Re: JFFS2/xattr problems.

Theodore Tso
2006-06-15T03:12:52Z

On Tue, Jun 13, 2006 at 04:13:17PM +0200, Jörn Engel wrote:
> On Tue, 13 June 2006 22:36:59 +0900, KaiGai Kohei wrote:
> >
> > >Seems you missed Ted's presentation at LCA this year. Among the
> > >interesting bits:
> >
> > If this presentation is public, could you tell me the URL?
> > This indication is highly suggestive for me.
> > Especially, I have not imagine yet the possibility that
> > malware uses xattr to hide itself.
>
> I can only find the abstract:
> http://lca2006.linux.org.au/abstract.php?id=384
>
> [ adding Ted to Cc: ]
>
> Ted, do still have your foils and can make them available? Kaigai-san
> is working on an xattr implementation for jffs2.

Sure, here you go (see attached)

> > >o The biggest user of Alternate Streams (less-limited versions of
> > > xattr on Windows, Solaris, etc.) arguably is root kits. Alternate
> > > Streams have the advantage that tripwire etc. don't understand them
> > > and won't look for malware there.
> > >o Some system administrators have no plans to upgrade to Solaris 9
> > > ever, because it supports Alternate Streams. The trouble of hidden
> > > malware is not worth the gains.
> > >
> > >Notable was also, that Ted repeated the last two points in several
> > >variations. Not sure if I would follow his line of thought 100%, but
> > >he does have a point.

See the article referenced in the slide, "Alternate Data Streams:
Threat or Menace?"

http://www.awprofessional.com/articles/article.asp?p=413685

(I love the title. "Threat or Menace?" "Menace or Threat?" Or, to
take a line from an old Bugs Bunny/Daffy Duck cartoon, "You got me
dead to rights, Doc. Would you like to shoot him now or shoot him
later?" :-)

- Ted