-r----- 1 root root 13, 65 Jul 15 19:00 event1

crw-r----- 1 root root 13, 74 Jul 15 19:00 event10

crw-r----- 1 root root 13, 75 Jul 15 19:00 event11

crw-r----- 1 root root 13, 76 Jul 15 19:00 event12

crw-r----- 1 root root 13, 77 Jul 15 22:10 event13

crw-r----- 1 root root 13, 66 Jul 15 19:00 event2

crw-r----- 1 root root 13, 67 Jul 15 19:00 event3

crw-r----- 1 root root 13, 68 Jul 15 19:00 event4

crw-r----- 1 root root 13, 69 Jul 15 19:00 event5

crw-r----- 1 root root 13, 70 Jul 15 19:00 event6

crw-r----- 1 root root 13, 71 Jul 15 19:00 event7

crw-r----- 1 root root 13, 72 Jul 15 19:00 event8

crw-r----- 1 root root 13, 73 Jul 15 19:00 event9

crw-r----- 1 root root 13, 63 Jul 15 19:00 mice

crw-r----- 1 root root 13, 32 Jul 15 19:00 mouse0

crw-r----- 1 root root 13, 33 Jul 15 19:00 mouse1

crw-r----- 1 root root 13, 34 Jul 15 22:10 mouse2

graph #1

lets suppose hacker find a way to watch keystrokes w/o needing root privilages. (thats not gonna happen look at graph #1)
then you noticed an unwanted 'movement' when looking iftop / htop / top whatever you want, then you 'killed' that process... with SIGKILL
what will that process do (unlike windows, it is KILLED)

again lets think about that process somehow gained root access and copied itself over $SHELL's location i will use /bin/sh, and moved that shell to /bin/.sh so process runs itself before that shell and forks original one to make itself 'invisible' to user.
you have noticed opening new xterm or logging in requires 'suspiciously longer' time and when digging recursive order you found /bin/.sh file, you checked 'x'sum of (md5,sha256 whatever) that .sh and sh files you found out sh is a 'fake' and .sh is original...
basically moving .sh to sh will OVERWRITES it but you should close all another shell sessions before doing it... use the script like that:

Code:
#!/bin/.sh

mv /bin/.sh /bin/sh

killall -9 sh

exit 0

well, if that not worked shutdown your computer fire up with some 'live' distro... go to desired folder do your job and exit. you can test it by with chroot environment...

so where is your virus now :)

Code:
Slax 7.0.8 (32-bits + PAE)

----- BEGIN GEEK CODE BLOCK-----

Version: 3.1

GE/CS/CM/S d+@ s-:- a--- C++++(++) UL+++ P+ L+++ E?() W+++(++) N? o? K- w+ 

O M-- V- PS+ PE Y? PGP- t+ 5? X++++(+++) R- !tv b+ DI? D- G e- h+ r-- z--

------END GEEK CODE BLOCK------