DOCSLIB.ORG

Tripwire Rootkit

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Tripwire Rootkit Χͅ Tripwire ƘƘƘƘ ȻȻȻȻ <<<< ʘʘʘʘ HHHH ͰͰͰͰ ȻȻȻȻ ÒÒÒÒ ǦǦǦǦ Rootkit LLLL ĤĤĤĤ ɊɊɊɊ ͌͝Ǎ 1111 zzzz 1111 ZZZZ ···· ̫̫̫̫ ǥǥǥǥ ££££ ɋɋɋɋ E-mail: [email protected] ŴŴŴŴ ŮŮŮŮ Mode ! Kernel Moded H ~ Ï ől f Ð Ω + ¤ZΩǻ ɾ ǻ Á ɯ Ȇ ɨ ĺ B ģ ̵ ől Ω ̇H ,¢ʲ ¿+,ɻ Ĝ ºUʲ ¿Ω+,ɻ Ĝ x ɞ ˊ ő ʈ ΩǮ ĺ ģ ϧ Ŏ š ñ$Ƭ ȷ Ò !" # ő l Ωɻ ǟ l m !c © ʃ ʃ Ï +,F G H Μ %ɯ l $ %& ' Linux(Windows) * +,Ω- . !/ ¤ºˣ¾ Ŏ H Kernel mode Rootkit x ʲ ¿+, 0 1ɯ Ȇ 2 3 4 Ω5 6 7 8 9:Rootkit; < = ɑ !¨c > ɑ Rʲ ¿¦$Ɍ ͼ Ü Ņ ǂ NJ >? Ɠ _ ǂ NJ .+,$H RF G H U á ?Χ ͅ § ã @ ABC D E Linux +,F G H ΩI J K š BC D & ' User Mode Rootkit K š L M ¢Ë ͣ Q L M N 2 ) * +,O P QRS User Mode e Rootkit ΩÎ w g h !5 6 š ñ%¶ ȿ ΩX Rootkit ? T U V W Ω X Y Z [ \ ] ^ _ ` Y a b1X Y Qe!Òs Rootkit B k Y +,l m Chkrootkit a bX Y c d QeΩ Rootkitf & ' A Ωn o h K ŎÒ ʡX Y Òs Rootkiti A{ | Ò Qe Rootkit g h i j Tripwire 1k Y +,l s Rootkit ; < = >} X Y ~ ¢Ƌ ` è é ê ë m Ωn o h %Ep q r\ N 2 RÒs Rootkit U ķ e+,F G H % +,F G H ~ Ǯ ĺ Ωςϡ ʱ t u Ωvc f !Qew Rootkit Ux t u Ωvc ʡ5 6 Ωl m ǂ NJ ? y z' @ ŎN 2 Òs Rootkiti A{ | Òs Rootkit ; < = >} X Y ~ ?Bε & Ű Å Ŕɾ ̓ 2. &&&& ϐϐϐϐ ̨̨̨̨ ƍ Y ¢ %Ý Ͷ U{ X Y Z [ } ͟ ȿ ʫ ? %ñ ς& ' Rootkit L M Ĝ ŷ J ΩW ǩ ¨ ΚɎď X Y +,RootkitLinux © l g ˛ õ £ !¤¶ ΩX Y 7 8 ) Ʌ͌ : 2.1 Rootkit ̨ 1. ++ ɚɚ %ñ & ' Rootkit ΩNJ G !ø ` ) ùɅ͌ : ' ͅ ģ \ 5 6 +,Ω H Ŏɚ ñ H R+ (1) Rootkit ΩNJ G O jú ® 5 6 û ÿ Uƌ ģ [6]º ,F G H ɯ ¤΋Ĝ ͼ ɞ ˊ Ŗ = Ωˣ¾ O Ĝ Ɖ Ů 5 6 û ÿ Ʌ͌ 9ñ : Ωa ) ?+,¡ R ¢£ $ F G H ¤ ¥ ¦+ û ÿ 1:/ 0 Ë ͣ :Rootkit x Τ ư) * +,{ ʆ ,§ Ω¨© l O P ª O « ¬ ­ ­ O ® ¯ 1 Ω± ͒ ͽ Ωų ͒ Ǥ ɻ Ĝ (Server Process)(ǻ Á ²?³Ů ´ ɡ ¤¶ · Z w X Y Ω/ 0 $ E) ͒ ͽ ʃ ʃ O P ¶ Ĕ Ü § Ω- . Ê %_ ` * +,B¸ 1M ε ͅ O BC D _ ` Linux +,Ω / 0 ' ǜ 1k ˖ ñ Y ¢ Ωų ͒ Ǥ ɻ ¨© l ¹ j Tripwire [11],[13]k Y a b1X Y ºl Ĝ ¶ û ø ¦ƱN Ϝ¶ Ĕ Ü § Ω- . ? m Ωn o h i %» ʈ O P ñ¼ ½ ¤ Ω_ ` H ʲ û ÿ 2:Ƌ ` / 0 :5 6 H x Ƌ ` +,Ω/ 0 ŎV ¿?U%Ů ɕ BΩÁ  l m Rt u Ω²Ã V W º W 2 ɻ Ĝ ͘ (code) ɻ Ĝ ͘ U{ ʆ Ω͒ ͽ X Y Z [ O Ä Ů B Å H ÆÇ Ω? ñ ͠ (ª « ® Ϊ š ǁ ļ ? È