Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

github.com

Post reply on HN
Print view View original

41–50 of 58 posts

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#41

Post by Joel_Mckay »

worthless-trash wrote: post #39
Joel_Mckay wrote: post #31

Earlier quoted context omitted.

Most production OS I saw would do this on boot-up completion: echo 1 > /proc/sys/kernel/modules_disabled Which is supposed to block dynamic loading modules until a reboot. It would be interesting if the PoC can get around that trick too. =3

Once you have memory write as ring0, all protections are dubious at best. Why bother loading a module when you can inject code into any function you want.

The encrypted page memory manager hardware in some ancient Sun systems prevented a lot of these context isolation problems. However, the modern IT landscape chose consumer grade processor architecture and bodged GPUs as the cloud infrastructure foundation.

Thus, there currently is economic inertia entrenching vulnerable system design. I don't think there is a company large enough to change the situation anytime soon, as the market has spoken. =3

Rule #3: popularity is not an indication of utility.

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#42

Post by mmh0000 »

finagler wrote: post #37
mmh0000 wrote: post #12

Hiding from SELinux is clever, but SELinux (for most users not running MLS) is a final level of defense. If you get to the point where SELinux is saving your butt, you've got problems higher up in the stack. For me, the real scary part is the hiding "Audit Evasion" (for those not in the know, here's a link https://www.redhat.com/en/blog/configure-linux-auditing-audi... ); Audit is supposed to be able to track anythin…

> SELinux (for most users not running MLS) is a final level of defense if so, why is it there at all? Years back when our team was dealing with weird permission issues on multiple levels due to SELinux, I found little value in it.

Don't misunderstand my original post. SELinux is AMAZING. But, if SELinux in the default "targeted" policy is the thing that's protecting you, that's good, but it means there are some major bugs or misconfiguration higher up (i.e., in your web server).

I assume you know what a network firewall is. Think of SELinux like a "System Call Firewall". SELinux will protect you from many so-called "zero-day" vulnerabilities. It watches every syscall an application makes, looks at its policy, and decides if that syscall should be allowed/denied. It is a good thing.

However, SELinux is really not user-friendly, though it is extremely well documented and learnable. (run `man -k selinux` to see all the man pages) Red Hat also has thorough documentation (https://docs.redhat.com/en/documentation/red_hat_enterprise_...)

Specifically, to your "weird permission issues". That is a "problem" with SELinux; it doesn't surface errors well. The TL;DR is: if you get a "permission denied" error, and you rule out the obvious (i.e., filesystem permissions), then you need to know to blame SELinux and look at the `/var/log/audit/audit.log` file.

That file is technically human readable, but there are tools that make it much easier, such as `ausearch` and `sealert -a`.

---

https://danwalsh.livejournal.com/71122.html

"Now this is a horrible exploit but as you can see SELinux would probably have protected a lot/most of your valuable data on your machine. It would buy you time for you to patch your system."

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#43

Post by arcfour »

finagler wrote: post #37
mmh0000 wrote: post #12

Hiding from SELinux is clever, but SELinux (for most users not running MLS) is a final level of defense. If you get to the point where SELinux is saving your butt, you've got problems higher up in the stack. For me, the real scary part is the hiding "Audit Evasion" (for those not in the know, here's a link https://www.redhat.com/en/blog/configure-linux-auditing-audi... ); Audit is supposed to be able to track anythin…

> SELinux (for most users not running MLS) is a final level of defense if so, why is it there at all? Years back when our team was dealing with weird permission issues on multiple levels due to SELinux, I found little value in it.

I don't mean this to come off as rude, but how much did you know about SELinux?

Because in my experience, when people are "dealing with weird...issues" and "[finding] little value in it" they usually don't understand what it is and how to use it.

This makes any tool difficult to appreciate.

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#44

Post by [deleted] »

transpute wrote: post #5
matheuzsec wrote: post #2

The rootkit now disables SELinux enforcing mode on-demand when the ICMP reverse shell is triggered, leaving zero audit logs. How it works: SELinux maintains a global kernel structure called selinux_state that contains the enforcement flag. The rootkit resolves this non-exported symbol via kallsyms at module load time, then directly writes enforcing = 0 when triggered. This bypasses the normal setenforce() interface e…

> The rootkit now disables SELinux enforcing mode on-demand when the ICMP reverse shell is triggered, leaving zero audit logs. Is this independent of the Linux Security Modules policy, e.g. RHEL default policy for SE Linux?

[deleted]

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#45

Post by egberts1 »

hulitu wrote: post #24
egberts1 wrote: post #21

Entry vector is via user-loadable kernel modules. Does not work if kernel Kconfig setting has: CONFIG_MODULES=n All deliverables should have this Kconfig setting disabled.

> CONFIG_MODULES=n does this work on normal linux desktops ? My impression was that either: 1). Kernel is too big. Try making modules - link error or 2) System will not boot due to missing/misconfigured parts.

The sole blocker of CONFIG_MODULES=n is WiFi and only just prior to network UP state of WiFi (during initial WiFi initialization).

