{"id":69,"date":"2005-03-02T15:41:20","date_gmt":"2005-03-02T15:41:20","guid":{"rendered":"http:\/\/dtrace.org\/blogs\/bmc\/2005\/03\/02\/dtrace-is-not-a-security-risk\/"},"modified":"2005-03-02T15:41:20","modified_gmt":"2005-03-02T15:41:20","slug":"dtrace-is-not-a-security-risk","status":"publish","type":"post","link":"https:\/\/bcantrill.dtrace.org\/2005\/03\/02\/dtrace-is-not-a-security-risk\/","title":{"rendered":"DTrace is not a security risk!"},"content":{"rendered":"<p>Recently, there was<br \/>\n<a href=\"http:\/\/www.ccc.de\/congress\/2004\/fahrplan\/event\/57.de.html\">a<br \/>\npresentation<\/a> at the annual meeting of<br \/>\n<a href=\"http:\/\/en.wikipedia.org\/wiki\/Chaos_Computer_Club\">Chaos<br \/>\nComputer Club<\/a> in Berlin.<br \/>\nAs the presentation describes DTrace at some length,<br \/>\nseveral have asked the question:  is DTrace a security risk?  The answer<br \/>\nis an emphatic &#8220;no&#8221; &#8212; quite the contrary in fact &#8212; but it merits some<br \/>\nexplanation.<\/p>\n<p>\nDTrace can only be used by users on the system that have the appropriate<br \/>\nprivileges (as discussed in the Security chapter of the<br \/>\n<a href=\"http:\/\/docs.sun.com\/app\/docs\/doc\/817-6223\">DTrace documentation<\/a>).<br \/>\nBy default, the only user with<br \/>\nsufficient privileges to use DTrace is <tt>root<\/tt> &#8212; the super-user.<br \/>\nThe techniques described in the paper and in the presentation<br \/>\nare only for use on a system <b>that one has already compromised<\/b>.<br \/>\nOf course, once a system is compromised, all bets are off; a nefarious<br \/>\nuser can:<\/p>\n<ul>\n<li>\nLoad their own daemons to act as<br \/>\n<a href=\"http:\/\/en.wikipedia.org\/wiki\/Trojan_horse_%28computing%29\">trojan<br \/>\nhorses<\/a>, potentially sniffing<br \/>\npasswords and compromising subsequent machines<\/p>\n<p><li>\nExamine <tt>\/etc\/shadow<\/tt> and crack it to obtain cleartext for<br \/>\nevery password on the system<\/p>\n<p><li>\nUse the<br \/>\npre-existing Solaris observability tools<br \/>\n(<tt>truss<\/tt>(1), <tt>gcore<\/tt>(1), <tt>mdb<\/tt>(1), etc.)<br \/>\nto observe and modify arbitrary processes<\/p>\n<li>Crash and\/or destroy the system beyond repair\n<li>Load their own kernel modules to spoof arbitrary parts of the system\n<\/ul>\n<p>Yes, you can use DTrace on a compromised system to glean additional<br \/>\ninformation, but everything you<br \/>\ncan do with DTrace was in principle possible before DTrace &#8212; DTrace<br \/>\njust happens to make it a little easier.<br \/>\nIndeed, the presentation<br \/>\ndoesn&#8217;t even discuss the ways in which a nefarious user on a compromised<br \/>\nsystem can use DTrace &#8212; rather it describes how DTrace can be used to<br \/>\n<i>understand<\/i> the system well enough to design a nefarious<br \/>\nspoofing kernel module in the first place.<br \/>\nAnd revealingly, the presentation spends quite a bit of time<br \/>\ndescribing<br \/>\nhow to design a nefarious kernel module such<br \/>\nthat it <i>evades<\/i> instrumentation by DTrace.<sup>1<\/sup>  The fact<br \/>\nthat time and effort were spend on DTrace evasion is telling:<br \/>\nas a tool designed to expose the inner workings of a production system,<br \/>\nDTrace is much more feared by<br \/>\nthe Black Hats than it is useful to them;<br \/>\nfar from being a security <i>risk<\/i>, DTrace is very much a security <i>asset<\/i>.<\/p>\n<hr \/>\n<p><sup>1<\/sup>  I hasten to add that the author&#8217;s techniques for evading<br \/>\nDTrace won&#8217;t actually work<br \/>\ncompletely.  They will successfully evade one form of instrumentation, but<br \/>\nthey leave the<br \/>\nnefarious module completely exposed to<br \/>\nseveral other forms of instrumentation and detection by DTrace.  A<br \/>\nmore devilish rootkit would completely replace DTrace with some sort of<br \/>\n<a href=\"http:\/\/theages.superman.ws\/Encyclopaedia\/bizarro.php\">Bizarro<\/a><br \/>\nDTrace that<br \/>\nknew how to <i>completely<\/i> deny the existence of its cohorts&#8230;<\/p>\n<p>\nTechnorati tags:<br \/>\n<a href=\"http:\/\/technorati.com\/tag\/DTrace\" rel=\"tag\">DTrace<\/a><br \/>\n<a href=\"http:\/\/technorati.com\/tag\/Security\" rel=\"tag\">Security<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently, there was a presentation at the annual meeting of Chaos Computer Club in Berlin. As the presentation describes DTrace at some length, several have asked the question: is DTrace a security risk? The answer is an emphatic &#8220;no&#8221; &#8212; quite the contrary in fact &#8212; but it merits some explanation. DTrace can only be [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"_links":{"self":[{"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/posts\/69"}],"collection":[{"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/comments?post=69"}],"version-history":[{"count":0,"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/posts\/69\/revisions"}],"wp:attachment":[{"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/media?parent=69"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/categories?post=69"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bcantrill.dtrace.org\/wp-json\/wp\/v2\/tags?post=69"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}