ŎŰ Ĩ 2 ¤Ω Rootkit · Ů O & ' Linux û ÿ 3:ɞ ˊ ˣ¾ : Ƌ ` / 0 +,¦x ^ ) * +,c d Ω Rootkit Ê Ë ñʗ Í Î w :User £ $ root ¤ ¥ ¢E+,¨© l \ ɳ ͘ U¶ 5 6 ΩŹ ¾ Ê %Ï 5 6 H f K š 5 6 Ω E ∩ E Sim ( S , S ) = i j Øɻ \ ɞ ˊ 5 6 H Ωl m c © } i j + (1) E i E j O ɞ ˊ Ŗ = Ωˣ¾ ¢ ʞ ñ Ð _ ` 2 root ϖ Ω¤ ¥ ? û ÿ 4: ! ": 5 6 H £ $ +,# £ ¤ ¥ ¦ 2.3 ̦ĭƖʍ˛ğʯ Ɠ _ NJ 1Ω/ 0 $ T% R& ͘ ª O x Ĕ ɕ c Forrest [14]ʃ d H Ƌ ` system call 1ª « ' ® (3 ( "ɻ Ĝ (backdoor)? e ͒ ͽ « ) š ñø ¶ Ωg ˛ R fTP Øɻ \ R (2) f & ' User mode ! Kernel mode ʗ Í Rootkit $ g h T 3 _ ͒ ͽ i š Ω@ j b 9:H X p q k Ωø ` ) Ʌ͌ : x ¶ H X system call Ωª « B l ¦m Ɍ ͼ n User mode Rootkit O Ű ) * ʡΩ Rootkit$ Ü Ͷ ~ n ^ ʡÜ Ņ « ) Ωg ˛ R ?ŎP Q n ^ ʡ O Ű + , R- 1_ ` Ωa bº_ ` . ͼ O x Ω« ) g ˛ R $o p ` _ q BΩ͒ ͽ H X q B / 0 (ɞ ˊ ͅ +,\ « ) Ωø ` ɻ Ĝ !+, H X ͒ ͽ ª $ Er 1Øs t ȿ u ? l m ºø ` ñɞ ˊ 5 6 H ɻ Ĝ "ɻ Ĝ E_ ` H v w x y ¨© l \ Ê %z Á _ _ 1 2 ɻ Ĝ !3 4 ɻ Ĝ [1],[7]? ` H Ω) { š ñ| Ê p ` ͅ X Y BZ Ǥ 5 6 f Kernel mode Rootkit [5]ñ Kernel 5 6 \ Ű 7 ' ͅ } Ǥ 5 6 X Y s t ¶ ~ Ə ΁ B ¶ Q ͒ ͽ O H Ŏ¶ Ω Rootkitz User mode Rootkit 8 ¶ ̲ _ ` H ɮ ʡBZ Ǥ ƱÊ %# £ ? Ƌ ` LKM(Loadable Kernel Module)Ω\ t ~ ɠ È z' l m Ω# ȫ R Ê % Á ɯ Q l ~ Ê Ï 5 6 H 15 6 +,Q¹ ģ ñŰ Μ X Y m ¶ Rt u 5 Ɍ ͼ E\ $ e²Ã Ω1ϕ @ ŎΜ Ω Rootkitºø ` ñɞ ˊ ɻ ǟ ɞ ˊ ǻ Á 9 %Á  +,§ Ω- . ?fO ¹ jz' l m Ω# ȫ R :ɞ ˊ LKM Ω Ƌ ` LKM ; < = > } +,\ ɯ Q ¨© l ¶ R¼ ½ ¤ Ω_ ` H t u !¿Òl m ΩΪ š ? ØÊ %i A Á O P ¶ š ñf » ʈ O P Q ¹ Ről ? ĜĜĜĜ ŷŷŷŷ {{{{ ΩΩΩΩ ŰŰŰŰ ǩǩǩǩ 2.2 @ Añ s Æ͈ ưN ²Ã Ω1ϕ %Ê %{ X Y Ω4 Bg ˛ ķ ) ? O ¼ @ g ˛ U ʆ ől ΩͶ c BC D I Ʊ+,¨© l !l m %_ ` ; ,ΩA B C D E Ĝ 1W ǩ º4 BĜ ŷ J Ω# ȫ (hash)R 1K š Ë ͣ ¢_ ` OhKimΩĜ O x F G :H@ I ςJ g ˛ K š @ u ) ¦ ŷ J W ǩ . Ĝ ¶ « ¬ Ω4 Bg ˛ Ĝ ŷ J W ǩ K L Ω? O C D H Ω· M N O ŎP Q · M N O Ω . ͼ f Π ͋ § õ p Ω¨© l g ˛ z' Ɲ ǩ ͼ Ʊ g ˛ R ķ ) ? x S ¶ Q T ΩU V ? Ê %$ ʡs ʃ ΩX Y :H? OhKimT2004W { 2 Í H X ͅ %­ A B C D ΩY Z 1W ǩ 4 BĜ ŷ J [8]?ºǩ Ĝ 9E Ĝ 2.4 ¤¤¤¤ ĮĮĮĮ ͰͰͰͰ ȻȻȻȻ ǶǶǶǶ ĔĔĔĔ (1)U[ º\ S , S N Ϝʗ 9 \ p q 4 B E ∩ E i j i j c d X Y rootkitΩ7 8 Ê ΄ Ë ñR1 Î [12]: N Ϝʗ 4 B\ á ' vc (item)] ^ Ω® ̇Ŏ E 1 ] , Ř Ğ X Y ɷ >Ĝ X Y š ñX Y g ˛ X Y E N Ϝ_ 4 B\ á ' vc Ω` ̇a b 1Ʌ: 2 n o h X Y ?