Known-exploit detection for the kernel

Posted Dec 19, 2013 6:14 UTC (Thu) by wahern (subscriber, #37304)
In reply to: Known-exploit detection for the kernel by PaulWay
Parent article: Known-exploit detection for the kernel

Script kiddies, by definition, don't need to worry about cleaning the logs. That's what their scripts are for. If the scripts don't do it now, they will. Script kiddies do the minimum possible. If you raise the bar, there's no reason to believe that it slows them down one iota.

Adding any security which can be easily circumvented is no security at all. All it takes is one person to write the circumvention code and to share it.

There are people doing the thankless job of actually preemptively scanning the code for vulnerabilities and fixing them. Those guys are priceless. Why they keep doing it when all the fame and adulation goes to this kind of stuff, port knocking, and other crazy schemes.... well, I wish their commitment could spread the same way interest in these schemes do.

These schemes only work as long as they're not widely adopted. Once they're widely adopted, they get added into the kiddie scripts. Then you're left with a bunch of useless code which only adds to your attack surface.

Known-exploit detection for the kernel

Posted Dec 19, 2013 7:11 UTC (Thu) by noxxi (subscriber, #4994) [Link] (3 responses)

From my understanding the code is not to fight new exploits, but to detect if a known and fixed exploit was tried. And because the exploit was fixed the script kiddie will have no way to clean the logs (unless it has another and better exploit).
Thus the log entry can be used as a canary by the admin to detect if an account might be compromised and lock it down before worse exploits will be tried.

Known-exploit detection for the kernel

Posted Dec 19, 2013 7:50 UTC (Thu) by dlang (guest, #313) [Link] (2 responses)

the better shops also ship their logs off of the local systems so that attempts to scrub the logs will fail.

Known-exploit detection for the kernel

Posted Dec 19, 2013 9:36 UTC (Thu) by zlynx (guest, #2285) [Link] (1 responses)

A really well informed attacker can try to jam the log server with nonsense UDP or TCP resets. He'd need access to the log server network of course.

If he can DOS the log server, it won't record anything except a pile of junk. Once he gets root he can kill -9 the log service, clean the logs and restart it.

Just another thing to watch out for.

Known-exploit detection for the kernel

Posted Dec 19, 2013 16:30 UTC (Thu) by Funcan (subscriber, #44209) [Link]

A sufficiently advanced attacked can also break in and steal the log server. I doubt most people are facing that level of APT most of the time though...