2002 news
04.11.2002 - As promised I released the new AngeL stable
version. angel_execve() was improved and becomed
less faulty. The Makefile was revised and the use of the new
shellcode scanner is disabled by default. The new shellcode
scanner, backported from development tree, works but the old one (
which works as well ) is more reliable at the moment so use it.
With latest stable versions an oops occured while removing the
module. I removed a proc entry after removing it's entry father,
so the kernel wasn't very happy about it. Please, upgrade
to 0.8.9 which fix all these
problems.
31.10.2002 - Halloween goodie for all our beloved AngeL hackers.
The real development tree starts today. AngeL version 0.9.0 is released today. Stability
issues are related to the new shellcode scanner. I'm working hard
into fixing some bad handled pointer. Some unexpected oops is
reported after loading the module, so please don't use this
development version in production servers. I also do working in
backporting some fixes to stable code. I think in a couple
of weeks we'll be out with AngeL-0.8.9 with some
improvements as well.
23.10.2002 - I decided to apply the patch to the third release
candidate and coming out with a fourth rc version. Nothing
else is changed so, if you already applied the patch, you
don't need to download this version.
17.10.2002 - Please note. A typo error was found by
last night in angelMemoryMalloc(). The memory free
function is called with the old name which is changed yesterday.
The patch is trivial and it can be found here. Apply this patch in order to
have AngeL rc3 working. The execve() wrapper has a
strange behaviour sometime, I was working really hard to give you
a stable wrapper, I also think I have to rewrite it from
scratch.
16.10.2002 - Third and last release candidate for
development AngeL series. Fixed some typos in
angel_execve() and some memory handling macro was defined
in order to have a more readable code. If all goes well with rc3,
we will release 0.9.0 development version in a week, and
so starting redesign AngeL net core. Please remember that stable
AngeL version is still 0.8.8, we will support 0.8.x release
until 0.10.x ( or 1.0.x ) version will be ready.
11.10.2002 - Second release candidate for development AngeL
series. We are working hard in logging facilities macro and
avoiding oopses in angel_execve... our most complicated
wrapper I guess. More hacks is placed to avoid system call
redirection, I think Angelo's code definitly rocks. So please,
AngeL's hackers, feel free to download our latest source code and
hacking around it. See host/Changelog for details.
26.09.2002 - New development release. Anti syscall redirection
code is now almost complete. Angelo Dell'Aera was very
active this month writing an awesome piece of code. We are really
near to start 0.9.0 development series releases.
03.09.2002 - News from AngeL stable world. People reported me that
it sounds difficult to compile AngeL if /boot/System.map doesn't
exist. In RedHat system, but also in my Debian box,
/boot/System.map-`uname -r` is used instead. AngeL makefile
doesn't find the required file and compilation aborted. I remember
you that we need to inspect System.map in order to take
sysrq_enable and handle_sysrq addresses since these functions
aren't exported by the kernel. Now a script is called by Makefile
and, if System.map is not found or the required addresses were not
found as well ( e.g. you have not compiled your kernel includiny
sysrq support in "Kernel Hacking" menu ) an appropriate header
file is generated disabling sysrq functions in AngeL.
Please listen to me now.Sysrq facility is used when a
malicious root tries to unload AngeL without using the startup
password, AngeL will react to this attempt syncing the disks,
unmounting them and shutting down the host. Without the sysrq
facility, AngeL will raise a kernel panic without taking
care of your disk, so please compile the kernel with sysrq support
if you can.
Please note that a logging feature is turned on as
well. In Make file you will find LOG_ANGEL = y directive that
turns on loggin facilities in /var/log/angel. Comment out these
feature if you don't want the module writes in /var/log/angel
before compiling.
On the development 0.9.0 site we are working
with good results in system call redirection and in other module
self defence facilities, so stay tuned.
03.07.2002 - Call for help. We need help to develop AngeL
module but, if you are not a kernel hacker but you can write C
programs please think about helping us to develop arc2 tool (
contact me if you are
interested ). I'm planning to write a gkrellm plugin to display some
AngeL stats. If you are experienced into gkrellm plugin
development, please contact me as well. Bye :)
03.07.2002 - Yes, we are alive. We are working hard in prepare a
0.9.0 release which is unvulnerable to system call redirect. Many
thanks to Angelo Dell'Aera for the really cool code he
wrote. 0.9.0 Milestone 5 release is the result of two
month of work, I hope you enjoy this. No changes were made to
stable AngeL release.
03.04.2002 - People report me that local DoS occours and the
machine freeze if root tryes to perform a fork or a malloc
bombing. AngeL fails to detect root attack due to a silly coding
error in Is_this_a_fork_bomb() and
Is_this_a_malloc_bomb() functions. These functions return
attacker uid or 0 if no attack is detected. At this point you may
guess that if root performs an attack, attacker uid is the same
than no attack code. This is fixed also in 0.9.0 Milestone 3
release. A new feature is added in stable release as well.
In Makefile you can use the non heuristic shellcode
scanner backported from 0.9.0 development series, so you may test
it without downloading development code. Please uncomment #
USE_EXPERIMENTAL_SCANNER=y from the makefile and recompile
angel.
03.02.2002 - Some fixes on "No codE" AngeL. arc tool now has a -H
flag that estimate fork() and malloc() system call throughput. You
can use these values to make an AngeL fine tune for your system
and you can lower the false positive probability. Some fix in
Is_this_a_malloc_bomb() that now calculate correctly the brk() /
sec ratio. Some fixes also in angel_execve() in order to avoid
false positive shellcode detection. Makefile shipped with AngeL
has outgoing mail check disabled as default because of the elevate
number of false positives. We still working on 0.9.x development,
we're going to change angel_execve() shellcode pattern matching
with some method more accurate.
09.01.2002 - Out! Today, our experimental angel code is
coming out for the first time. Basically it stops the same attacks
as the latest stable release but new cools features came across
module's architecture. Now I need your tests, I need your support
and I need your ideas in order to have a smashing new stable
release before next summer.
02.01.2002 - New year, new face. Just web site style change. As
you can see the development series version is set to
0.9.0pre6, it's true! We are working on the new release
which contains cools new features:
-
/proc tuning now is done using sysctl interface, it means
that proc entry handlers disapperd and the code is now
lightweight;
-
host related stuff is divided from net related one. This
means that in engine.c there are just few lines of code,
simply host_init and net_init function calls. It wasn't
possible to divide AngeL in 3 separated modules do to
some problem related to /proc/sys handling but logically
it is do divided;
-
now we provide logging also in /var/log/angel.
I think in a month we could hack onto the final 0.9.0
release. Stay tuned.
$Id: 2002_news.html,v 1.2 2004/01/14 21:15:44 sponge Exp $