Ʊ%§ ã RÍ X Y 7 8 ΩŤ ˢ 0 1 ³ S = A,B,C,D S = A,C, D, E . E = {AB, AC, AD, 1 { } 2 { } 1 ) Ʌ͌ : BC, BD,CD} E = 6E = {AC, AD, AE,CD,CE, DE} 1 2 1. ] , Ř Ğ X Y (Cross view based detection) = ∩ = ∩ = Ŏ E 2 6 E1 E2 {AC, AD,CD} E1 E2 3 S1 Ť 0 :Ê k Y +,l m (File)ɻ ǟ (Process) ! S ΩĜ ŷ J Sim(S , S ) ñ1/2? 2 1 2 !Z ͘ (Registry key)? ˢ 0 :o ø ` ͅ Windows+,ΩX Y 7 8 2. ɷ >Ĝ X Y (Hardware detection) Ť 0 : Òs Rootkit Z [ · Ů jX Y ¸ ɻ ¨© l g ˛ (1)i ¶ Ŗ = ΩCPU¢ŀ ØDMA' ¨c >' ǜ ? z' Ɲ ǩ ͼ ΩV W 1¹ º ? (2)b¶ N ɻ J ΩX Y ģ H? ˢ 0 :ʁ ϐ l 1 @ Ωģ B \ !Ȃ X ? 3.1 ͰͰͰͰ ȻȻȻȻ ÜÜÜÜ ɻɻɻɻ LLLL ģģģģ ŰŰŰŰ 3. š ñX Y (Behavioral detection) Bε & T Linux +,§ :õ Chkrootkit ! Ť 0 : Tripwire ʗ ® X Y a b¢V W 2 X Y Òs Rootkit (1)~ ά ě ¡ Qe(% eΩ¢ £ (; < = >? Ω X Y Z [ & ' P ʗ ® X Y Z [ Ω û ¨ l (2)H ʁ Ů 8 r ºg ˛ (¢ £ ͘ ʡp q r\ ? (Response)1ª « « = ¢ķ e+,F G H ~ ά y ˢ 0 : \ Ω » G ? % ñ ¼ ½ B C D U { 2 } Χ ͅ (1)UV N Ωš ñ¤ ¥ H ͈ ¦ N Æ͈ § ģ U ¨ Tripwire k Y a b%X Y Òs Rootkit } X Y Z [ (false positive)? ºX Y ¸ ɻ 9Ĺ 1 U[ : (2)Ɍ ͼ ¡ © g N Ω¢ £ (; < = >? 4. g ˛ X Y (Signature based detection) Ť 0 : (1)Ǯ ĺ B ¥ ¬ ě © ¤¶ QeΩ¢ £ (; < = >? (2)H x ɯ « U ¨ (false positive)(ª « ¨ (false negative)? (3)o ʁ r ¬ r Ω¢ £ ͘ (g ˛ ʡp q r\ Ɠ Ê Ĺ 1 +,X Y ¸ ɻ X Y 2 r Ω¢ £ (; < = >? ¹ j Chkrootkit Detection k Y +,B ¢% X Y ˢ 0 : ʡ Rootkitf K û _ ` Bε & U{ 2 } X Y Z [ (1)̲ 1 @ Ωp q r? \ Ω Tripwire Detection Ê i % X Y Ò s Ω (2)Ɍ ͼ X Y % ew Ω¢ £ (; < = >? Rootkit9Ĺ 2 U[ ¿ºĜ Κ û ÿ 9ñ U[ : 5. n o h X Y (Integrity based detection) Ť 0 : (1)Ê Ǯ ĺ Ωɯ ¤+,l m O P R­ ® ? (2)H ʁ 8 r g ˛ (¢ £ ͘ ʡp q r\ ? (3)Ê ¶ ȿ ΩX Y +,O P R¼ ½ ¤ _ ` H ? ˢ 0 : (1)Ɍ ͼ ě ¯ ; < ¢ £ (; < = >š ñ? (2)³+,Ωl m t u ņ ± .Æ͈ ² ³ U ¨ ? ´ õ § ã ΩË ͣ zs Χ ͅ ñ ~ ¶ ȿ X Y ! Ĺ 2 Χ ͅ Tripwire } X Y ¸ ɻ Ǝ ¶ · # ģ BO | BC D ς_ ` g ˛ X Y !n o û ÿ 1:T Tripwire Detection \ ¦ʁ Ů ^ ! h X Y 1 V W X Y Z [ % _ ¶ ȿ X Y Ò s NJ .l (Policy File)¢V N Ů ' +,l m Rootkit? y Á Q Ωk  u ) ςAà .Ä ʡNJ .l Å? 3.
Load more

Recommended publications
