4

Has anyone had experience with or is aware of any products that hash the OS kernel? This would be used, ideally, for watching for system compromises, auditing, change management, etc. I am looking for products, either open source or commercial, that have this capability. If such a product does not exist, does anyone have any ideas on how this could be done? Also, if this is not currently available, does anyone know of any academic research that has been performed in this arena?

Thanks in advance.

Improve this question

3 Answers 3

Reset to default
3

Yeah its called a tripwire which protects the kernel as well as other binaries. Watching the kernel alone isn't enough. Kernel modules can be loaded at runtime and this wouldn't affect the kernel's hash, but LKM rootkits aren't a problem anymore. Today, even with a tripwrire the machine can still be compromised with a Hypervisor rootkit and a tripwire wouldn't detect this attack. Thew new NIST BIOS protection guidelines are interesting.

Improve this answer
4
  • Is there an easy way in which to see or recall the hash of the kernel? Are you sure it hashes the kernel? I was not aware that it did.
    – John
    May 19, 2011 at 23:54
  • @John why wouldn't it? Its just a file. Tripwire's are heavily configurable.
    – rook
    May 19, 2011 at 23:55
  • 1
    "but LKM rootkits aren't a problem anymore"... Are you sure? Or do you mean they aren't the worst of the problem? I realise the syscall table is read only as of linux 2.6.24 or something, but given this is ring 0 I'm pretty certain you can simply set it to rw like this: memset.wordpress.com/2010/12/03/…
    – user2213
    May 20, 2011 at 16:54
  • @Ninefingers Occasionally a hacker find a vulnerability in Linux that allows LKM's to subvert syscalls, but it takes many months to find a vulnerability like this and its patched in less than a day. LKM rootkits are nearly dead.
    – rook
    May 20, 2011 at 17:35
3

If you have a computer with a TPM you should look the Secure Boot feature.

There is an option in Microsoft Bitlocker to take advantage of TPM 1.2 implementations, and force the TPM to release the keys only if all integrity checks are fine.

Improve this answer
4
  • Does TPM hash the Kernel?
    – John
    May 20, 2011 at 0:09
  • Its odd to see someone support TPM. I find that people are more afraid of TPM as some kind of big brother anti-piracy system.
    – rook
    May 20, 2011 at 1:04
  • 4
    TPM: totally awesome when I control it. Totally miserable when somebody else locks me out of my own machine with it.
    – Jeff Ferland ♦
    May 20, 2011 at 2:26
  • @John yes, TPM's have a measurement functionality that can generate sha-1 hashes of the bios,the os loader and the os image on boot so that you know the pc is booting normally. I think in the windows world bitlocker can make use of such measurements to disallow access if an integrity check fails, but in theory in can be used without encryption.
    – john
    May 20, 2011 at 14:03
2

There's no point to hashing your kernel, especially from Ring-3. If someone actually has kernel privileges, then they can intercept/modify your requests to hash the kernel and output whatever your program would want to see.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .