OpenChaos/Malware Linux

From C4 Wiki
< OpenChaos
Revision as of 13:11, 4 November 2004 by Mario Manno (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Folien unter http://www.mmweg.rwth-aachen.de/~thorsten.holz/summerschool/malware-unix.pdf

runtime kernel patching

  • /dev/kmem - raw i/o capability needed from kernel
  • kmalloc fuer rootkit code
  • suckit aendert pointer auf syscall in der IDT

hide modules by

  • delete module from module list (adore) by changing syscall table
  • modify vfs (adore-ng)
  • parasitic module infection (adore-ng optional), changes the module file
  • runtime-kernel patching (suckit) (copy der syscall table ...idt)
  • static kernel patching - im kernel image code ablegen

Sebek

  • baut sk_buff struct und schickt sie an device

Virus

  • ELF header infection
  • RST.B Virus

rootkit hunter

  • chkrootkit
  • tiger

grsec

  • grsec, trusted path execution, benutzer koennen keine programme ausfuehren die sie schreiben koennen

Antivirus Virus Linux

  • f-prot
  • clamav
  • hb-antivir