  • The Science DMZ
    The Science DMZ Brian Tierney, Eli Dart, Eric Pouyoul, Jason Zurawski ESnet Supporting Data-Intensive Research Workshop QuestNet 2013 Gold Coast, Australia July 2, 2013 What’s there to worry about? © Owen Humphreys/National Geographic Traveler Photo Contest 2013 7/2/13 2 Lawrence Berkeley National Laboratory U.S. Department of Energy | Office of Science The Science DMZ in 1 Slide Consists of three key components, all required: “Friction free” network path • Highly capable network devices (wire-speed, deep queues) • Virtual circuit connectivity option • Security policy and enforcement specific to science workflows • Located at or near site perimeter if possible Dedicated, high-performance Data Transfer Nodes (DTNs) • Hardware, operating system, libraries all optimized for transfer • Includes optimized data transfer tools such as Globus Online and GridFTP Performance measurement/test node • perfSONAR Details at http://fasterdata.es.net/science-dmz/ Lawrence Berkeley National Laboratory U.S. Department of Energy | Office of Science Overview Part 1: • What is ESnet? • Science DMZ Motivation • Science DMZ Architecture Part 2: • PerfSONAR • The Data Transfer Node • Data Transfer Tools Part 3: • Science DMZ Security Best Practices • Conclusions Lawrence Berkeley National Laboratory U.S. Department of Energy | Office of Science The Energy Sciences Network (ESnet) A Department of Energy Facility Naonal Fiber footprint Distributed Team of 35 Science Data Network Internaonal Collaboraons Mul3ple 10G waves 5 Lawrence Berkeley National Laboratory U.S. Department of Energy | Office of Science ESnetSC Supports Supports Research DOE at More Office than 300 of Institutions Science Across the U.S. Universities DOE laboratories The Office of Science supports: 27,000 Ph.D.s, graduate students, undergraduates, engineers, and technicians 26,000 users of open-access facilities 300 leading academic institutions 17 DOE laboratories 6 Lawrence Berkeley National Laboratory U.S.
