Date: Fri, 22 May 1998 10:02:46 +1000 (EST) From: Nicholas Charles Brawn <ncb05@uow.edu.au> To: freebsd-security@FreeBSD.ORG Subject: Re: Virus on FreeBSD Message-ID: <Pine.SOL.3.96.980522100017.17145A-100000@banshee.cs.uow.edu.au> In-Reply-To: <199805211431.KAA17444@brain.zeus.leitch.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 21 May 1998, Greg A. Woods wrote: > [ On Thu, May 21, 1998 at 11:19:29 (+0930), Mark Newton wrote: ] > > Subject: Re: Virus on FreeBSD > > > > LKMs open vast new vistas of potential for viruses, btw. I attended a > > series of seminars given my Kirk some number of years ago, where he > > said the decision to avoid expending development time on LKMs for 4.4BSD > > was partly motivated by the security concerns raised by the ability to > > move executable code from user-space (i.e.: the filesystem) into the > > kernel. Mitnick's SunOS "tap" streams module is but one example :-) > > A "published" LKM that can do the most nasty things was in the Phrack > newsletter issue #51. > > Anyone who's read that article and has even the tiniest amount of > imagination would *NEVER* run LKMs on a production machine. Sure > they're a great tool for doing OS developement and experimention at the > lowest levels, but they're more dangerous in a production environment > than not even having a root password in the first place (at least with > the latter you *know* your security is blown). > > (And that's just one reason never to run SunOS-5 in production! ;-) > > I'd love to have a "virus" scanner that could detect the signature of a > LKM module or the LKM loader in a kernel. Of course by "signature" here > I mean something that would recognize the style of code necessary to > perform this operation, not the specific sequence of bits in any given > implementation. You may have a point here. Is there any way you could "sign" a module to ensure it's authenticity? And on top of that build in an automatic authentication system within the kernel that rejects lkm's that are not signed? Perhaps this could be included so as to be performed at one of the securelevels? > > -- > Greg A. Woods > > +1 416 443-1734 VE3TCP <gwoods@acm.org> <robohack!woods> > Planix, Inc. <woods@planix.com>; Secrets of the Weird <woods@weird.com> > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe security" in the body of the message > Nick -- Email: ncb05@uow.edu.au - DE 30 33 D3 16 91 C8 8D A7 F8 70 03 B7 77 1A 2A http://rabble.uow.edu.au/~nick - public key available on request. Nicholas Brawn - Computer Science Undergraduate, University of Wollongong. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.SOL.3.96.980522100017.17145A-100000>