Linux Privilege Increase Threat Analysis

Linux is an open source operating system that uses the Linux kernel. The security of Linux makes its users rarely use antivirus to prevent the threat of ransomware attacks. The purpose of this study is to assess the security of the Linux operating system that uses Wine as a compatibility layer against ransomware attacks. Then to determine whether ransomware has a higher impact than malware samples in previous studies or not. The methods used on the 30 samples are static analysis to identify samples, and dynamic analysis to determine the implications. From the 30 ransomware samples that can run on the Linux operating system, the results obtained show that 80% affect the registry, 50% affect the file system, 50% affect the service, 70% affect the Network and 60% affect the Process. While overall there are 30% of samples that affect the five existing parameters. The results show that ransomware has relatively high implications for existing parameters, inversely proportional to previous research.

Modern multi-core, multi-socket hardware powering the "cloud" is designed with memory and cache resources that have local associativity to a group of cores. Operating systems have characterized these associativities as part of Non-Uniform Memory Architecture (NUMA) optimizations within their virtual memory manager (VMM) and scheduler which improves application performance. Mature NUMA optimizations are prevalent for an OS running on bare-hardware. However, their benefits are reduced within virtual machines(VM) in the cloud. Even though cloud applications are executed by standard multi-core multi-socket hardware, the abstraction brought in by the virtualization layer makes it challenging to optimize resource management within a VM. This paper describes new paradigms in hypervisor technology-- scheduling VMs on cores and managing their memory resources which streamlines their execution on underlying multicore hardware. Being Linux kernel developers, we base our work on Linux operating system and Kernel Virtual Machine (KVM) --a subsystem which turns the Linux kernel into a scalable hypervisor. We evaluate few approaches for optimal resource allocation with KVM. We summarize our findings with a comparative study of how different scheduling algorithms can be employed with KVM for various systems to support efficient resource placement while running cloud workloads.

This article highlights the key aspects of developing and analyzing a rootkit for the Linux operating system, particularly focusing on the methods and technologies used to create rootkits, as well as the challenges posed to operating system security. In the context of increasing complexity and criticality of information security, this article emphasizes the necessity of understanding and detecting rootkits to enhance system protection against potential threats. The aim of the article is to provide a detailed examination of the process of developing a rootkit for the Linux operating system, analyzing its functional capabilities, assessing its impact on system security, and developing recommendations for protection against such threats. An important aspect is the study of methods for hiding processes, files, network connections, and other objects in the system. The research methodology includes the development of a rootkit in the C programming language using Linux kernel modules and a command-line interface (CLI). The main tools used during development include GCC (GNU Compiler Collection), the standard compiler for the C programming language in the Linux environment; GDB (GNU Debugger) for code debugging; Makefile for automating the compilation and assembly process of kernel modules; and Kernel Headers and Kernel Source, which are necessary for kernel module development. Scientific novelty. This article presents a comprehensive analysis and practical implementation of a rootkit for the Linux operating system, which is a significant contribution to the field of information security. For the first time, the process of designing and developing a rootkit is examined in detail, including the analysis of functional requirements, kernel module design, process and file hiding, and the development of mechanisms for obtaining superuser privileges. Considerable attention is given to methods of optimizing the rootkit to minimize its impact on system performance, as well as to analyzing ways of detecting and neutralizing it. This research provides new insights into the methods of creating and hiding rootkits, aiding in the development of more effective means of protecting information systems. Conclusions. During the course of this research, significant results were achieved that have practical implications for enhancing the security of Linux operating systems. As a result of the work, a rootkit was developed that demonstrates capabilities for hiding processes and files, obtaining superuser privileges, and organizing a reverse shell. A detailed analysis of the rootkit's impact on system security was conducted, and recommendations for its detection and neutralization were developed. The proposed methods for detecting and protecting against rootkits contribute to improving the level of information security and can be used in practical activities for protecting computer systems.

The Linux operating system has become the platform of choice in the HEP community. However, the migration process from another operating system to Linux can be a tremendous effort for developers and system administrators. The ultimate goal of such a transition is to maximize agreement between the nal results of identical calculations on the different platforms. Apart from the ne tuning of the existing software, the following issues need to be resolved: choice of Linux distribution, development tools (compiler, debugger, prolers etc.), compatibility with third-party software, and deployment strategy. It would be ideal to develop, run and test software using ofce desktops, local farm systems, or personal laptops regardless of the Linux distribution choosen. To accomplish this task, you need to have a e xible package management system that is able to install/upgrade/verify/uninstall the necessary software components without particular knowledge of remote system conguration and user privileges. We discuss how Linux became the third ofcial computing platform of the CLEO collaboration, outlining the details of the transition from Tru64 and Solaris operating systems to Linux, and the software model and deployment strategy employed.