    [Show full text]
  • Intrusion Detection Systems (IDS)
    Intrusion Detection Systems (IDS) Adli Wahid Role of Detection in Security • Part of security monitoring o Violation of security policies o Indicators of compromise o Threat drive or Vulnerability driven o What’s happening on the network? • Rules o Detection is based on rules • Action • What do we do when detection happens? • Alert and Investigate • Drop / Block Perspective – Adversary Tactics and Techniques • Mitre Att&ck Framework https://attack.mitre.org • Tactics – what are the goals of the adversary? • Technique – how do they do it? • SubJect to: o Resources o Platforms • Can we used this knowledge for detection? o Observe Adversaries Behaviour o Techniques, Tactics and Procedures (TTPs) o Deploy in prevention, detection, response Your Adversaries Motives Infrastructure Targets Behaviour Your Assets Your Systems Reference: https://published-prd.lanyonevents.com/published/rsaus19/sessionsFiles/13884/AIR-T07-ATT%26CK-in-Practice-A-Primer-to-Improve-Your-Cyber-Defense-FINAL.pdf Reference: https://published-prd.lanyonevents.com/published/rsaus19/sessionsFiles/13884/AIR-T07-ATT%26CK-in-Practice-A-Primer-to-Improve-Your-Cyber-Defense-FINAL.pdf Making Your Infrastructure Forensics Ready • Detecting known or potentially malicious activities • Part of the incident response plan • If your infrastructure is compromised o Can you answer the questions: what happened and since when? o Can we ‘go back in time’ and how far back? • What information you you need to collect and secure? • Centralized logging Intrusion Detection Systems • An intrusion
    [Show full text]
  • BSD UNIX Toolbox 1000+ Commands for Freebsd, Openbsd
    76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iii BSD UNIX® TOOLBOX 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD®Power Users Christopher Negus François Caen 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page ii 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page i BSD UNIX® TOOLBOX 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page ii 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iii BSD UNIX® TOOLBOX 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD®Power Users Christopher Negus François Caen 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iv BSD UNIX® Toolbox: 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD® Power Users Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2008 by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-470-37603-4 Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 Library of Congress Cataloging-in-Publication Data is available from the publisher. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permis- sion should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions.
    [Show full text]
  • Hodetector: the Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine 1393
    HODetector: The Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine 1393 HODetector: The Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine YongGang Li1, 2, ChaoYuan Cui1, BingYu Sun1, WenBo Li3* 1 Institute of Intelligent Machine, Chinese Academy of Sciences, China 2 School of Information Science and Technology, University of Science and Technology of China, China 3 Institute of Technology Innovation, Chinese Academy of Sciences, China [email protected], {cycui, bysun, wbli}@iim.ac.cn Abstract objects for virtual machine security. For virtualization security, the traditional secure With the spread of malwares, the security of virtual tools detecting malwares are placed into the guest VM machine (VM) is suffering severe challenges recent years. (GVM) that may be injected by computer viruses. So, Rootkits and their variants can hide themselves and other it’s possible that the secure tool will be bypassed or kernel objects such as processes, files, and modules cheated. For example, a rootkit named f00lkit can making malicious activity hard to be detected. The bypass Chkrootkit and Rkhunter, the most popular anti- existed solutions are either coarse-grained, monitoring at malwares tools in Linux. Compared with the traditional virtual machine level, or non-universal, only supporting method, one mechanism called out-of-box [3] detecting specific operating system with specific modification. In malwares out of VM is a better way, because the this paper, we propose a fine-grained approach called secure tool is outside any span of malwares. Then HODetector based on static semantic information library another problem appears: semantic gap [4].
