[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 Nov 2019 11:32:00 +0000
From: Patrick Schleizer <adrelanos@...eup.net>
To: lkrg-users@...ts.openwall.com
Subject: LKRG Security Questions
This may be a speculative question, but how likely is it that malware
would specifically target LKRG in order to exploit or escalate
privileges? Did this happen in-the-wild with off-the-shelf malware [1] yet?
How big is the attack surface that LKRG adds vs the security advantages
gained from LKRG?
Have there been any reports or first hand experiences with
(off-the-shelf) malware vs LKRG yet?
Are there any trial exploits and/or instruction to verify LKRG is load
and effective? Maybe an automated test suite / unit testing that could
be run by developers and/or users?
LKRG wouldn't stop "simple" trojan horses? By that, I mean a trojan
horse comparable with a "remote SSH shell" or "remote VNC session" which
the user is unaware off? I.e. a simple process not trying to gain kernel
access. Imagine a user who executes "cute cat" binary, resulting in a
forking "remote SSH shell"? Or a browser exploit that starts a "remote
SSH shell"? LKRG seems more useful to prevent kernel compromise with the
goal to prevent a rootkit and/or with the goal to prevent outbreak from
a virtual machine (which may require a chain of exploits such as browser
exploit -> kernel exploit -> VM breakout)?
Which types of security vulnerabilities (SWAPGS? ...) are (probably)
insufficient to bypass LKRG?
Quote https://www.openwall.com/lkrg/
> LKRG's current response to kernel integrity violations is merely
reporting those in kernel messages (which obviously doesn't mitigate
attacks when those are for real)
Would it be possible / sane to kernel panic in such cases? Perhaps with
a clearly written message on the user's screen for informational
purposes? Or dispatch a configurable hook script that could specify the
response?
Also if/when time allows, could you please consider submitting the LKRG
module to the mainline linux kernel? If that makes sense? Even if
(likely?) rejected, it might help with popularity, source code review?
Kind regards,
Patrick
[1]
https://www.whonix.org/wiki/Malware#Targeted_Malware_vs_Off-The-Shelf_Malware
> Targeted Malware vs Off-The-Shelf Malware
>
> Targeted malware is the opposite of off-the-shelf malware.
>
> Targeted malware is specifically crafted against a known target to attack a specific system or limited amount of systems only with the goal to avoid detection by avoiding getting installed on too many where qualified people might detect the malware and publish about it.
>
> On other other hand, off-the-shelf malware attempts to spread in bulk against bigger groups or the general public with the goal of taking over as many systems as possible.
(Defining these terms since often people wonder what I mean by that.
Talking to general public, not only to specific people who probably know
this already.)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
