{"id":114415,"date":"2024-03-19T00:25:59","date_gmt":"2024-03-18T22:25:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi"},"modified":"2024-03-19T00:25:59","modified_gmt":"2024-03-18T22:25:59","slug":"kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","title":{"rendered":"Kiddy \u2013 en Linux-k\u00e4rnmodul f\u00f6r skydd mot script kiddies","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex>      <noindex><\/p>\n<p><a rel=\"nofollow\" href=\"https:\/\/github.com\/milabs\/kiddy\">Kiddy<\/a> &ndash; \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430.<\/p>\n<p><\/noindex><\/noindex> <\/p>\n<p>Skyddsmetoden som implementeras i denna modul bygger p\u00e5 en enkel id\u00e9, n\u00e4mligen att identifiering av angreppsoffret alltid sker under en attack. Om man kan g\u00f6ra denna identifiering sv\u00e5rare, \u00f6kar det avsev\u00e4rt sv\u00e5righeterna att utnyttja, eftersom m\u00e5nga f\u00e4rdiga exploater inneh\u00e5ller olika typer av adress-tabeller (offsets) som \u00e4r anpassade f\u00f6r m\u00e5lspecifika k\u00e4rnversioner.<\/p>\n<p> <noindex><\/p>\n<p>Till exempel, s\u00e5 h\u00e4r g\u00f6rs det f\u00f6r <a rel=\"nofollow\" href=\"https:\/\/github.com\/xairy\/kernel-exploits\/blob\/master\/CVE-2017-1000112\/poc.c#L91\">CVE-2017-1000112<\/a>. D\u00e4r kan man ocks\u00e5 se att identifieringen av k\u00e4rnversionen sker med hj\u00e4lp av uname.<\/p>\n<p><\/noindex> <\/p>\n<p>Den utvecklade modulen \u00e4r enkel att implementera och till\u00e5ter att:<\/p>\n<ul>\n<li>\u00e4ndra k\u00e4rnidentifieringen;<\/li>\n<li>begr\u00e4nsa \u00e5tkomsten till k\u00e4rnloggar (dmesg);<\/li>\n<li>begr\u00e4nsa \u00e5tkomsten till vissa filer i \/proc som ocks\u00e5 inneh\u00e5ller identifierande information;<\/li>\n<li>begr\u00e4nsa \u00e5tkomst till filer och mappar som potentiellt inneh\u00e5ller identifierande information;<\/li>\n<li>\u00e4ndra k\u00e4rnversionen som \u00e4r tillg\u00e4nglig via vDSO.<\/li>\n<\/ul>\n<p>\u0412 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 \u043c\u043e\u0434\u0443\u043b\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0442.\u043d. &laquo;\u043f\u0440\u0435\u0441\u0435\u0442\u044b&raquo;, \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u0443\u044e \u043b\u043e\u0433\u0438\u043a\u0443 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043f\u0440\u0435\u0441\u0435\u0442 &laquo;windows&raquo; \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0435 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435:<\/p>\n<p><strong>Innan modulen laddas<\/strong><\/p>\n<p> $ .\/misc\/id.sh ** UNAME identidty leaks  &#8212; uname -r    2.6.32-754.35.1.el6.x86_64  &#8212; uname -v    #1 SMP Sat Nov 7 12:42:14 UTC 2020  &#8212; uname -a    Linux localhost.localdomain 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64 x86_64 x86_64 GNU\/Linux ** PROCFS identidty leaks  &#8212; \/proc\/cmdline    ro root=\/dev\/mapper\/VolGroup00-LogVol00 rd_NO_LUKS no_timer_check console=tty0 console=ttyS0,115200n8 net.ifnames=0 biosdevname=0 LANG=en_US.UTF-8 rd_NO_MD SYSFONT=latarcyrheb-sun16  rd_LVM_LV=VolGroup00\/LogVol01 rd_LVM_LV=VolGroup00\/LogVol00  KEYBOARDTYPE=pc KEYTABLE=us rd_NO_DM rhgb quiet  &#8212; \/proc\/version    Linux version 2.6.32-754.35.1.el6.x86_64 (mockbuild@x86-02.bsys.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC) ) #1 SMP Sat Nov 7 12:42:14 UTC 2020  &#8212; \/proc\/sys\/kernel\/version    #1 SMP Sat Nov 7 12:42:14 UTC 2020  &#8212; \/proc\/sys\/kernel\/osrelease    2.6.32-754.35.1.el6.x86_64 which: no hostnamectl in (\/usr\/local\/bin:\/bin:\/usr\/bin:\/usr\/local\/sbin:\/usr\/sbin:\/sbin:\/home\/vagrant\/bin)   <\/p>\n<p><strong>Efter att modulen har laddats<\/strong><\/p>\n<p> $ .