On Wed, 10 Nov 2010 00:57:04 -0800 (PST), Jakub Moravek
<[email protected]> wrote:
Hi everybody,
I was discussing some security issues wit my colleagues. And we
found interresting issue. How is guaranteed integrity of Ossec
itself?
Can Ossec somehow discover, that an attacker will replace Ossec with
modified application. Modified Ossec will report during syscheck scan
same size, modification times, checksums, etc. as had original
version
of Ossec application. Is there any internal mechanism howto prevent
or
discover described situation?
Jakub
This is the age-old discussion of trust models and how far they extend.
How do you know an attacker who has compromised the box has not replaced
OSSEC, or sent you false alerts? How do you know the e-mail server,
itself, wasn't compromised such that no alerts are sent? How do you know
that OSSEC doesn't have a bug causing alerts not to be sent? The short
answer is that you don't. But that doesn't mean you can't trust OSSEC at
all. You can rely on a well-hardened OS, with nothing else installed
except OSSEC. You can set the OSSEC binaries to be immutable. You can
look at the source code and see that it is written with security in
mind. You could even set up a promiscuous syslog server and have an
out-of-band OSSEC monitor that. Or you can simply use OSSEC to monitor
itself or another instance of OSSEC to monitor the main one.
I have thought about this question in various contexts and, while I
think there are possibilities in this area, such as making the process
hard to kill, randomization, etc, many of them also get in the way of
the administrator. So it has to be approached carefully.
--
Michael Starks
[I] Immutable Security
http://www.immutablesecurity.com
