Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database stored on an external machine or media, but lets say that is not the case, and everything is just on one machine.

Firstly these programs would necessarily be detected right? Through Cron or RC scripts or even just as a running process...or do they take steps to hide and obscure themselves?

If they do hide themselves, what steps could an attacker take to detect them?

Let's say an attacker manages to end the process...will they report this? Can an attacker just end and then restart the process without this being reflected in the logs?

What about notifications....can they be prevented from sending out notifications?

I think HIDS is a very interesting and useful technology, but as with anything I know it cannot be solely relied on, so am interested in the types of attacks against these systems. If anyone knows other sources of information I would appreciate it also.

share|improve this question
3  
can you split these out into 4 separate questions - that way you should expect more focused answers. Also, before posting have a good google (as per the faq) as some of your answers are instantly available there. –  Rory Alsop Jun 2 '11 at 7:55
add comment

1 Answer

up vote 1 down vote accepted

Would Tripwire's use on a system would be detected by malware?

While a properly secured system would make it difficult to detect system security measure like Tripwire, I believe a sophisticated piece of malware could detect the presence of Tripwire or another HIDS. A program like Tripwire is no necessarily hidden, but it is protected by OS access controls. For example removing other read permission to the directory /usr/local/tripwire is not so much hiding as protecting.

Do HIDS [they] take steps to hide and obscure themselves?

Tripwire itself, excluding how an administrator sets it up on a system, does not attempt to hide itself from detection by malware. Tripwire does encrypt and authenticate its configuration and database files. Again I would describe this as protection instead of hiding.

What steps could an attacker take to detect them?

It depends on the system and what vulnerabilities it has. Attacks can be very inventive, and do anything from exploiting specific library functions, to using unintended signaling channels. For example, an attacker developed a method of determining characters in a password by monitoring page-faults.

"Let's say an attacker manages to end the HIDS process...will they report this?"

Depending on how the process was ended a HIDS may or may not explicitly log the unexpected termination. However, a properly configured system should explicitly log the unexpected termination of a security program. Even if the system did not explicitly log the unexpected termination the fact would be easily discoverable by evidence like a missing or incomplete audit report.

"Can an attacker just end and then restart the process without this being reflected in the logs?"

If the system is properly configured, usually no. If the system kept all its audit and logging data locally, the attacker was sophisticated, and the attacker effected a full access compromise, then yes the attacker could modify the HIDS logs to show normal operation.

"What about notifications....can they be prevented from sending out notifications?"

Again it depends on the system, how its security is constructed, and the sophistication of the attacker. A HIDS can be configured to send e-mail or other types of notifications, and the system may be configured to protect those notifications.

share|improve this answer
    
"While a properly secured system would make it difficult to detect system security measure like Tripwire" -- why is it difficult... isn't just which tripwire? –  mehaase Aug 15 '12 at 1:10
    
@mehaase mv tripwire leg-obstacle; echo obfuscation is fun; or simply make permissions such that only the tripwire user process can read the executable or directory structure containing tripwire –  this.josh Aug 28 '12 at 14:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.