    [Show full text]
  • A Brief Study and Comparison Of, Open Source Intrusion Detection System Tools
    International Journal of Advanced Computational Engineering and Networking, ISSN: 2320-2106, Volume-1, Issue-10, Dec-2013 A BRIEF STUDY AND COMPARISON OF, OPEN SOURCE INTRUSION DETECTION SYSTEM TOOLS 1SURYA BHAGAVAN AMBATI, 2DEEPTI VIDYARTHI 1,2Defence Institute of Advanced Technology (DU) Pune –411025 Email: [email protected], [email protected] Abstract - As the world becomes more connected to the cyber world, attackers and hackers are becoming increasingly sophisticated to penetrate computer systems and networks. Intrusion Detection System (IDS) plays a vital role in defending a network against intrusion. Many commercial IDSs are available in marketplace but with high cost. At the same time open source IDSs are also available with continuous support and upgradation from large user community. Each of these IDSs adopts a different approaches thus may target different applications. This paper provides a quick review of six Open Source IDS tools so that one can choose the appropriate Open Source IDS tool as per their organization requirements. Keywords - Intrusion Detection, Open Source IDS, Network Securit, HIDS, NIDS. I. INTRODUCTION concentrate on the activities in a host without considering the activities in the computer networks. Every day, intruders are invading countless homes On the other hand, NIDS put its focus on computer and organisations across the country via virus, networks without examining the hosts’ activities. worms, Trojans, DoS/DDoS attacks by inserting bits Intrusion Detection methodologies can be classified of malicious code. Intrusion detection system tools as Signature based detection, Anomaly based helps in protecting computer and network from a detection and Stateful Protocol analysis based numerous threats and attacks.
    [Show full text]
  • Ten Strategies of a World-Class Cybersecurity Operations Center Conveys MITRE’S Expertise on Accumulated Expertise on Enterprise-Grade Computer Network Defense
    Bleed rule--remove from file Bleed rule--remove from file MITRE’s accumulated Ten Strategies of a World-Class Cybersecurity Operations Center conveys MITRE’s expertise on accumulated expertise on enterprise-grade computer network defense. It covers ten key qualities enterprise- grade of leading Cybersecurity Operations Centers (CSOCs), ranging from their structure and organization, computer MITRE network to processes that best enable effective and efficient operations, to approaches that extract maximum defense Ten Strategies of a World-Class value from CSOC technology investments. This book offers perspective and context for key decision Cybersecurity Operations Center points in structuring a CSOC and shows how to: • Find the right size and structure for the CSOC team Cybersecurity Operations Center a World-Class of Strategies Ten The MITRE Corporation is • Achieve effective placement within a larger organization that a not-for-profit organization enables CSOC operations that operates federally funded • Attract, retain, and grow the right staff and skills research and development • Prepare the CSOC team, technologies, and processes for agile, centers (FFRDCs). FFRDCs threat-based response are unique organizations that • Architect for large-scale data collection and analysis with a assist the U.S. government with limited budget scientific research and analysis, • Prioritize sensor placement and data feed choices across development and acquisition, enteprise systems, enclaves, networks, and perimeters and systems engineering and integration. We’re proud to have If you manage, work in, or are standing up a CSOC, this book is for you. served the public interest for It is also available on MITRE’s website, www.mitre.org. more than 50 years.
