{"id":114415,"date":"2024-03-19T00:25:59","date_gmt":"2024-03-18T22:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi"},"modified":"2024-03-19T00:25:59","modified_gmt":"2024-03-18T22:25:59","slug":"kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","title":{"rendered":"Kiddy \u2014 een kernelmodule voor Linux ter bescherming tegen script-kiddies.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/github.com\/milabs\/kiddy\">Kiddy<\/a> \u2013 module voor de Linux-kernel, ontwikkeld om de risico's van de exploitatie van (bepaalde) kwetsbaarheden in de kernel te verminderen.<\/p>\n<p><\/noindex><\/noindex> <\/p>\n<p>De basis van het beschermingsmechanisme dat in deze module is ge\u00efmplementeerd, is een eenvoudig idee: tijdens een aanval vindt er op de een of andere manier identificatie van het doelobject plaats. Daarom, door deze identificatie te bemoeilijken, kan de complexiteit van de exploitatie aanzienlijk worden verhoogd, aangezien in veel gevallen kant-en-klare exploits tabellen met diverse verschuivingen (offsets) bevatten, die overeenkomen met de doelversies van de kernel.<\/p>\n<p> <noindex><\/p>\n<p>Bijvoorbeeld, zo is het gedaan voor <a rel=\"nofollow\" href=\"https:\/\/github.com\/xairy\/kernel-exploits\/blob\/master\/CVE-2017-1000112\/poc.c#L91\">CVE-2017-1000112<\/a>. Daar kan ook worden gezien dat de identificatie van de kernelversie wordt uitgevoerd met behulp van uname.<\/p>\n<p><\/noindex> <\/p>\n<p>De ontwikkelde module is eenvoudig te implementeren en stelt in staat om:<\/p>\n<ul>\n<li>de identificatie van de kernel te wijzigen;<\/li>\n<li>de toegang tot de kernellog (dmesg) te beperken;<\/li>\n<li>de toegang tot bepaalde bestanden in \/proc, die ook identificerende informatie bevatten, te beperken;<\/li>\n<li>de toegang tot bestanden en mappen die mogelijk identificerende informatie bevatten, te beperken;<\/li>\n<li>de identificatie van de kernelversie, toegankelijk via vDSO, te wijzigen.<\/li>\n<\/ul>\n<p>Tijdens het samenstellen van de module kunnen zogenaamde \u00abpresets\u00bb worden gebruikt, die verschillende logica voor identiteitswijziging implementeren. Bijvoorbeeld, door de preset \u00abwindows\u00bb te gebruiken, kan het volgende gedrag worden verkregen:<\/p>\n<p><strong>Voor het laden van de module<\/strong><\/p>\n<p> $ .\/misc\/id.sh ** UNAME identiteitslekken  \u2014 uname -r    2.6.32-754.35.1.el6.x86_64  \u2014 uname -v    #1 SMP Sat Nov 7 12:42:14 UTC 2020  \u2014 uname -a    Linux localhost.localdomain 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64 x86_64 x86_64 GNU\/Linux ** PROCFS identiteitslekken  \u2014 \/proc\/cmdline    ro root=\/dev\/mapper\/VolGroup00-LogVol00 rd_NO_LUKS no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16  rd_LVM_LV=VolGroup00\/LogVol01 rd_LVM_LV=VolGroup00\/LogVol00  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet  \u2014 \/proc\/version    Linux versie 2.6.32-754.35.1.el6.x86_64 (mockbuild@x86-02.bsys.centos.org) (gcc versie 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC) ) #1 SMP Sat Nov 7 12:42:14 UTC 2020  \u2014 \/proc\/sys\/kernel\/version    #1 SMP Sat Nov 7 12:42:14 UTC 2020  \u2014 \/proc\/sys\/kernel\/osrelease    2.6.32-754.35.1.el6.x86_64 which: no hostnamectl in (\/usr\/local\/bin:\/bin:\/usr\/bin:\/usr\/local\/sbin:\/usr\/sbin:\/sbin:\/home\/vagrant\/bin)   <\/p>\n<p><strong>Na het laden van de module<\/strong><\/p>\n<p> $ .\/misc\/id.sh ** UNAME identiteitslekken  \u2014 uname -r    Windows  \u2014 uname -v    NT 4.0  \u2014 uname -a    Linux localhost.localdomain Windows NT 4.0 x86_64 x86_64 x86_64 GNU\/Linux ** PROCFS identiteitslekken  \u2014 \/proc\/cmdline    EFIMicrosoftBootbootmgfw.efi  \u2014 \/proc\/version    Windows NT 4.0  \u2014 \/proc\/sys\/kernel\/version    NT 4.0  \u2014 \/proc\/sys\/kernel\/osrelease    Windows which: no hostnamectl in (\/usr\/local\/bin:\/bin:\/usr\/bin:\/usr\/local\/sbin:\/usr\/sbin:\/sbin:\/home\/vagrant\/bin)   <\/p>\n<p>Kiddy-scripts zullen niet doorgaan!<\/p>\n<p>Bron: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/17555973\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Kiddy &ndash; \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0430\u043d\u043d\u043e\u043c \u043c\u043e\u0434\u0443\u043b\u0435, \u043b\u0435\u0436\u0438\u0442 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0438\u0434\u0435\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0430\u0442\u0430\u043a\u0438 \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043e\u0431\u044a\u0435\u043a\u0442\u0430 \u0430\u0442\u0430\u043a\u0438. \u041f\u043e\u044d\u0442\u043e\u043c\u0443, \u0435\u0441\u043b\u0438 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u0438\u0442\u044c \u0442\u0430\u043a\u0443\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e, \u043c\u043e\u0436\u043d\u043e \u043a\u0440\u0430\u0442\u043d\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0442.\u043a. \u0432\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114415","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Kiddy \u2014 \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442-\u043a\u0438\u0434\u0434\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-03-18T22:25:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-03-18T22:25:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kiddy \u2014 een Linux-kernelmodule ter bescherming tegen script-kiddies | ProHoster","description":"Kiddy \u2013 een module voor de Linux-kernel die is ontwikkeld om de risico's van het exploiteren van (bepaalde) kwetsbaarheden in de kernel te verminderen.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Kiddy \u2014 \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442-\u043a\u0438\u0434\u0434\u0438 | ProHoster","og:description":"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-18T22:25:59+00:00","article:modified_time":"2024-03-18T22:25:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/114415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=114415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/114415\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=114415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=114415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=114415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}