{"id":114415,"date":"2024-03-19T00:25:59","date_gmt":"2024-03-18T22:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi"},"modified":"2024-03-19T00:25:59","modified_gmt":"2024-03-18T22:25:59","slug":"kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","title":{"rendered":"Kiddy \u2014 ein Linux-Kernel-Modul zum Schutz vor Skript-Kiddies","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/github.com\/milabs\/kiddy\">Kiddy<\/a> &ndash; ein Modul f\u00fcr den Linux-Kernel, das entwickelt wurde, um die Risiken der Ausnutzung (einiger) Schwachstellen im Kernel zu verringern.<\/p>\n<p><\/noindex><\/noindex> <\/p>\n<p>Das Sicherheitsmechanismus, das in diesem Modul implementiert ist, basiert auf der einfachen Idee, dass bei einem Angriff immer eine Identifikation des Angriffsobjekts stattfindet. Wenn man diese Identifikation erschwert, kann man die Ausnutzung erheblich komplizieren, da in vielen F\u00e4llen bereitgestellte Exploits Tabellen mit verschiedenen Offsets enthalten, die spezifischen Kernelversionen entsprechen.<\/p>\n<p> <noindex><\/p>\n<p>Hier ist ein Beispiel, wie dies umgesetzt wird f\u00fcr <a rel=\"nofollow\" href=\"https:\/\/github.com\/xairy\/kernel-exploits\/blob\/master\/CVE-2017-1000112\/poc.c#L91\">CVE-2017-1000112<\/a>. Dort kann man sehen, dass die Identifikation der Kernelversion durch die Verwendung von uname erfolgt.<\/p>\n<p><\/noindex> <\/p>\n<p>Das entwickelte Modul ist einfach zu implementieren und erm\u00f6glicht es:<\/p>\n<ul>\n<li>die Kernelidentifikation zu \u00e4ndern;<\/li>\n<li>den Zugriff auf das Kernelprotokoll (dmesg) einzuschr\u00e4nken;<\/li>\n<li>den Zugriff auf bestimmte Dateien in \/proc, die ebenfalls identifizierende Informationen enthalten, einzuschr\u00e4nken;<\/li>\n<li>den Zugriff auf Dateien und Ordner, die potenziell identifizierende Informationen enthalten, einzuschr\u00e4nken;<\/li>\n<li>die Identifikation der Kernelversion, die \u00fcber vDSO verf\u00fcgbar ist, zu \u00e4ndern.<\/li>\n<\/ul>\n<p>W\u00e4hrend des Aufbaus erm\u00f6glicht das Modul die Verwendung von sogenannten &laquo;Presets&raquo;, die unterschiedliche Logik zur \u00c4nderungsverarbeitung der Identifikation implementieren. Zum Beispiel kann man mit dem Preset &laquo;windows&raquo; folgendes Verhalten erreichen:<\/p>\n<p><strong>Vor dem Laden des Moduls<\/strong><\/p>\n<p> $ .\/misc\/id.sh ** UNAME identidty leaks  &#8212; uname -r    2.6.32-754.35.1.el6.x86_64  &#8212; uname -v    #1 SMP Sat Nov 7 12:42:14 UTC 2020  &#8212; uname -a    Linux localhost.localdomain 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64 x86_64 x86_64 GNU\/Linux ** PROCFS identidty leaks  &#8212; \/proc\/cmdline    ro root=\/dev\/mapper\/VolGroup00-LogVol00 rd_NO_LUKS no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16  rd_LVM_LV=VolGroup00\/LogVol01 rd_LVM_LV=VolGroup00\/LogVol00  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet  &#8212; \/proc\/version    Linux version 2.6.32-754.35.1.el6.x86_64 (mockbuild@x86-02.bsys.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC) ) #1 SMP Sat Nov 7 12:42:14 UTC 2020  &#8212; \/proc\/sys\/kernel\/version    #1 SMP Sat Nov 7 12:42:14 UTC 2020  &#8212; \/proc\/sys\/kernel\/osrelease    2.6.32-754.35.1.el6.x86_64 which: no hostnamectl in (\/usr\/local\/bin:\/bin:\/usr\/bin:\/usr\/local\/sbin:\/usr\/sbin:\/sbin:\/home\/vagrant\/bin)   <\/p>\n<p><strong>Nach dem Laden des Moduls<\/strong><\/p>\n<p> $ .\/misc\/id.sh ** UNAME identidty leaks  &#8212; uname -r    Windows  &#8212; uname -v    NT 4.0  &#8212; uname -a    Linux localhost.localdomain Windows NT 4.0 x86_64 x86_64 x86_64 GNU\/Linux ** PROCFS identidty leaks  &#8212; \/proc\/cmdline    EFIMicrosoftBootbootmgfw.efi  &#8212; \/proc\/version    Windows NT 4.0  &#8212; \/proc\/sys\/kernel\/version    NT 4.0  &#8212; \/proc\/sys\/kernel\/osrelease    Windows which: no hostnamectl in (\/usr\/local\/bin:\/bin:\/usr\/bin:\/usr\/local\/sbin:\/usr\/sbin:\/sbin:\/home\/vagrant\/bin)   <\/p>\n<p>Das Skript-Tool wird nicht bestehen!<\/p>\n<p>Quelle: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/17555973\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Kiddy &ndash; \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0430\u043d\u043d\u043e\u043c \u043c\u043e\u0434\u0443\u043b\u0435, \u043b\u0435\u0436\u0438\u0442 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0438\u0434\u0435\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0430\u0442\u0430\u043a\u0438 \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043e\u0431\u044a\u0435\u043a\u0442\u0430 \u0430\u0442\u0430\u043a\u0438. \u041f\u043e\u044d\u0442\u043e\u043c\u0443, \u0435\u0441\u043b\u0438 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u0438\u0442\u044c \u0442\u0430\u043a\u0443\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e, \u043c\u043e\u0436\u043d\u043e \u043a\u0440\u0430\u0442\u043d\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0442.\u043a. \u0432\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114415","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/de\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"de_DE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Kiddy \u2014 \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442-\u043a\u0438\u0434\u0434\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/de\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-03-18T22:25:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-03-18T22:25:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kiddy \u2013 Linux-Kernel-Modul zum Schutz vor Script-Kiddies | ProHoster","description":"Kiddy \u2013 ein Modul f\u00fcr den Linux-Kernel, das entwickelt wurde, um die Ausnutzung (mancher) Kernel-Schwachstellen zu verringern.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Kiddy \u2014 \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442-\u043a\u0438\u0434\u0434\u0438 | ProHoster","og:description":"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-18T22:25:59+00:00","article:modified_time":"2024-03-18T22:25:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/114415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=114415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/114415\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=114415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=114415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=114415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}