One way to carry out such an attack and hide it in the long term is to manipulate executables (binary exploitation[8]). An executable is a file that contains a sequence of instructions (machine code) that the system can execute directly[1]. These attacks kcan be discovered with AIDE.
Manipulating executables
If implemented correctly, manipulation is not recognized by the user or the system. Therefore, such manipulation can go unnoticed for a very long time. For example, a Attacker bypass password protection by skipping parts of the machine code. How this can be implemented is explained in the following shown using an example.
Manipulation of a simple executable
As an example, we have chosen a simple program that reads a PIN from the command line and checks it against a stored value:
#include <stdio.h>
void login(){
// hier soll abgefragt werden, ob der Nutzer den festgelegten PIN kennt
// kennt er ihn nicht, hängt er in einer endlosen Schleife fest
int pin = 12345;
int input = 0;
for(;;){
printf("Please input pin: ");
scanf("%5d", &input);
if(input != pin){
printf("Wrong pin! Try again.\n");
}else{
printf("Correct pin! continue...\n");
return;
}
}
}
int main(){
login();
// sollte erst nach richtiger PIN-Eingabe ausgegeben werden
printf("Login successful!\n");
}
In the main()-method, the login()-function, which contains logic for reading the user input and validating the PIN. If the correct PIN has been entered "Login successful!" on the command line. The login()-function reads PINs until a correct value has been entered.
An execution of the above code could look like this:
user@PC:~$ ./login-programm Please input pin: 2222 Wrong pin! Try again. Please input pin: 12345 Correct pin! continue... Login successful!
As an example, we would now like to manipulate the above program and skip the PIN query. To do this, we skip the call of the login()-function in machine code. As the above program has been compiled, it is in binary format and must first be executed with a Decompiler can be decompiled to become human-readable again[2].
The main()-method looks after decompiling with reko[5] as follows:
As the name of the functions is retained when compiling, it is also visible here and makes the code easier to understand. In the fifth line, the login()-function with a call[6] instruction, which comprises five bytes (marked red in the above image). If this call not be carried out, it can be replaced with a jmp[5] instruction can be skipped. A jmp jumps to a certain position - in contrast to the call it is shorter and only two bytes long:
In the image above, the first two bytes of the call with a jmp is overwritten to skip the next three bytes. This means that the total length of the call instruction and thus also the call of the login()-function is completely skipped. This is why its call is no longer visible in the decompile. Now "Login successful!" is displayed directly on the command line without performing a PIN comparison:
user@PC:~$ ./login-programm Login successful!
Recognizing a manipulation with AIDE
What is AIDE?
AIDE stands for "Advanced Intrusion Detection System". It is a program that can be used to detect changes in the file system, such as the manipulation of executables (see above). It can also detect changes to permissions, folders and log files. AIDE creates an image or snapshot of the file system. This image is saved in a database that can be stored externally. If tampering is suspected, AIDE can be used to compare an earlier version from the database with the current version[3].
Configuration of AIDE
AIDE is available for every modern UNIX system. It can be either here or - for Ubuntu or Debian - can be installed as follows using a terminal command[7]:
apt install aide
After installation, AIDE must be configured[4]; this is done using the file /etc/aide/aide.conf. This article explains the most important configuration steps for AIDE, for more information see the man pages (man aide, man aide.conf) is recommended. The file aide.conf contains important configuration parameters, such as the storage location of the snapshot and comparison database:
# The daily cron job depends on these paths database=file:/var/lib/aide/aide.db database_out=file:/var/lib/aide/aide.db.new database_new=file:/var/lib/aide/aide.db.new gzip_dbout=yes
Which file properties are saved by AIDE is defined as follows:
NORMAL = R+b+sha1 /etc p+i+u+g /home NORMAL /media NORMAL !/media/example
The above configuration causes the folder /etc and all contained subfolders and files the properties Authorizations p, Inode iUser u and Group g can be saved. However, such a procedure can quickly become confusing, for example when the configuration is changed. This can be prevented by using keywords. Under the keyword NORMALin line 1 of the code snippet above, some parameters are saved. In lines 4 and 5, the folders /home and /media thereby the in NORMAL saved parameters.
If there are folders or files that change very frequently, they can make AIDE's output confusing. If you therefore do not want to examine them, you can exclude them with an execution character in front of the path. As can be seen here in line 5, it is first determined that the folder /media is to be examined. In line 6, however, the Subfolder /media/example excluded from this. This folder is therefore not examined by AIDE.
The configuration can be tested with the following terminal command:
aide --config=/etc/aide/aide.conf --config-check
Use AIDE
Once the configuration is complete, AIDE can be initialized:
aide --config=/etc/aide/aide.conf --init
The snapshot database /var/lib/aide/aide.db.new generated. In order to compare this database in the future, it must be aide.db can be renamed. To recognize changes in the file system, the comparison of the file /var/lib/aide/aide.db with the current status of the system with the following command:
aide --config=/etc/aide/aide.conf --check
This procedure can also be carried out with cron jobs can be automated in order to check your own system regularly and automatically.
