Staying one step ahead of the intruders
Prevention
Internet intruders have many ingenious ways of escalating privileges and hiding their presence once they get inside your system. The best protection is to keep them out in the cold.
Just when you think you've mastered the art of intrusion protection, the cyber-criminals discover new some techniques for slipping through your security. Attackers use every possible advantage to stay hidden and gain control. Shouldn't you use every trick to keep them out?
This month's cover story focuses on techniques for keeping intruders off your system. In our lead-off article, "Who's There: Single Packet Port Knocking with fwknop," we study a powerful technique that lets you keep your firewall ports closed to all unauthorized users – but still open to traffic from friends. The next article, "Closing the Book: Fighting Dictionary Attacks with Sshutout and Fail2ban," discusses a pair of tools that will help you keep intruders from guessing your passwords.
Next, we show you how to apply more flexible and precise permissions to files and other objects using Access Control Lists (ACLs). We end with a workshop on the powerful security tool known as SELinux.
Getting In
Read on for more about locking down your Linux system – but first we take a quick look at exactly why this elaborate dance of security is even necessary. The rest of this introduction examines rootkits in the Linux environment.
What if someone broke into your Linux system and replaced the login program with a malignant variant. The new login finds out your username and password and sends the data it collects through a hole it has punched in your firewall to a server somewhere in the wild. No one suspects the new login, although the intruder suspects that an attentive system administrator might eventually wonder about the change in the file size.
But Internet criminals have a way of covering their tracks. Along with the manipulated login tool, the attacker smuggles in a modified ls program. This new version of ls masks any changes to the size or modification date for the login program.
The attacker also decides to replace several other system programs that work together to gather information and hide any evidence of the intrusion. Even anti-virus programs are powerless because the manipulated tools fool them, too.
This scenario is by no means fiction. Attackers often bring along a collection of tools that captures information, opens backdoors, and conceals their activities. This bundle of weapons is commonly known as a rootkit.
A rootkit typically comprises multiple components that fill various needs:
- A trojan drops the rootkit and anchors it on the system.
- A sniffer analyzes the network traffic and retrieves the access credentials.
- In some cases, keyloggers log keyboard input to capture passwords or PINs before the system can encrypt them.
- A backdoor gives the attacker access to the system.
All of these activities are camouflaged by replacing system files and, for current rootkits, redirecting API calls. Other components then put the computer to use – possibly for distributing spam or performing denial of service attacks.
Innovation
In the early days, rootkits simply replaced popular system tools such as ls, passwd, or ps. Security experts soon learned how to detect these early rootkits, and malware programmers soon learned to target the kernel itself.
If an attacker manages to inject malicious code into the kernel, the offending kernel code can capture and redirect any request.
Rootkits running in kernel space are particularly hard to discover. On Linux, kernel rootkits are often injected through a kernel module, which explains why they are known as LKM (for Loadable Kernel Module) rootkits.
Rootkit developers use various approaches to infest the kernel. One option is to manipulate the memory directory via /dev/kmem.
Firmware
Firmware rootkits provide an alternative attack vector. They infect the PC's firmware and survive a reboot. Some rootkits feel quite at home in the ACPI firmware routines. A clean rescue disk is little help against this kind of threat.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Juno Computers Launches Another Linux Laptop
If you're looking for a powerhouse laptop that runs Ubuntu, the Juno Computers Neptune 17 v6 should be on your radar.
-
ZorinOS 17.1 Released, Includes Improved Windows App Support
If you need or desire to run Windows applications on Linux, there's one distribution intent on making that easier for you and its new release further improves that feature.
-
Linux Market Share Surpasses 4% for the First Time
Look out Windows and macOS, Linux is on the rise and has even topped ChromeOS to become the fourth most widely used OS around the globe.
-
KDE’s Plasma 6 Officially Available
KDE’s Plasma 6.0 "Megarelease" has happened, and it's brimming with new features, polish, and performance.
-
Latest Version of Tails Unleashed
Tails 6.0 is based on Debian 12 and includes GNOME 43.
-
KDE Announces New Slimbook V with Plenty of Power and KDE’s Plasma 6
If you're a fan of KDE Plasma, you'll be thrilled to hear they've announced a new Slimbook with an AMD CPU and the latest version of KDE Plasma desktop.
-
Monthly Sponsorship Includes Early Access to elementary OS 8
If you want to get a glimpse of what's in the pipeline for elementary OS 8, just set up a monthly sponsorship to help fund its continued existence.
-
DebConf24 to be Held in South Korea
Busan will be the location of the latest DebConf running July 28 through August 4
-
Fedora Unleashes Atomic Desktops
Fedora has combined its solid distribution with rpm-ostree system to make it possible to deliver a new family of Fedora spins, called Fedora Atomic Desktops.
-
Bootloader Vulnerability Affects Nearly All Linux Distributions
The developers of shim have released a version to fix numerous security flaws, including one that could enable remote control execution of malicious code under certain circumstances.