    [Show full text]
  • Detecting Kernel Rootkits
    Dartmouth College Dartmouth Digital Commons Computer Science Technical Reports Computer Science 9-2-2008 Detecting kernel rootkits Ashwin Ramaswamy Dartmouth College Follow this and additional works at: https://digitalcommons.dartmouth.edu/cs_tr Part of the Computer Sciences Commons Dartmouth Digital Commons Citation Ramaswamy, Ashwin, "Detecting kernel rootkits" (2008). Computer Science Technical Report TR2008-627. https://digitalcommons.dartmouth.edu/cs_tr/314 This Technical Report is brought to you for free and open access by the Computer Science at Dartmouth Digital Commons. It has been accepted for inclusion in Computer Science Technical Reports by an authorized administrator of Dartmouth Digital Commons. For more information, please contact [email protected]. Detecting kernel rootkits Ashwin Ramaswamy Department of Computer Science Dartmouth College Masters Thesis Proposal Dartmouth Computer Science Technical Report TR2008-627 Proposal Presentation Date: 2 September, 2008 Abstract Kernel rootkits are a special category of malware that are deployed directly in the kernel and hence have unmitigated reign over the functionalities of the kernel itself. We seek to detect such rootkits that are deployed in the real world by first observing how the majority of kernel rootkits operate. To this end, comparable to how rootkits function in the real world, we write our own kernel rootkit that manipulates the network driver, thus giving us control over all packets sent into the network. We then implement a mechanism to thwart the attacks of such rootkits by noticing that a large number of the rootkits deployed today rely heavily on the redirection of function pointers within the kernel. By overwriting the desired function pointer to its own function, a rootkit can perform a proverbial man-in-the-middle attack.
    [Show full text]
  • Unix/Mac/Linux OS Malware 10/15/2020
    Unix/Mac/Linux OS Malware 10/15/2020 Report #: 202010151030 Agenda • Executive Summary • Origin of Modern Operating Systems • Overview of Operating Systems o Desktop o Servers o Super Computers o Mobile o Attack Surface and CVEs • Malware Case Studies o Drovorub o Hidden Wasp o Operation Windigo o MAC Malware Slides Key: • Defending Against Malware The picture can't be displayed. Non-Technical: Managerial, strategic and high- • Summary level (general audience) The picture can't be displayed. Technical: Tactical / IOCs; requiring in-depth knowledge (system admins, IRT) TLP: WHITE, ID# 202010151030 2 Executive Summary • Unix and Unix-like systems drive most of today's computer systems. • Vulnerabilities and malware • Threat mitigation o Comprehensive security policies o Access control o Regular updates and backups o Training employees o Improving posture and maturity TLP: WHITE, ID# 202010151030 3 Modern Operating Systems "Determining the operating system on which the server runs is the most important part of hacking. Mostly, hacking is breaking into the target's system to steal data or any such purpose. Hence, the security of the system becomes the thing of prime importance." Source: Parikh, K. (2020, August) The Hackers Library Functions of Operating Systems Timeline of the Origins of Operating Systems TLP: WHITE, ID# 202010151030 4 Overview of Operating Systems (Non-Mobile) Unix Chrome OS •Derived from Original AT&T Unix •Free and open-source •Command-line input •Graphical user interface •Very popular among scientific, •Based on Linux
    [Show full text]
  • Network Security Presentation
    http://bit.ly/2LamWxj Network Security & Performance Jason Zurawski Scott Chevalier [email protected] [email protected] ESnet / Lawrence Berkeley National Laboratory Indiana University International Networks Linux Cluster Institute (LCI) Introductory Workshop University of Oklahoma May 15-16, 2019 This document is a result of work by volunteer LCI instructors and is licensed under CC BY- NC-ND 4.0 (https://creativecommons.org/licenses/by-nc-nd/4.0/). National Science Foundation Award #1826994 https://epoc.global Science DMZ as Security Architecture • Allows for better segmentation of risks, more granular application of controls to those segmented risks. • Limit risk profile for high-performance data transfer applications • Apply specific controls to data transfer hosts • Avoid including unnecessary risks, unnecessary controls • Remove degrees of freedom – focus only on what is necessary • Easier to secure • Easier to achieve performance • Easier to troubleshoot Science DMZ Security • Goal : Disentangle security policy and enforcement for science flows from security for business systems • Rationale • Science data traffic is simple from a security perspective • Narrow application set on Science DMZ • Data transfer, data streaming packages • No printers, document readers, web browsers, building control systems, financial databases, staff desktops, etc. • Security controls that are typically implemented to protect business resources often cause performance problems • Separation allows each to be optimized Performance is a Core Requirement •Core information security principles • Confidentiality, Integrity, Availability (CIA) •In data-intensive science, performance is an additional core mission requirement: CIA PICA • CIA principles are important, but if the performance isn’t there the science mission fails • This isn’t about “how much” security you have, but how the security is implemented • Need to appropriately secure systems without performance compromises Motivations • The big myth: The main goal of the Science DMZ is to avoid firewalls and other security controls.
