Date: Wed, 12 Dec 2001 13:05:07 +0100 From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl> To: freebsd-security@freebsd.org Subject: Fw: Re: MD5 sum checking for installed binaries to check for intrusion or root kits... Message-ID: <20011212130507.3a1849a1.kzaraska@student.uci.agh.edu.pl>
next in thread | raw e-mail | index | archive | help
On Tue, 11 Dec 2001 22:39:08 -0800 Landon Stewart wrote: > A while ago (a few months) recently several administrators were let go, > but were left to their own devices in the NOC until late that night. > (Don't ask me why because I couldn't tell ya!) I have not noticed any > strange happenings on any of the systems. I'd like to note that they could also add extra "features" much earlier... > They could have done who knows what to whatever system(s) they wanted > to. Without someone saying "reformat the machines or reinstall" because > thats the obvious answer, is there a way to check which files differ > from the size they should be and have the correct MD5 sum than they > should or is this asking too much? Well I thought about this problem once (though I ended up in moving data to other machine in that case), but _theoretically_... If they are -RELEASE machines you could take install CD for appropriate version and compare binaries on the system with those on the CD. IMVHO they shouldn't differ. Configuration files will have to be analyzed by hand, of course. If a system in question was cvsup'ed and built from sources there is not much that can be done, unfortunately. Binaries installed from ports/packages can be treated the same way, but you'd have to get _exactly_ the same version-revision-patchlevel of each package in question, what may not be possible. pkg_add puts some md5 checksums under /var/db/pkg/ but these are not reliable (if someone could trojan a binary s/he could also modify the database) but you could look for inconsistencies. I would anyhow audit configuration files in first place. Next _theoretically_ a binary update/reinstall (without touching the configuration files) from a trusted source should remove trojaned binaries in base system. I would boot from install floppy (to avoid trojaned kernel etc.) and did a binary upgrade (even to the same version). As I said at the beginnig, this is a _purely theoretical_ discussion. I'm not making any claims that these methods will work. Regards, Krzysztof To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011212130507.3a1849a1.kzaraska>