Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Has anyone had experience with or is aware of any products that hash the OS kernel? This would be used, ideally, for watching for system compromises, auditing, change management, etc. I am looking for products, either open source or commercial, that have this capability. If such a product does not exist, does anyone have any ideas on how this could be done? Also, if this is not currently available, does anyone know of any academic research that has been performed in this arena?

Thanks in advance.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Yeah its called a tripwire which protects the kernel as well as other binaries. Watching the kernel alone isn't enough. Kernel modules can be loaded at runtime and this wouldn't affect the kernel's hash, but LKM rootkits aren't a problem anymore. Today, even with a tripwrire the machine can still be compromised with a Hypervisor rootkit and a tripwire wouldn't detect this attack. Thew new NIST BIOS protection guidelines are interesting.

share|improve this answer
    
Is there an easy way in which to see or recall the hash of the kernel? Are you sure it hashes the kernel? I was not aware that it did. –  John May 19 '11 at 23:54
    
@John why wouldn't it? Its just a file. Tripwire's are heavily configurable. –  Rook May 19 '11 at 23:55
1  
"but LKM rootkits aren't a problem anymore"... Are you sure? Or do you mean they aren't the worst of the problem? I realise the syscall table is read only as of linux 2.6.24 or something, but given this is ring 0 I'm pretty certain you can simply set it to rw like this: memset.wordpress.com/2010/12/03/… –  user2213 May 20 '11 at 16:54
    
@Ninefingers Occasionally a hacker find a vulnerability in Linux that allows LKM's to subvert syscalls, but it takes many months to find a vulnerability like this and its patched in less than a day. LKM rootkits are nearly dead. –  Rook May 20 '11 at 17:35
add comment

If you have a computer with a TPM you should look the Secure Boot feature.

There is an option in Microsoft Bitlocker to take advantage of TPM 1.2 implementations, and force the TPM to release the keys only if all integrity checks are fine.

share|improve this answer
    
Does TPM hash the Kernel? –  John May 20 '11 at 0:09
    
Its odd to see someone support TPM. I find that people are more afraid of TPM as some kind of big brother anti-piracy system. –  Rook May 20 '11 at 1:04
4  
TPM: totally awesome when I control it. Totally miserable when somebody else locks me out of my own machine with it. –  Jeff Ferland May 20 '11 at 2:26
    
@John yes, TPM's have a measurement functionality that can generate sha-1 hashes of the bios,the os loader and the os image on boot so that you know the pc is booting normally. I think in the windows world bitlocker can make use of such measurements to disallow access if an integrity check fails, but in theory in can be used without encryption. –  john May 20 '11 at 14:03
add comment

There's no point to hashing your kernel, especially from Ring-3. If someone actually has kernel privileges, then they can intercept/modify your requests to hash the kernel and output whatever your program would want to see.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.