I’m happy to announce the release of several Glibc heap analysis plugins (for
Linux), resp. plugins to gather information from keepassx and zsh, which are now
included in the
Rekall Memory Forensic Framework. This
blogpost will demonstrate these plugins and explain how they can be used. More
detailed information, including real world scenarios, will be released after the
talk
at this years DFRWS USA.
Before being able to reliably analyze the heap of a process, a profile, for the
Glibc version being used, must be provided. However, this step should for most
cases be fairly simple and only consist of gathering the offset for the mp_
and main_arena variables:
Some of you might use WebEx in their daily life. And some of you might use Linux
(as I and many of us do). However, this combination often results in issues with
your PC’s sound or microphone use in a WebEx session.
The problem here is that WebEx won’t run as intended with Firefox and JRE x64.
But the solution is quite easy! Use the x86-versions of each.
Following up on
this post,
we want to provide some details on
two rather new
(well, compared to its lifespan) Linux kernel parameters — and emphasize the
need to enable those:
fs.protected_hardlinks
fs.protected_symlinks
For BSD, similar parameters for hardlinks exist:
security.bsd.hardlink_check_uid/security.bsd.hardlink_check_gid.
Those parameters control whether users are allowed to create links pointing to
files which are not owned by them. If fs.protected_hardlinks/symlinks is set
to 1, users can only create links to files which they own. Attackers have used
this possibility for a long time, and here are some sample attack scenarios:
One interesting observation we make when testing complex environments is that at
the bottom of huge technology stacks, there is usually a handful of shell
scripts doing interesting stuff. More often than not these helper scripts are
started as part of cron jobs running as root and perform basic administrative
tasks like compressing and copying log files or deleting leftover files in
temporary directories. Of course, these high privileges make them an interesting
target for privilege escalation attacks and one class of vulnerability we
reliably encounter in shell scripts is unsafe handling of globbing or filename
expansions.
We were recently approached by a customer asking us for support along the lines
of “do you have any recommendations as for strict hardening of IPv6 parameters
on Linux systems?”. It turned out that the systems in question process quite
sensitive data and are located in certain, not too big network segments with
very high security requirements.
They indicated they were willing to spend significant operational resources on
“securely configuring them”. So Antonios deciced to write a small hardening
guide for IPv6 on Linux, mostly focusing on manual configuration of pretty much
everything (including neighbor cache entries 😉 with accompanying deactivation
of all automatic mechanisms, together with ip6tables based local packet
filtering.
The document
can be found here.