Clan x86

General Forums => General Discussion => Topic started by: deadly7 on February 24, 2011, 07:21:23 PM

Title: Interesting sandbox hypothetical
Post by: deadly7 on February 24, 2011, 07:21:23 PM
Let's say you have a binary that "phones home". The machine on which it resides you have SSH access to, but cannot log in via root [or sudo]. How would you sandbox it so that all outgoing network traffic from the executable gets blocked?
Title: Re: Interesting sandbox hypothetical
Post by: iago on February 24, 2011, 07:35:54 PM
on windows, I wrote a loader that would start a process suspended and modify some of the calls (send/recv/etc) to go through my code before going out. It would probably work without admin access, and the same type of thing should be possible on Linux. It's function hooking or writing a loader.

I've never done it on Linux, sadly. I mostly do this type of thing from Windows.
Title: Re: Interesting sandbox hypothetical
Post by: nslay on February 25, 2011, 11:58:28 PM
I've never seen a Unix firewall that can block based on process. Although, I'm mostly a pf user myself.
Title: Re: Interesting sandbox hypothetical
Post by: Joe on February 26, 2011, 11:22:45 AM
I can't say without more details, but is unplugging the Ethernet a possible fix? It'll stop the program from phoning home, at least.
Title: Re: Interesting sandbox hypothetical
Post by: Blaze on February 26, 2011, 12:06:54 PM
If he has to ssh in, and he doesn't have root, it's likely that he does not have physical access to the box.
Title: Re: Interesting sandbox hypothetical
Post by: Joe on February 26, 2011, 12:53:14 PM
Can you write a plugin that gives me an "I just woke up button" that doesn't allow me to post within 30 minutes of clicking it?
Title: Re: Interesting sandbox hypothetical
Post by: iago on February 27, 2011, 10:37:42 AM
Quote from: Joe on February 26, 2011, 12:53:14 PM
Can you write a plugin that gives me an "I just woke up button" that doesn't allow me to post within 30 minutes of clicking it?
Sure, but it might have a large false positive rate.
Title: Re: Interesting sandbox hypothetical
Post by: Blaze on February 27, 2011, 04:39:48 PM
Quote from: iago on February 27, 2011, 10:37:42 AM
Quote from: Joe on February 26, 2011, 12:53:14 PM
Can you write a plugin that gives me an "I just woke up button" that doesn't allow me to post within 30 minutes of clicking it?
Sure, but it might have a large false positive rate.


Hahaha.
Title: Re: Interesting sandbox hypothetical
Post by: Sidoh on February 27, 2011, 04:47:49 PM
HOLD ON, HOLD ON. WAIT A MINUTE

did someone just get told?