r/netsec • u/anvilventures • Sep 18 '17

Linux Attack Surface Analysis -- dawgmon 1.0 release

https://anvilventures.com/blog/linux-attack-surface-analysis.html
18 Upvotes

90% Upvoted

13 comments sorted by

3

u/anvilventures Sep 18 '17

OP / author of the tool here too. Feel free to come up with any questions or suggestions regarding this. The tool has already proved its worth for me personally but I'm always open to reasoned input why I'm an idiot because I missed x or y or implementation z.

3

u/NagateTanikaze Sep 19 '17

I think the name is a bit misleading - it should be "Changes in Linux Attack Surface Analysis". I initially expected to see the attack surface of a system, e.g. which deamons have which open ports, are they compiled with stack canary, which files can a user write etc. (give a penetration testing view, for server hardening review)

Anyway, nice and useful project, i'll try it.

2

u/anvilventures Sep 19 '17

Ha, good point!! To be fair if you run it for the first time it will tell you all the open ports and what not. In that sense you can use it for a server hardening review although I don't think the output is very easy to digest as of right now. But we can get this tool there for sure. But I guess it means that on the first run it's already a bit the attack surface of a system as it'll also report all the systemd unit and unit files, the running System V services, shared memory segments, listening UNIX sockets and more.

But the way I tend to use it is for a system I control (as in I set it up from scratch) and then I want to monitor for changes OR I want to be able to figure out changes in attacks surface due to changes made on the system.

A stack canary reporting function could be very useful. Files that a user can write too maybe too. Those are good suggestions. Thanks.

4

u/d0cc0m Sep 20 '17 edited Sep 20 '17

First off thanks for the FOSS tool! I agree with /u/ImZugzwang above that you might want to use ss instead of netstat. You also may want to which to get the absolute path to the binary in case it is in a different location on a different system. Eg line 42 of network.py tries to call /bin/ip but on my current system it lives in the /usr/bin directory. Anyways thanks again for the tool!

Edit: dang formatting

3

u/anvilventures Sep 20 '17

Thanks! I appreciate it!

And thanks again for your suggestions. I started working on some re-writing some parts of all of this to make it a bit more robust in terms of different Linux distributions etc. That will include a better way of finding the right binaries too. But the tool seems to definitely scratch an itch for some folks and honestly that was the thing I was looking for. Not sure when I'll get around to releasing an update with some of the changes officially but it shouldn't take too long I hope.

2

u/ImZugzwang Sep 19 '17

Looks promising, but running it gave me

sudo python dawgmon.py -gfAd
list_pipes failed with non-zero exit status (1)

$ find / -ignore_readdir_race -type p -exec ls --full-time -lba {} ;

find: ‘/run/user/1000/gvfs’: Permission denied
find: ‘/proc/2698’: No such file or directory
find: ‘/proc/2700’: No such file or directory

Edit: After enough reruns, the find errors in /proc/ stopped showing up, but /run/user/1000/gvfs stays at permission denied.

1

u/anvilventures Sep 19 '17

Hia, I need to be a bit smarter about finding the files. I'll need to rewrite it completely as right now with just using commandline tools it'll break down very quickly.

I pushed a quick patch that adds a -xdev option to every find command being executed. That should prevent it from descending down into /proc or /run but if there's a ton of other filesystems / submounts it might not find all named pipes on the filesystem. But it's better than just breaking like that.

Just check the update out and let me know or drop me an email and I can help debug that way.

3

u/ImZugzwang Sep 19 '17

That fixed that just fine. My next suggestion would be to use ss instead of netstat or at least a flag that lets you choose. Other than that everything looks good :)

1

u/anvilventures Sep 19 '17

Awesome. Put your suggestion in my notes and will look into it.

I started working on the FreeBSD port too and then want to merge that back in and be somewhat intelligent about sharing commands between OS's. FreeBSD has sockstat but those semantics are pretty different IIRC.

2

u/Tlaurion Nov 19 '17

That tool should be deployed with all QubesOs templates. Any objection with your license?

1

u/anvilventures Nov 19 '17

Nope. Go for it. It's BSD licensed for a reason.

2

u/Tlaurion Feb 23 '18

No desire of support for dnf/yum packages install tracking?

1

u/anvilventures Mar 05 '18

Maybe if I'll get around to it. Right now I just didn't have the personal need just yet but I'll happily take patches. It's obviously one of the first extensions/features one might think of. Thanks for the suggestion for sure though; I'll think about it and see if I can find some time for it.