When checking the current status of the system would changes to files become visible. The manipulation shown above can also be detected in this way:
Start timestamp: 2022-09-28 13:08:08 +0200 (AIDE 0.16.1) AIDE found differences between database and filesystem!! Verbose level: 6 Summary: Total number of entries: 4369 Added entries: 0 Removed entries: 0 Changed entries: 1 --------------------------------------------------- Changed entries: --------------------------------------------------- f <.... mc..C . : /home/user/directoy/login_programm --------------------------------------------------- Detailed information about changes: --------------------------------------------------- File: /home/user/directoy/login_programm Size : 5409 | 0 Mtime : 2022-09-28 13:07:07 +0200 | 2022-09-28 13:08:08 +0200 Ctime : 2022-09-28 13:07:07 +0200 | 2022-09-28 13:08:08 +0200 RMD160 : 3P3jJI5Py1yl2hQwiLIYmu3VcPc= | nBGFpcXp/FRhKAiXfuj1SLIljTE= TIGER : yeoa37uQP8PswwEg70TZhy037fhY2vdX | JPATDGOskzIWFm52sbuSX/Nz3i1JWE56 SHA256 : 09ZmIT08ZKsXBS/Vg7VpQAAzvE2LUlPX | 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NM 0hOGCX+rEDQ= | pJWZG3hSuFU= SHA512 : +a5eJiroTSoo82w4DZIhLdTisaYLMnBf | z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXc AoAKKH5TmqiqSE4wWmzo6PcUyifY8qcg | g/SpIdNs6c5H0NE8XYXysP+DGNKHfuwv pOkxl2JdKEx0E0R8ZwTEvA== | Y7kxvUdBeoGlODJ6+SfaPg== CRC32 : 25fKwQ== | AAAAAA== HAVAL : HuKazlmnt4G7aTmM4iVwotgroePcLnLz | T2k4Ux8LyJkfYtp7vW994/rURWK4xvTr uznRDJjrJKA= | 8UbVtORvfBc= GOST : mY17eqRRScOJIX/9sg/C7rsRsBVR49Uh | zoW5nMRnUv/+41yrmnsCeKu0wtIFXP9o p0LR9uxxoqk= | WvSRLElJD40= --------------------------------------------------- The attributes of the (uncompressed) database(s): --------------------------------------------------- /var/lib/aide/aide.db RMD160 : DFlsf9bhMv11uys/l/0GuQ3zEfs= TIGER : EkPsm+2XBHhBphSaELIFpSzPtZg2d6VN SHA256 : D8sCR+/lvF2ZGDVrICp4ngi1fNqMfKp0 ZyuYElDwVhY= SHA512 : lxm5R/yWS6hYiKfAS9f6gNCyMGWcbCs9 vu8jKMLvhi0q4Ys730gB0F4pEuJ7zJxN t9WIwy731g907vnUvU8zZA== CRC32 : 9KoDXA== HAVAL : 0OCFObfkmniRWOnp5IB0XvWuWKOuXiY1 P4yyXsRlyF0= GOST : KSznHY86cA0kKXjIRp5OQJSaJrAMDrKM +7sQr/8pgOA= End timestamp: 2022-09-28 13:08:14 +0200 (run time: 0m 6s)
Conclusion
With AIDE, an attack cannot be can be reversed, but damage can be minimized or prevented altogether. If an executable has been changed in your own system, it is very important as quickly as possible, otherwise high losses can quickly occur. Experienced attackers will try to conceal their own traces as best they can. These can be found with AIDE.
Co-authorRuben Miller
Sources:
[1] https://www.malwarebytes.com/blog/news/2021/10/what-is-an-exe-file-is-it-the-same-as-an-executable, Retrieved on 8.11.2022, 8:30
[2] https://de-academic.com/dic.nsf/dewiki/312194 Retrieved 30.09.2022, 13:00
[3] https://aide.github.io/ Retrieved 30.09.2022, 13:00
[4] https://www.tecmint.com/check-integrity-of-file-and-directory-using-aide-in-linux/ Retrieved on: 30.09.2022, 12:30.
[5] https://github.com/uxmal/reko#readme, Retrieved on 8.11.2022, 8:30
[6] https://c9x.me/x86/html/file_module_x86_id_147.html, Retrieved on 8.11.2022, 8:30
[7] https://aide.github.io/ , Retrieved on 8.11.2022, 8:30
[8] https://ctf101.org/binary-exploitation/overview/ , Retrieved 9.11.2022, 7:30
