HAKIN9 ONDEMAND EXPLORES LINUX KERNEL! 08/12

Explore 11 professional articles written by our experts! All about Kernel security and technical hacking!

Defence Pattern

KERNEL SECURITY
By Vikas Kumar

In computing, the kernel is the main component of most computer operating systems; it is a bridge between applications and the actual data processing done at the hardware level. The kernel’s responsibilities include managing the system’s resources (the communication between hardware and software components).[1] Usually as a basic component of an operating system, a kernel can provide the lowest-level abstraction layer for the resources (especially processors and I/O devices) that application software must control to perform its function. It typically makes these facilities available to application processes through inter-process communication mechanisms and system calls.

Configure and Build Your Own Secure Linux Kernel
By Dusko Pijetlovic
One of the best ways to get a feeling for the Linux kernel internals and security features is to configure its settings and then compile it. Most GNU/Linux users and administrators use kernels configured and provided by the community (free and open source distributions) or corporate sponsors (e.g. Red Hat Enterprise Linux, SUSE Linux Enterprise, Canonical – Ubuntu).

Step by step with Kernel Toolkit Tutorials

SRDF: Write Your Own Security Tool
By Amr Thabet

This is a free open source Development Framework created to support writing security tools and malware analysis tools. And to convert the security researches and ideas from the theoretical approach to the practical implementation.
This development framework created mainly to support the malware field to create malware analysis tools and anti-virus tools easily without reinventing the wheel and inspire the innovative minds to write their researches on this field and implement them using SRDF.

Hooking Socket API calls on Linux 
by Johnny Levin

The socket APIs of BSD are the de-facto standard for network programming. Unlike operating at the packet level, which requires dealing with issues such as fragmentation, duplicates, and stream assembly, sockets provide the logical abstraction of a connection endpoint. From this endpoint, either messages (UDP) or logical streams (TCP) may be sent and received.
The same easy abstraction provided to programmers proves useful for hackers. By hijacking socket calls, a hacker can gain unparalleled views into an application, inspecting and even injecting data to its flows. This article describes the various methods of socket level hijacking found in Linux.

Linux Kernel Exploit. Android OS – The storm is over? 
By Sembiante Massimiliano M.S.c. Computer Security

Writing an article on Linux Kernel Exploitation is always a challenge. During the last decade the Linux Kernel has been constantly under the spotlight for a number of issues including vulnerabilities, controversial design, and structural aspects.
The security of Linux Kernel has been covered at many levels.
Discussing the latest penetration technique or the latest bug report is always a useful exercise, but makes it seem that defense strategy is exclusively based on a reactive approach rather than a preventive approach.

SysFS Little Tutorial and How to Use it to Trigger Kernel Faults. 
By Jesus Rivero

A few months ago, I got curious about a strange and kind of obscure bug in the Linux Kernel.
This bug threw a divide by zero error (see listing #1) when the Kernel tried to update the average load on a group of CPUs. According to the bug report [0] in the Kernel’s bugzilla, and my own experience, this bug presented itself randomly in time. Sometimes it would appear after 6 months uptime, on others, it would show after just 2-3 months, or even after just 4 days. It wasn’t even bound to a given machine architecture or type of processor because it had been reported in Intel and AMD processors and even in Amazon EC2 instances. Then, my curiosity kicked in. I needed to learn more about this bug.

Kernel Usage in MAC OS-X and Windows 8

15 percent of malware still compatible with Windows 8, Test Reveals
By Bogdan Botezatu, Bitdefender company

The introduction of Windows 8 marks an important milestone in more than 30 years of operating system development for US vendor Microsoft. The new operating system boasts a major overhaul in terms of visuals with the introduction of the Advanced UI, as well as massive changes of the security subsystems that ship with Windows 8.
A couple of days after the official release we took Windows 8 to a spin to determine how much of the malware that runs on Windows 7 also affects the new operating system.

Security Policy Development in Trusted BSD MAC Framework
By Mohamed Farag

Trusted Operating Systems are the “Next Level” of system security. They offer both new security features and high assurance of successful implementation. Trusted systems differ from secure systems in many principles. Trusted Systems established the concept of “ranking” systems within different degrees of trustworthiness. In such systems, users decide on trustworthiness and make a judgment based on systems. Operating systems have to implement security policies and different mechanisms are used to enforce such policies. There are various operating system security policies such as MLS and Biba policies. In this article we will describe the overall process of developing and applying different security policies within FreeBSD kernel under the TrustedBSD MAC Security Framework.

Security in the Enterprise Area

Integration of Cyberwarfare and Cyberdeterrence Strategies into the U.S. CONOPS Plan to
Maximize Responsible Control and Effectiveness by the U. S. National Command Authorities 
By Matthew Crosston, PhD. – Professor
This paper deals with issues related to the present situation of lack of a clearly defined national policy on the use of cyberweapons and cyberdeterrence, as well as the urgent present need to include strategies and tactics for cyberwarfare and cyberdeterrence into the national CONOPS Plan, which is the national strategic war plan for the United States.

U.S. GOVERNMENT SAYS NO WAY TO HUAWEI 
By Terrance J. Stachowski, CISSP, L|PT
The U.S. government asserts that the Chinese telecommunications behemoth, Huawei, poses a threat to its national security. Huawei insists that the claims are uncorroborated, and that they are being hindered by unsubstantiated, non-specific concerns, and profess they pose absolutely no threat to U.S. national security.
Through examination of how the U.S. has handled its involvement with Huawei, this paper seeks to answer the question: “Is there tangible evidence backing the stance the U.S. has taken against Huawei, or are decisions being made based on skepticism, speculations, and long-standing bias?”