Empirically testing the effectiveness of kernel hardening patches

Empirically testing the effectiveness of kernel hardening patches

[Carter Cheng]

[-- Attachment #1: Type: text/plain, Size: 367 bytes --]

Hi,

Is there some sort of standard testbed for testing the effectivenss of a
kernel hardening patch to see how effective it is against current malware?
How does one go about this?

I assume when it comes to hardening the kernel the main target is certain
forms of privilege escalation. Is it possible to use Kali linux for this
purpose?

Thanks in advance,

Carter.

[-- Attachment #2: Type: text/html, Size: 485 bytes --]

Re: Empirically testing the effectiveness of kernel hardening patches

[Wes Turner]

[-- Attachment #1: Type: text/plain, Size: 1076 bytes --]

https://en.wikipedia.org/wiki/Fuzzing

https://github.com/secfigo/Awesome-Fuzzing

https://github.com/kernelslacker/trinity

https://github.com/google/syzkaller/#external-articles

https://github.com/google/syzkaller/blob/master/docs/syzbot.md

> syzbot system continuously fuzzes main Linux kernel branches and
automatically reports found bugs to kernel mailing lists

https://github.com/oracle/kernel-fuzzing

I just found these, so IDK

Does Kali include virtualization  such as KVM and fuzzing / dynamic
analysis / static analysis tools and a CI pipeline that can execute
on_commit to new git branches?

On Wednesday, October 31, 2018, Carter Cheng <cartercheng@gmail.com> wrote:

> Hi,
>
> Is there some sort of standard testbed for testing the effectivenss of a
> kernel hardening patch to see how effective it is against current malware?
> How does one go about this?
>
> I assume when it comes to hardening the kernel the main target is certain
> forms of privilege escalation. Is it possible to use Kali linux for this
> purpose?
>
> Thanks in advance,
>
> Carter.
>

[-- Attachment #2: Type: text/html, Size: 1918 bytes --]

Re: Empirically testing the effectiveness of kernel hardening patches

[Kees Cook]

On Wed, Oct 31, 2018 at 10:15 AM, Carter Cheng <cartercheng@gmail.com> wrote:
> Is there some sort of standard testbed for testing the effectivenss of a
> kernel hardening patch to see how effective it is against current malware?
> How does one go about this?

I haven't seen a specific framework like that, but there are fuzzers
(as mentioned in the other reply), and there is the lkdtm set of tests
(which try to exercise bug classes or elements of exploit techniques).

I'd note that testing old malware against new kernels isn't always
going to be very real-world meaningful, though. Most exploits are
designed to do the least amount of work to accomplish something, so
any break in the exploit chain will stop _that_ exploit, but it
doesn't mean there aren't other paths.

> I assume when it comes to hardening the kernel the main target is certain
> forms of privilege escalation. Is it possible to use Kali linux for this
> purpose?

The goal has been to kill classes of bugs (e.g. %n in format strings),
or exploit techniques (e.g. overwriting timer function arguments).
There's a bit of an overview about them here:
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project/Work

-- 
Kees Cook