Monday, November 29, 2010

Wednesday, November 17, 2010

SELinux (Security Enhanced Linux)


http://en.wikipedia.org/wiki/Security-Enhanced_Linux

This is a Linux feature developed by NSA (National Security Agency).  It is not a Linux distribution, but a set of modification that can be applied to Unix-like OS (Operating System) kernels.


This is a really good overview article of what SELinux is and is not.  

MAC (Mandatory Access Controls) - enforced by SELinux.

DAC (Discretionary Access Control) - the old way of controlling what privileges a user can set on a file.

The SELinux policy has no concept of an all-powerful superuser.  It looks at things from the perspective of what is allowed.

An Internet-facing server should be locked down very strictly.

FC3 (Fedora Core 3) allows a targeted policy - "allow all, deny as needed."


Some more good information.  

AVC (access vector cache)

Wednesday, October 27, 2010

ATE (Advanced Evasion Techniques)


http://gcn.com/articles/2010/10/26/hacker-advanced-evasion-techniques.aspx?s=gcndaily_271010

Found a reference here.  This article is not too good but it lead me to the article below, which is much better.


Hasn't this been around for awhile?  It would be funny if the technique is patented.  The above link include a you tube video.