Date: Wed, 13 Nov 2019 11:32:00 +0000 From: Patrick Schleizer <adrelanos@...eup.net> To: lkrg-users@...ts.openwall.com Subject: LKRG Security Questions This may be a speculative question, but how likely is it that malware would specifically target LKRG in order to exploit or escalate privileges? Did this happen in-the-wild with off-the-shelf malware  yet? How big is the attack surface that LKRG adds vs the security advantages gained from LKRG? Have there been any reports or first hand experiences with (off-the-shelf) malware vs LKRG yet? Are there any trial exploits and/or instruction to verify LKRG is load and effective? Maybe an automated test suite / unit testing that could be run by developers and/or users? LKRG wouldn't stop "simple" trojan horses? By that, I mean a trojan horse comparable with a "remote SSH shell" or "remote VNC session" which the user is unaware off? I.e. a simple process not trying to gain kernel access. Imagine a user who executes "cute cat" binary, resulting in a forking "remote SSH shell"? Or a browser exploit that starts a "remote SSH shell"? LKRG seems more useful to prevent kernel compromise with the goal to prevent a rootkit and/or with the goal to prevent outbreak from a virtual machine (which may require a chain of exploits such as browser exploit -> kernel exploit -> VM breakout)? Which types of security vulnerabilities (SWAPGS? ...) are (probably) insufficient to bypass LKRG? Quote https://www.openwall.com/lkrg/ > LKRG's current response to kernel integrity violations is merely reporting those in kernel messages (which obviously doesn't mitigate attacks when those are for real) Would it be possible / sane to kernel panic in such cases? Perhaps with a clearly written message on the user's screen for informational purposes? Or dispatch a configurable hook script that could specify the response? Also if/when time allows, could you please consider submitting the LKRG module to the mainline linux kernel? If that makes sense? Even if (likely?) rejected, it might help with popularity, source code review? Kind regards, Patrick  https://www.whonix.org/wiki/Malware#Targeted_Malware_vs_Off-The-Shelf_Malware > Targeted Malware vs Off-The-Shelf Malware > > Targeted malware is the opposite of off-the-shelf malware. > > Targeted malware is specifically crafted against a known target to attack a specific system or limited amount of systems only with the goal to avoid detection by avoiding getting installed on too many where qualified people might detect the malware and publish about it. > > On other other hand, off-the-shelf malware attempts to spread in bulk against bigger groups or the general public with the goal of taking over as many systems as possible. (Defining these terms since often people wonder what I mean by that. Talking to general public, not only to specific people who probably know this already.)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.