0

A linux server has Node.js installed with the http-server package. The server will respond to requests on port 80 with a file in the same directory named index.html.

An interesting characteristic of this server is that it exposes full read access to guest users via ssh. Any file on the system can be read by guests (except the SSL private key). Guest users can confirm that the SHA hashes of the node, http-server, and ssh binaries on the system match reference versions, and can confirm that those binaries are the currently running processes.

Is it possible for an attacker (via privilege escalation) or the owner of the server to modify the server in such a way that it serves a different version of index.html to specific IP addresses, while hiding this fact from any third party?

Improve this question
2
  • Hashes and processes can be faked by the sshd binary or the kernel. If you are wanting more details, you may need to provide more details, this sounds like homework.
    – David Houde
    Commented Dec 7, 2014 at 2:05
  • I'm not too worried about the hash functions being faked, since a third party could copy the target binary/file to another machine before verifying. Additionally, it's a given that the kernel must be trusted. Your point about a faked sshd binary is really interesting though. Basically the server could be taken offline, all existing SSH sessions are terminated, and the old sshd is replaced by a malicious version that displays a fake filesystem that looks like the old one. At least the third party users would know when their sessions get terminated though.
    – user62052
    Commented Dec 7, 2014 at 3:08

2 Answers 2

Reset to default
2

As long as you don't setup the server yourself you cannot be sure that what you are seeing with ssh is actually what is happening on the server. At the end your ssh access could just be a well built honeypot and nothing you see there relates to real server activity.

Even if you've setup the server yourself you cannot be sure, because there is still the BIOS, the firmware on the network cards, router in between client and server etc. All of these can affect what data get actually transferred to the client but all of these could be used to compromise the data.

And even if ssh shows the proper state of the server and no router, iptables or others are tampering with the server provided data: there might still be an in-memory malware like Darkleech affecting what actually gets served. You will not detect this when looking at the process table and you will not detect this when looking at the files, because it is just in the memory of the HTTP server.

Improve this answer
1

Iptables can do this without any difficulty.

Create a chain for the target IP address(es) and within that chain, modify the inbound request packet so that the request is for a different file.

Alternatively, you could modify the outgoing packets so that they contain the target file instead of the original contents of index.html.

None of the binaries or files would have been altered in any way. The only necessary change is in the running iptables config.

Of course, if you have that kind of access, you could also modify the process that does the SHA verification of the files and binaries so that it returns false results. You could be running IIS on Windows and still return the SHA hashes for Node on Linux.

Improve this answer
3
  • Thanks for your answer! Suppose the server has no software packages other than the necessary ones to serve index.html. And if software like iptables was installed, it would be considered a 'red flag' that could be detected by a third party.
    – user62052
    Commented Dec 7, 2014 at 1:46
  • I'm asking this question from a pretty theoretical standpoint. This doesn't have to be a fast or efficient server. It's only necessary characteristic is to be verifiable by third parties.
    – user62052
    Commented Dec 7, 2014 at 1:54
  • @user62052 take a look at TPM remote attestation, it tries to do exactly what you want by giving remote hosts the ability to prove that the software running on a particular host wasn't tampered with.
    – user42178
    Commented Dec 7, 2014 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .