Date: Wed, 4 Jul 2012 01:33:27 +0200 From: Sofian Brabez <sbz@FreeBSD.org> To: =?iso-8859-1?Q?Cl=E9ment?= Lecigne <clemun@gmail.com> Cc: freebsd-security@freebsd.org, Zoran Kolic <zkolic@sbb.rs> Subject: Re: turtle rootkit Message-ID: <20120703233327.GA58368@freebsd.ifr.lan> In-Reply-To: <CAKSJdAD7=eswaD%2BmcZ6jWdVrZxpGuuP3iaHFrgPT556pHEE6EA@mail.gmail.com> References: <20110830033854.GA1064@faust> <CAKSJdAD7=eswaD%2BmcZ6jWdVrZxpGuuP3iaHFrgPT556pHEE6EA@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
--uAKRQypu60I7Lcqm
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Hi,
On Tue, Aug 30, 2011 at 11:53:12AM +0200, Cl=E9ment Lecigne wrote:
>
> What do you want? It's just a basic rootkit that hooks some specific
> entries inside the sysent table. It can be detected by checking if a
> device /dev/turtle2dev exists or by sending an ICMP echo request with
> a payload starting with a double '_' and if rootkit is loaded no reply
> will be returned.
>
> [root@clem1 ~/koda/Turtle2/module]# hping -c 1 -n 127.0.0.1 -e "__foo" -1
> HPING 127.0.0.1 (lo0 127.0.0.1): icmp mode set, 28 headers + 5 data bytes
> [main] memlockall(): No such file or directory
> Warning: can't disable memory paging!
>
> --- 127.0.0.1 hping statistic ---
> 1 packets tramitted, 0 packets received, 100% packet loss
>
> These tricks can be implemented inside rkhunter or/and chkrootkit.
>
It's implemented since rkhunter 1.4.0 [1], and now security/rkhunter port v=
ersion [2]
is able to detect it during the check scan:
% sudo rkhunter --version | head -1
Rootkit Hunter 1.4.0
% sudo rkhunter --list rootkits | grep -i turtle2
trNkit, Trojanit Kit, Turtle2, Tuxtendo, URK, Vampire,
% sudo rkhunter --check --sk
=2E..
Turtle Rootkit [ Not found ]
Btw, the best way to avoid such rootkit is to use sysctl kern.securelevel in
order to avoid untrusted kernel modules loading at runtime (but can be bypa=
ssed at
boot time...)
Regards
[1] http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/CHAN=
GELOG?revision=3D1.226&view=3Dmarkup
[2] http://docs.freebsd.org/cgi/getmsg.cgi?fetch=3D471258+0+current/cvs-all
--
Sofian Brabez
--uAKRQypu60I7Lcqm
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (FreeBSD)
iEYEARECAAYFAk/zgUYACgkQc2NR9CSH5X5NfQCfZ+benj+haRonNBzbraik9wPE
KmEAoMx3F/xnN3bzU9jCu1QbqH3YnVJP
=u3Op
-----END PGP SIGNATURE-----
--uAKRQypu60I7Lcqm--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20120703233327.GA58368>