| brent timothy saner via plug on 11 May 2021 17:11:08 -0700 |
[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]
| Re: [PLUG] Simple Reliable method to determine what is running on a Linux Box |
On 5/11/21 11:56, Mark Bergman via plug wrote: > Conceptually, there is no way to do what you want. > > If someone has shell access, they can trivally obscure any program they are running. That's how malware operates, only in this case, the act of hiding a forbidden program is done > intentionally by the owner of the PC. The simplest example is: > > sudo cp /path/to/app/forbidden/during/exam /usr/bin/vi > vi Just a point of argument, this wouldn't work in SELinux with contexts applied. BUUUT of course that requires you having root access to their machine, them NOT having it[0], and running CentOS/RedHat. (Similarly, you can only whitelist specific commands for sudo, but again- you root, them not, etc.) But it *is* enforceable under those conditions. [0] "But they have physical access!" Sure, but consider this: an iPXE-booted filesystem that requires remote decryption via SSH. They can't change or bruteforce/etc. the root password (because the / fs image is encrypted), they can't mount the image (read-only, loads into RAM, and again- requires remote decryption), and at that point the only circumvention options they have available are custom rootkitted kernel/initramfs (which can be detected by runtime analysis from within the encrypted fs image post-decryption) or custom hardware-level attacks. The ROI on these for a ham license test is extremely poor, so you're probably fine. ___________________________________________________________________________ Philadelphia Linux Users Group -- http://www.phillylinux.org Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce General Discussion -- http://lists.phillylinux.org/mailman/listinfo/plug