For years, computer users have put up with the bugs, security holes, and viruses on Windows because they had no choice. Until recently, there has never been a good alternative to Windows. But now, Windows users can switch to Linux, the reliable, secure, and spyware free operating system. Linux is easy to use, runs on almost any PC, and enables you to perform all the tasks you can do with Windows. Getting to know Linux has never been easier, because now there's a way to test-drive Linux without changing, installing, or configuring a thing on your computer. It's called Test Driving Linux: From Windows to Linux in 60 Seconds. This latest release from O'Reilly comes with a Live CD called Move, that allows Windows users to try all the features of Mandrake Linux, a popular Linux distribution without the hassle of actually installing Linux. Users simply place the Move CD into their CD drive, boot from the disc, then watch an entire Mandrake system run on the fly from the CD-ROM. Test Driving Linux: From Windows to Linux in 60 Seconds is a detailed step-by-step guide to the Linux operating system and several popular open source programs. With this guide you can quickly learn how to use Linux to perform the tasks you do most: surf the web, send and receive email, instant message with friends, write letters, create spreadsheets, and even how to enhance your digital photos. Test Driving Linux: From Windows to Linux in 60 Seconds provides both home and business users with a hassle-free way to investigate this operating system before they purchase and install a complete Linux distribution.

An exceptional feature of the development of modern operating systems based on the Linux kernel is their leading use in cloud technologies, mobile devices and the Internet of things, which is accompanied by the emergence of more and more security threats at the kernel level. In order to improve the security of existing and future Linux distributions, it is necessary to analyze the existing approaches and tools for automated vulnerability detection and to conduct experimental security testing of some current versions of the kernel. The research is based on fuzzing - a software testing technique, which consists in the automated detection of implementation errors by sending deliberately incorrect data to the input of the fuzzer and analyzing the program's response at its output. Using the Syzkaller software tool, which implements a code coverage approach, vulnerabilities of the Linux kernel level were identified in stable versions used in modern distributions. The direction of this research is relevant and requires further development in order to detect zero-day vulnerabilities in new versions of the kernel, which is an important and necessary link in increasing the security of the Linux operating system family.

These days, the problems of scheduling and security are increasingly pressing as a result of the rapidly growing number of implementations that are operated in operating systems. Process scheduling and scheduling security is the most effective methodology of operating a system which can improve and degrade the performance of the computer system. The performance of scheduling algorithm in operating system can be measured by scheduling principles like average waiting time, average turnaround time, response time, throughput etc. Much research carried out over operating system security and round robin scheduling used in time sharing operating system in previous years to resolve the issues regarding to improvement in the performance of round robin (RR) scheduling and improving the security in the scheduling approach. This study discussed the security issues in operating systems, scheduling security and discrete structure of a new approach for RR scheduling. The researcher has suggested a list of policy for scheduling method security and proposed a new approach for RR scheduling and investigated the scheduling principles. The proposed methodology covers distinctive strategy for selection manner of process from ready queue than RR and used diverges time quantum. The proposed methodology has been validated experimentally by comparing with a numerous scheduling algorithm namely as Round Robin (RR), Adaptive Round Robin (ARR), Round Robin Remaining time (RRRT), improved Round Robin (IRR), an additional improvement on the improved Round Robin (AAAIRR), and an Enhanced Round Robin (ERR). Numerous simulations have been conducted to validate the effectiveness of the proposed algorithm to compelling the performance of system. At the conclusion the performance of computing system is dependent on security of operating system as well as secluding methods.

Chapter 6 - Eliminating the Security Weakness of Linux and Unix Operating Systems

Despite decades of research in extensible operating system technology, extensions such as device drivers remain a significant cause of system failures. In Windows XP, for example, drivers account for 85% of recently reported failures.This article describes Nooks, a reliability subsystem that seeks to greatly enhance operating system (OS) reliability by isolating the OS from driver failures. The Nooks approach is practical: rather than guaranteeing complete fault tolerance through a new (and incompatible) OS or driver architecture, our goal is to prevent the vast majority of driver-caused crashes with little or no change to the existing driver and system code. Nooks isolates drivers within lightweight protection domains inside the kernel address space, where hardware and software prevent them from corrupting the kernel. Nooks also tracks a driver's use of kernel resources to facilitate automatic cleanup during recovery.To prove the viability of our approach, we implemented Nooks in the Linux operating system and used it to fault-isolate several device drivers. Our results show that Nooks offers a substantial increase in the reliability of operating systems, catching and quickly recovering from many faults that would otherwise crash the system. Under a wide range and number of fault conditions, we show that Nooks recovers automatically from 99% of the faults that otherwise cause Linux to crash.While Nooks was designed for drivers, our techniques generalize to other kernel extensions. We demonstrate this by isolating a kernel-mode file system and an in-kernel Internet service. Overall, because Nooks supports existing C-language extensions, runs on a commodity operating system and hardware, and enables automated recovery, it represents a substantial step beyond the specialized architectures and type-safe languages required by previous efforts directed at safe extensibility.