    [Show full text]
  • Evaluating the Availability of Forensic Evidence from Three Idss: Tool Ability
    Evaluating the Availability of Forensic Evidence from Three IDSs: Tool Ability EMAD ABDULLAH ALSAIARI A thesis submitted to the Faculty of Design and Creative Technologies Auckland University of Technology in partial fulfilment of the requirements for the degree of Masters of Forensic Information Technology School of Engineering, Computer and Mathematical Sciences Auckland, New Zealand 2016 i Declaration I hereby declare that this submission is my own work and that, to the best of my knowledge and belief, it contains no material previously published or written by another person nor material which to a substantial extent has been accepted for the qualification of any other degree or diploma of a University or other institution of higher learning, except where due acknowledgement is made in the acknowledgements. Emad Abdullah Alsaiari ii Acknowledgement At the beginning and foremost, the researcher would like to thank almighty Allah. Additionally, I would like to thank everyone who helped me to conduct this thesis starting from my family, supervisor, all relatives and friends. I would also like to express my thorough appreciation to all the members of Saudi Culture Mission for facilitating the process of studying in a foreign country. I would also like to express my thorough appreciation to all the staff of Saudi Culture Mission for facilitating the process of studying in Auckland University of Technology. Especially, the pervious head principal of the Saudi Culture Mission Dr. Satam Al- Otaibi for all his motivation, advice and support to students from Saudi in New Zealand as well as Saudi Arabia Cultural Attaché Dr. Saud Theyab the head principal of the Saudi Culture Mission.
    [Show full text]
  • 6.4.0-0 Release of SIMP, Which Is Compatible with Centos and Red Hat Enterprise Linux (RHEL)
    SIMP Documentation THE SIMP TEAM Sep 16, 2020 Contents 1 Level of Knowledge 3 1.1 Quick Start................................................4 1.2 Changelogs................................................4 1.3 SIMP Getting Started Guide....................................... 64 1.4 SIMP User Guide............................................ 81 1.5 Contributing to SIMP.......................................... 228 1.6 SIMP Security Concepts......................................... 263 1.7 SIMP Security Control Mapping..................................... 282 1.8 Vulnerability Supplement........................................ 642 1.9 Help................................................... 644 1.10 License.................................................. 652 1.11 Contact.................................................. 652 1.12 Glossary of Terms............................................ 652 Index 669 i ii SIMP Documentation This is the documentation for the 6.4.0-0 release of SIMP, which is compatible with CentOS and Red Hat Enterprise Linux (RHEL). This guide will walk a user through the process of installing and managing a SIMP system. It also provides a mapping of security features to security requirements, which can be used to document a system’s security conformance. Warning: Be EXTREMELY CAREFUL when performing copy/paste operations from this document! Different web browsers and operating systems may substitute incompatible quotes and/or line endings in your files. The System Integrity Management Platform (SIMP) is an Open Source
    [Show full text]
  • Securing Debian Manual
    Securing Debian Manual Javier Fernández-Sanguino Peña <[email protected]> ‘Authors’ on this page Version: 3.13, Sun, 30 Jan 2011 19:58:16 +0000 Abstract This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribu- tion installation, it also covers some of the common tasks to set up a secure network environ- ment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team. Copyright Notice Copyright © 2002-2007 Javier Fernández-Sanguino Peña Copyright © 2001 Alexander Reelsen, Javier Fernández-Sanguino Peña Copyright © 2000 Alexander Reelsen Some sections are copyright © their respective authors, for details please refer to ‘Credits and thanks!’ on page 28. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 (http://www.gnu.org/licenses/ old-licenses/gpl-2.0.html) or any later version (http://www.gnu.org/copyleft/ gpl.html) published by the Free Software Foundation. It is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY. Permission is granted to make and distribute verbatim copies of this document provided the copyright notice and this permission notice are preserved on all copies. Permission is granted to copy and distribute modified versions of this document under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.
    [Show full text]