\/misc\/id.sh ** UNAME identidty leaks  &#8212; uname -r    Windows  &#8212; uname -v    NT 4.0  &#8212; uname -a    Linux localhost.localdomain Windows NT 4.0 x86_64 x86_64 x86_64 GNU\/Linux ** PROCFS identidty leaks  &#8212; \/proc\/cmdline    EFIMicrosoftBootbootmgfw.efi  &#8212; \/proc\/version    Windows NT 4.0  &#8212; \/proc\/sys\/kernel\/version    NT 4.0  &#8212; \/proc\/sys\/kernel\/osrelease    Windows which: no hostnamectl in (\/usr\/local\/bin:\/bin:\/usr\/bin:\/usr\/local\/sbin:\/usr\/sbin:\/sbin:\/home\/vagrant\/bin)   <\/p>\n<p>Script kiddies kommer inte att lyckas!<\/p>\n<p>K\u00e4lla: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.linux.org.ru\/news\/security\/17555973\">linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>Kiddy &ndash; \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430. \u0412 \u043e\u0441\u043d\u043e\u0432\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0437\u0430\u0449\u0438\u0442\u044b, \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432 \u0434\u0430\u043d\u043d\u043e\u043c \u043c\u043e\u0434\u0443\u043b\u0435, \u043b\u0435\u0436\u0438\u0442 \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0438\u0434\u0435\u044f, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0430\u0442\u0430\u043a\u0438 \u0442\u0430\u043a \u0438\u043b\u0438 \u0438\u043d\u0430\u0447\u0435 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u043e\u0431\u044a\u0435\u043a\u0442\u0430 \u0430\u0442\u0430\u043a\u0438. \u041f\u043e\u044d\u0442\u043e\u043c\u0443, \u0435\u0441\u043b\u0438 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u0438\u0442\u044c \u0442\u0430\u043a\u0443\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e, \u043c\u043e\u0436\u043d\u043e \u043a\u0440\u0430\u0442\u043d\u043e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, \u0442.\u043a. \u0432\u043e \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114415","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Kiddy \u2014 \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442-\u043a\u0438\u0434\u0434\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-03-18T22:25:59+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-03-18T22:25:59+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kiddy \u2014 Linux-k\u00e4rnmodul f\u00f6r skydd mot script kiddies | ProHoster","description":"Kiddy \u2013 en modul f\u00f6r Linux-k\u00e4rnan, utvecklad f\u00f6r att minska risken f\u00f6r utnyttjande av (vissa) k\u00e4rnsvagheter.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Kiddy \u2014 \u043c\u043e\u0434\u0443\u043b\u044c \u044f\u0434\u0440\u0430 Linux \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442-\u043a\u0438\u0434\u0434\u0438 | ProHoster","og:description":"Kiddy \u2013 \u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u044b\u0439 \u0441 \u0446\u0435\u043b\u044c\u044e \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 (\u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0445) \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044f\u0434\u0440\u0430..","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/kiddy-modul-yadra-linux-dlya-zashhity-ot-skript-kiddi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-18T22:25:59+00:00","article:modified_time":"2024-03-18T22:25:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=114415"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/114415\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=114415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=114415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=114415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}