Abstract—During the Covid-19 pandemic, all learning activities were carried out online. Many learning media and software are used in online learning. One of them is the Open Source Operating System which is currently widely used in online learning systems. This makes the operating system much attention by the world of education, researchers, government organizations, individuals, even large software companies such as Google and others who are very interested in developing Open Source software, especially the Linux Operating System. This makes the authors interested in knowing how to develop an operating system based on open source software in online learning systems and disseminate the use of open source software to the public.

In this paper, we study device driver architectures on two different operating systems, Fuchsia and Linux. Fuchsia is a relatively new operating system developed by Google and it is based on a microkernel named Zircon, while Linux-based operating system is based on a monolithic kernel. This paper examines technical details of device driver on Fuchsia and Linux operating systems with the focus on different kernel designs. We also quantitatively evaluate the performance of device drivers on both operating systems by measuring I/O throughput in a real device.

The operating system (OS) is the basic software on top of the computer hardware system, which can provide necessary support for the operation of other application software. In addition, the OS is also a fundamental tool for application development, and an integrated development environment (IDE) is installed on top of it. Consequently, Linux OS is introduced into the computer science related majors and as an advanced course. In this paper, the Linux programming curriculum reform is discussed in the era of open-source hardware and software. Different from the traditional Linux courses on server related operations, we focus more on desktop level program development or embedded system software development based on Linux operating system. Moreover, communication between two hardware systems installed with Linux operating systems is also considered. The effectiveness of the proposed reform methods has been verified through practical teaching work.

This tutorial is extracted from the recently completed monograph, Computer Security: Its Problems and Solutions [3], and is intended as a technical review of research in the areas of operating system security. Furthermore, it is intended to provide some assessment and evaluation of the work reviewed. Some projections and speculations of future activities in operating system research are also included. Because the tutorial is written for technical people who are not directly conducting such research, we have tried to present the review in an illustrative manner with intuitive and informal definitions of the necessary technology. The tutorial expounds the notion of surveillance in terms of logging and threat monitoring. It conceptualizes the problems and solutions of access control. To achieve security, the operating system relies on isolation. The tutorial points out the trade-off between security and cost of isolation. Furthermore, it illustrates two impor tant isolation methods. In order to provide security, the operating system must be designed and implemented as a secure system. The use of verification techniques for proving the correctness of secure operating system design and implementation is examined. When the operating system is large and the security requirements are elaborate, it may be necessary to concentrate the secure elements in a kernel. The notion of secure kernel is therefore examined. Other methods such as penetration tests are also examined An up-to-date bibliography since 1974 is included. To allow the readers to have a coherent coverage of various topics of operating system security, we have endeavored to give our personal views of various subject matters. We would like the reader to bear with us in the expression of these views.

Users and resources in a system are defined subjects and objects separately and abstractly by a mandatory access control mechanism. Both subjects and objects are endowed with security levels. The computer's security on basis of the operating system, and the operating system is the basic software of a computer. We present a model of security operating system. As we know the operating system has many security disables. But after the research on current security of Linux OS, this paper using access controlling, auditing and LPT designs a generalized security operating system. The design principles of security architecture and three basic security models: confidentiality, integrity, and privilege control models are discussed, respectively. Three novel security models and new security architecture are proposed. And this model was able to satisfy the standard of security operating system.

ABSTRACTAn operating system is the essence of software, serving as the foundation for the operation of various application software. The security of the operating system is crucial for national informatization construction. Data indicate that many cybersecurity incidents result from exploiting security vulnerabilities in the operating system. Linux is currently the most widely used open‐source operating system, with thousands of Common Vulnerabilities and Exposures (CVEs) related to Linux systems reported each year. Therefore, research and prevention of vulnerabilities in the Linux system are particularly important. To gain a better understanding of the characteristics of Linux system vulnerabilities, this paper leverages knowledge in the field of software security to analyze nearly 10,000 historical vulnerability data in two core systems of Linux: Linux Kernel and Debian Linux. The study explores the evolutionary patterns of vulnerability characteristics. Specific research contents include the following: (1) data collection and cleaning of vulnerability data in Linux Kernel and Debian Linux systems; (2) cross‐statistical analysis of structured data features in vulnerability reports; (3) unstructured data characteristics mining in vulnerability reports based on domain knowledge; (4) analysis of the evolution of vulnerability characteristics. This paper provides empirical lessons and guidance for Linux system vulnerabilities to assist practitioners and researchers in better preventing and detecting vulnerabilities in Linux and Linux‐based systems.