+++ /dev/null
-Rootkit detection techniques used by the OSSEC HIDS
-by Daniel B. Cid, daniel.cid@gmail.com
-
-
-Starting on version 0.4, the OSSEC HIDS will perform
-rootkit detection on every system where the agent is
-installed. The rootcheck (rootkit detection engine) will
-be executed every X minutes (user specified --by default
-every 2 hours) to detect any possible rootkit installed.
-Used witht the log analysis and the integrity checking
-engine, it will become a very powerful monitoring solution
-(the OSSEC HIDS performs log analysis and integrity
-checking since version 0.1).
-
-Other feature included on version 0.4 is that the analysis
-server will automatically forward the rootkit detection
-signatures to the agents, reducing the administration
-overhead for the system admin. The agents and server will
-keep contact every 10 minutes and if the server is
-updated with a new signature file, it will forward them
-to all configured agents. Take a look at the management
-documentation for more information.
-
-The rootcheck will perform the following steps on the
-system trying to find rootkits:
-
-
-1- Read the rootkit_files.txt which contains a big database
- of rootkits and files used by them. It will try to stats,
- fopen and opendir each specified file. We use all these
- system calls, because some kernel-level rootkits, hide
- files from some system calls. The more system calls we
- try, the better the detection. This method is more like
- an anti-virus rule that needs to be updated constantly.
- The chances of false-positives are small, but false
- negatives can be produced by modifying the rootkits.
-
-2- Read the rootkit_trojans.txt which contains a database
- of signatures of files trojaned by rootkits. This
- technique of modifying binaries with trojaned versions
- was commonly used by most of the popular rootkits
- available. This detection method will not find any
- kernel level rootkit or any unknown rootkit.
-
-3- Scan the /dev directory looking for anomalies. The /dev
- should only have device files and the Makedev script.
- A lot of rootkits use the /dev to hide files. This
- technique can detect even non-public rootkits.
-
-4- Scan the whole filesystem looking for unusual files and
- permission problems. Files owned by root, with written
- permission to others are very dangerous and the rootkit
- detection will look for them. Suid files, hidden directories
- and files will also be inspected.
-
-5- Look for the presence of hidden processes. We use getsid()
- and kill() to check if any pid is being used or not. If
- the pid is being used, but "ps" can't see it, it is the
- indication of kernel-level rootkit or a trojaned version
- of "ps". We also verify the output of kill and getsid that
- should be the same.
-
-6- Look for the presence of hidden ports. We use bind() to
- check every tcp and udp port on the system. If we can't
- bind to the port (it's being used), but netstat does not
- show it, we probably have a rootkit installed.
-
-7- Scan all interfaces on the system and look for the ones
- with "promisc" mode enabled. If the interface is in promiscuous
- mode, the output of "ifconfig" should show that. If not,
- we probably have a rootkit installed.
-
-
-EOF
projects / ossec-hids.git / blobdiff