Also, kernel build will fail during 'make modules'/'make all'/'make' but will succeed for 'make bzImage'/'make install'

Desktop Linux distros' WiFi required SIGNED module support for internationalization of radio band selection.

SO, for kernel modules to be disabled on desktop and still use WiFi, one needs to rebuild WiFi without module support and specifically to comply with their country's radio authority.

Pesky little thing.

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#46

Post by egberts1 »

matheuzsec wrote: post #35
Joel_Mckay wrote: post #32

Earlier quoted context omitted.

Could always try: echo 1 > /proc/sys/kernel/modules_disabled Which is supposed to block dynamic loading modules until a reboot. =3

This is not permanent; if the system is rebooted, it will be undone :)

Kernel bootline can be uodated to include this option:

    modules_disabled

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#47

Post by egberts1 »

egberts1 wrote: post #45
hulitu wrote: post #24

Earlier quoted context omitted.

> CONFIG_MODULES=n does this work on normal linux desktops ? My impression was that either: 1). Kernel is too big. Try making modules - link error or 2) System will not boot due to missing/misconfigured parts.

The sole blocker of CONFIG_MODULES=n is WiFi and only just prior to network UP state of WiFi (during initial WiFi initialization). Also, kernel build will fail during 'make modules'/'make all'/'make' but will succeed for 'make bzImage'/'make install' Desktop Linux distros' WiFi required SIGNED module support for internationalization of radio band selection. SO, for kernel modules to be disabled on desktop and still u…

Many embedded systems or supercomputers disable modules for security or simplicity, but then all needed drivers must be built in. WiFi is a common casualty because it’s normally modular due to firmware blobs provided as-is from WiFi manufacturers.

Also, many supercomputing facilities and hardened servers prohibits direct networking with WiFi drivers (because, unverifiable firmware blobs).

Your homelab should provide the direct Ethernet connect to your desktop.

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#48

Post by iberator »

hugo1789 wrote: post #17
kpcyrd wrote: post #16

Earlier quoted context omitted.

The rootkit runs in ring0, at that point all kernel-enforced security controls are potentially compromised. Instead, you need to prevent the kernel module from being loaded in the first place. There are multiple ways to ensure no further kernel modules can be loaded without rebooting the computer, e.g. by having pid=1 drop CAP_SYS_MODULE out of it's bounding set before starting any child processes. After it has been…

That is a critical observation. Last time I had to root an Android device it hat pretty robust defenses like dm-verity and strict SELinux policies (correctly configured) and then everything collapsed because the system loaded a exfat kernel module from an unverified filesystem. Permitting user-loaded kernel modules effectively invalidates all other security measures.

Naive question: does Linux check checksum of loaded modules? If not I could just replace them and voila?

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#49

Post by Imustaskforhelp »

lima wrote: post #36
Joel_Mckay wrote: post #31

Earlier quoted context omitted.

Most production OS I saw would do this on boot-up completion: echo 1 > /proc/sys/kernel/modules_disabled Which is supposed to block dynamic loading modules until a reboot. It would be interesting if the PoC can get around that trick too. =3

If Kernel Lockdown is enabled, a zero-day exploit is required to bypass module restrictions without a reboot. Unfortunately, threat actors tend to have a stash of them and the initial entry vector often involves one (container or browser sandbox escape), and once you have that, you are in ring 0 already and one flipped bit away from loading the module. The Linux kernel is not really an effective privilege boundary.

So what would you recommend instead? To run workflows in VMs?

Re: Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

#50

Post by Imustaskforhelp »

sounds wrote: post #10
VoidWhisperer wrote: post #7

I understand that this is to drive research and help security researchers in this case, but I personally think Github should take a harder stance against this kind of repo, education purposes or not - saying it is for educational purposes is definitely not going to stop someone (especially people who wouldn't know how to develop this level of rootkit on their own) from going and using it. Also the specific details in…

Do you think malware creators find out by reading HN or github? I don't understand the vitriol, the request "Github should take a harder stance" could have a chilling effect on security researchers, pushing high impact exploits deeper underground.

Another point is that Firstly Github shouldn't take a harder stance but considering its microsoft and even if One might argue that Github does take in this case and it actually does.

This would really end up doing not much because buying a domain name and such hosting should be easy.

There are some service providers who will only comply in things if you provide if and only a legal complaint which is genuine and valid (like a court order) and I think no Court can order for something like this because I feel like there is / must be a legal backing for genuinely writing "this tool is for educational/research purposes" and its actually so, so I don't really understand if github's stance would even matter in the end because if you need to get court order to remove it in the end, then github will comply it with it as well (even more so than those providers even)

I don't understand what the OP wants, like should this be obscure in some tor .onion forum for hackers or should this be on github so that people can read about this and learn abotu this vector and patch up in their servers where they may have thought it was safe but they didn't know about this issue exists in the first place! (because a hacker might still use obscure persons but a sysadmin might not comparatively)

Post reply on HN