VirusForget - Design

From Kicksecure
< Dev
Jump to navigation Jump to search

Stop malware persistence. Deactivate malware after reboot from non-root compromise. Make malware non-persistent after reboot.

Description[edit]

Deactivate malware after reboot from non-root compromise.

Similar to Qubes-VM-hardeningarchive.org iconarchive.today icon, but designed for any (Debian) Linux system booted without root access.

Issue[edit]

Most Linux desktop distributions are vulnerable to persistent malware even if only the user account was compromised. It would be expected and desirable that, after a reboot, non-root malware would get deactivated (i.e., be non-persistent).

This is currently not the case because malware can gain persistence (survive reboot) by using hooks such as the file ~/.bashrc, the folder ~/.config/autostart, and many others to autostart itself after reboot.

An effort to start enumerating these files and folders has been made in Security-Misc VirusForget Source Codearchive.org iconarchive.today icon.

Notes & Scratch Pad[edit]

Features[edit]

  • Run at boot before mounting /home.
  • Allow root to modify file and commit changes.
  • File same as /etc/skel (root location) is acceptable.
  • Carantaine.
  • Delete.
  • Diff.
  • Init.
  • Commit.
  • Show.
  • Extra file.
  • Changed file.
  • Whitelisting of files, such as for netvm.
  • File by tag.
  • Qubes root compromise with protected root image /usr/local, /rw.
  • Move anything not part of skel.
  • After PAM?
  • Log a note if a dotfile does not exist.
  • No root protections in Qubes Template.
  • Ignore when running as root.
  • Deploy.
  • Duplicate files for later diff.

Considerations for Tor Browser in the Home Folder[edit]

  • Snapshot binaries with:
    • find . -executable -type f
  • Upgrade mode to allow changing executables.

Command-Line Interface[edit]

  • --path
    • Home folder can be in any location, such as:
    • --path /home/user
    • --path /rw/home/user
    • --path /path/to/chroot/folder/home/user
  • --simulate - Perform a dry run, outputting what would be done.
  • --protect - Remove important files after reboot.
  • --unprotect - Disable protection.
  • --immutable - Make important files immutable (cannot be written to).
  • --mutable - Make files writable again.
  • --reset-to-skel - Reset important files as if created from /etc/skel.
  • --skel /path/to/skel - Specify an alternative skel location (default is /etc/skel).

Additional Considerations[edit]

  • First boot.
  • Subsequent boots.
  • Handling newly added configuration files.

Status[edit]

Notification image
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 13 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Dev/VirusForget&oldid=90809"