7

Linux is compiled from open-source and thousands of developers would spot any malicious source code. However many Linux users dual boot Windows and malware / spyware / "spook"ware (CIA) software could hack the compiled binaries of Linux after a clean version was installed.

The solution I think is to run a hash total on Linux Kernel binaries immediately after an update is installed, ie on 4.4.0-63-generic.

The question is which files need to be included? ie /boot/4.4.0-63-generic or more than that?

After the hash total is generated a cron job can be run monthly, weekly or daily to regenerate the hash total and compare it to the original version to ensure it hasn't changed. If the hash totals don't match an infection has occurred and a clean kernel needs to be reinstalled.


Edit 1 The answers so far are more like comments. Those answers and the comments below seem to say "The CIA is too smart and too rich to protect yourself so don't bother trying". If I read that right then all the answers might as well be written by one the CIA, NSA, MI6 or Mossad paid trolls or someone on spook payroll. An analogy would be "Your neighbourhood criminals are too smart and sophisticated. They watch your house and learn your habits. There is no point locking your doors or installing an alarm system."

Someone else says once you reboot with Windows the password you used to encrypt your hash totals can be read by spyware. I doubt that because Windows RAM footprint is larger than Linux's RAM footprint and loading windows would wipe out any valuable searchable RAM Linux may have left behind. Besides a simple 10 second power off would erase all RAM.

At the opposite end of the spectrum someone suggested "Don't use Windows". Um... no I won't hide in fear and avoid the platforms I need to use when I need to use them. It's a super fast laptop with a hybrid nVidia graphics and when it's time for Windows gaming it will be used as such.

  1. This is more of a how would you do it, but with kernel update you would obviously need to rerun the hash, to create a new one. But what if you forgot to rerun it, what would happen then?

With a kernel update an entirely new kernel is installed to /boot. If you forget to run the job to create new hash totals then the cron job that compares totals will give you an error the same way as if someone had modified kernel binaries behind your back.

The actual design of scripts and encryption of hash totals comes later. We are putting the cart in front of the horse. The fist step is to identify what needs to be protected. It's NAA (Not An Answer) to post questions on "how would you do it?" embedded in an answer.

Partially answering my question in addition to running hash totals on Kernel images, selected drivers should be included. Specifically I'm thinking of the one where they can turn off power to webcam led's giving the illusion they are turned off and then activating the camera. Something similar with mic's perhaps?

Removing all speculation on whether you should or should not monitor unauthorized modifications to your kernel space--what binaries should be protected from external tampering?

9
  • "Linux is compiled from open-source and thousands of developers would spot any malicious source code." Like with Heartbleed, you mean? Where would the hash value be stored? Wouldn't malware tamper with that, or disable the check? After all, they can alter the kernel (in your scenario).
    – user12753
    Mar 10, 2017 at 13:08
  • 2
    @ThomasWard If CIA can create Windows malware that will alter the Linux kernel (dozens of different versions in current use), why couldn't they include a no-DLL ext-4 and/or btrfs read-write module? After all, malware doesn't need to fit in the headers of an email any more...
    – Zeiss Ikon
    Mar 10, 2017 at 13:45
  • 2
    @WinEunuuchs2Unix From windows you can see the password, decrypt & edit the script or nobble the hash totals. We could continue this for a while but perhaps you can investigate how software (especially games) get "cracked" (have their protection removed). What you're suggesting - protection from an adversary which has physical access to your device - is impossible.
    – user12753
    Mar 10, 2017 at 16:00
  • 1
    @Serg I think Russia Today ran a story of how the CIA infects computers not connected to the internet a few days ago based on Wikileaks #Vault7. Didn't read it though. Back in the 90's I proudly maintained a small home network server not connected to the internet and a separate isolated laptop for internet access but not now. Besides you and I would go stir-crazy without internet access to learn and post our programs :D Mar 11, 2017 at 2:08
  • 1
    -1 -> too broad. I've have some paranoid friends who will first ask me what they should do. Which is then the beginning of an endless tiresome circle of "buts" and "ifs". My bottom-line is: "Ask yourself what try to protect and what you are trusting and base your decisions on that." and "If you don't trust what I trust then don't ask me what to do."
    – MadMike
    Mar 20, 2017 at 13:45

3 Answers 3

1

The only way I see to avoid this scenario is to avoid dual-boot: get rid of Windows. Of course, if you think the CIA can't install malware that will hide in a desktop/laptop Linux system, you're not paranoid enough...

3
  • Exactly. The only safe way to run Windows is within a virtual machine.
    – user12753
    Mar 10, 2017 at 13:48
  • This initial version focuses on Kernel Space not User Space. Mar 10, 2017 at 14:09
  • @WinEunuuchs2Unix What do you mean? Windows (running on bare metal) can do what it wants to the local hard drive. It need not respect other OSes kernel/user space distinction.
    – user12753
    Mar 10, 2017 at 15:00
1

Learn how make grub work for you, and set it up in order to boot linux distributions that are kept within .iso archives ever time that you boot. Keep your Windoze machine at home and only allow it to talk via direct hard-linked connection, to the linux box that you allow to talk to the internet on each boot, and configure all internet activity remotely, through the linux system that gets initialized each time it gets booted. For those that are hyper-paranoid, make bootable flash drives, that you keep in you pocket, and turn off boot-from-USB, whenever you leave the house, on the linux device. All involved boxes would be password protected, at the BIOS level, of course! ;^)

0

Here is a sampling of other kernel binaries to protect besides those in /boot:

$ ls /lib/modules/4.9.13-040913-generic/
build          modules.alias.bin    modules.dep.bin  modules.symbols
initrd         modules.builtin      modules.devname  modules.symbols.bin
kernel         modules.builtin.bin  modules.order    updates
modules.alias  modules.dep          modules.softdep  vdso
───────────────────────────────────────────────────────────────────────────────
rick@dell:~$ ls /lib/modules/4.9.13-040913-generic/kernel
arch  crypto  drivers  fs  kernel  lib  mm  net  sound  virt
───────────────────────────────────────────────────────────────────────────────
rick@dell:~$ ls /lib/modules/4.9.13-040913-generic/kernel/drivers
acpi        dca       hwmon       mcb       nvme      rapidio      uio
ata         dma       hwtracing   md        nvmem     regulator    usb
atm         edac      i2c         media     parport   reset        uwb
auxdisplay  extcon    iio         memstick  pci       rtc          vfio
base        firewire  infiniband  message   pcmcia    scsi         vhost
bcma        firmware  input       mfd       phy       spi          video
block       fmc       iommu       misc      pinctrl   spmi         virtio
bluetooth   fpga      ipack       mmc       platform  ssb          vme
char        gpio      isdn        mtd       power     staging      w1
clk         gpu       leds        net       powercap  target       watchdog
cpufreq     hid       lightnvm    nfc       pps       thermal      xen
crypto      hsi       macintosh   ntb       ptp       thunderbolt
dax         hv        mailbox     nvdimm    pwm       tty
───────────────────────────────────────────────────────────────────────────────
rick@dell:~$ ls /lib/modules/4.9.13-040913-generic/kernel/drivers/net/ethernet/realtek/
8139cp.ko  8139too.ko  atp.ko  r8169.ko
───────────────────────────────────────────────────────────────────────────────
rick@dell:~$ 

A recursive algorithm is needed to take md5sum snapshot (or whichever security hashsum you prefer) of all sub-directories and files in the directory /lib/modules/kernel_version/*

There are probably other binaries but I wanted to post an answer of what has been discovered so far.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .