Linux Security Deep Dive: How LD_PRELOAD Makes It Possible to Audit and Control Root Users

5/3/2018 1:00:00 PM [(UTC-05:00) Eastern Time (US & Canada)] - Can't make the live event? Register anyway to receive a link to the recording.

Show/Hide All Time Zones

All Time Zones

Dateline Standard Time-(UTC-12:00) International Date Line West 5/3/2018 5:00:00 AM
UTC-11-(UTC-11:00) Coordinated Universal Time-11 5/3/2018 6:00:00 AM
Aleutian Standard Time-(UTC-10:00) Aleutian Islands 5/3/2018 8:00:00 AM
Hawaiian Standard Time-(UTC-10:00) Hawaii 5/3/2018 7:00:00 AM
Marquesas Standard Time-(UTC-09:30) Marquesas Islands 5/3/2018 7:30:00 AM
Alaskan Standard Time-(UTC-09:00) Alaska 5/3/2018 9:00:00 AM
UTC-09-(UTC-09:00) Coordinated Universal Time-09 5/3/2018 8:00:00 AM
Pacific Standard Time (Mexico)-(UTC-08:00) Baja California 5/3/2018 10:00:00 AM
UTC-08-(UTC-08:00) Coordinated Universal Time-08 5/3/2018 9:00:00 AM
Pacific Standard Time-(UTC-08:00) Pacific Time (US & Canada) 5/3/2018 10:00:00 AM
US Mountain Standard Time-(UTC-07:00) Arizona 5/3/2018 10:00:00 AM
Mountain Standard Time (Mexico)-(UTC-07:00) Chihuahua, La Paz, Mazatlan 5/3/2018 11:00:00 AM
Mountain Standard Time-(UTC-07:00) Mountain Time (US & Canada) 5/3/2018 11:00:00 AM
Central America Standard Time-(UTC-06:00) Central America 5/3/2018 11:00:00 AM
Central Standard Time-(UTC-06:00) Central Time (US & Canada) 5/3/2018 12:00:00 PM
Easter Island Standard Time-(UTC-06:00) Easter Island 5/3/2018 12:00:00 PM
Central Standard Time (Mexico)-(UTC-06:00) Guadalajara, Mexico City, Monterrey 5/3/2018 12:00:00 PM
Canada Central Standard Time-(UTC-06:00) Saskatchewan 5/3/2018 11:00:00 AM
SA Pacific Standard Time-(UTC-05:00) Bogota, Lima, Quito, Rio Branco 5/3/2018 12:00:00 PM
Eastern Standard Time (Mexico)-(UTC-05:00) Chetumal 5/3/2018 12:00:00 PM
Eastern Standard Time-(UTC-05:00) Eastern Time (US & Canada) 5/3/2018 1:00:00 PM
Haiti Standard Time-(UTC-05:00) Haiti 5/3/2018 1:00:00 PM
Cuba Standard Time-(UTC-05:00) Havana 5/3/2018 1:00:00 PM
US Eastern Standard Time-(UTC-05:00) Indiana (East) 5/3/2018 1:00:00 PM
Turks And Caicos Standard Time-(UTC-05:00) Turks and Caicos 5/3/2018 1:00:00 PM
Paraguay Standard Time-(UTC-04:00) Asuncion 5/3/2018 1:00:00 PM
Atlantic Standard Time-(UTC-04:00) Atlantic Time (Canada) 5/3/2018 2:00:00 PM
Venezuela Standard Time-(UTC-04:00) Caracas 5/3/2018 1:00:00 PM
Central Brazilian Standard Time-(UTC-04:00) Cuiaba 5/3/2018 1:00:00 PM
SA Western Standard Time-(UTC-04:00) Georgetown, La Paz, Manaus, San Juan 5/3/2018 1:00:00 PM
Pacific SA Standard Time-(UTC-04:00) Santiago 5/3/2018 2:00:00 PM
Newfoundland Standard Time-(UTC-03:30) Newfoundland 5/3/2018 2:30:00 PM
Tocantins Standard Time-(UTC-03:00) Araguaina 5/3/2018 2:00:00 PM
E. South America Standard Time-(UTC-03:00) Brasilia 5/3/2018 2:00:00 PM
SA Eastern Standard Time-(UTC-03:00) Cayenne, Fortaleza 5/3/2018 2:00:00 PM
Argentina Standard Time-(UTC-03:00) City of Buenos Aires 5/3/2018 2:00:00 PM
Greenland Standard Time-(UTC-03:00) Greenland 5/3/2018 3:00:00 PM
Montevideo Standard Time-(UTC-03:00) Montevideo 5/3/2018 2:00:00 PM
Magallanes Standard Time-(UTC-03:00) Punta Arenas 5/3/2018 2:00:00 PM
Saint Pierre Standard Time-(UTC-03:00) Saint Pierre and Miquelon 5/3/2018 3:00:00 PM
Bahia Standard Time-(UTC-03:00) Salvador 5/3/2018 2:00:00 PM
UTC-02-(UTC-02:00) Coordinated Universal Time-02 5/3/2018 3:00:00 PM
Mid-Atlantic Standard Time-(UTC-02:00) Mid-Atlantic - Old 5/3/2018 4:00:00 PM
Azores Standard Time-(UTC-01:00) Azores 5/3/2018 5:00:00 PM
Cape Verde Standard Time-(UTC-01:00) Cabo Verde Is. 5/3/2018 4:00:00 PM
UTC-(UTC) Coordinated Universal Time 5/3/2018 5:00:00 PM
Morocco Standard Time-(UTC+00:00) Casablanca 5/3/2018 6:00:00 PM
GMT Standard Time-(UTC+00:00) Dublin, Edinburgh, Lisbon, London 5/3/2018 6:00:00 PM
Greenwich Standard Time-(UTC+00:00) Monrovia, Reykjavik 5/3/2018 5:00:00 PM
W. Europe Standard Time-(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna 5/3/2018 7:00:00 PM
Central Europe Standard Time-(UTC+01:00) Belgrade, Bratislava, Budapest, Ljubljana, Prague 5/3/2018 7:00:00 PM
Romance Standard Time-(UTC+01:00) Brussels, Copenhagen, Madrid, Paris 5/3/2018 7:00:00 PM
Central European Standard Time-(UTC+01:00) Sarajevo, Skopje, Warsaw, Zagreb 5/3/2018 7:00:00 PM
W. Central Africa Standard Time-(UTC+01:00) West Central Africa 5/3/2018 6:00:00 PM
Jordan Standard Time-(UTC+02:00) Amman 5/3/2018 8:00:00 PM
GTB Standard Time-(UTC+02:00) Athens, Bucharest 5/3/2018 8:00:00 PM
Middle East Standard Time-(UTC+02:00) Beirut 5/3/2018 8:00:00 PM
Egypt Standard Time-(UTC+02:00) Cairo 5/3/2018 7:00:00 PM
E. Europe Standard Time-(UTC+02:00) Chisinau 5/3/2018 8:00:00 PM
Syria Standard Time-(UTC+02:00) Damascus 5/3/2018 8:00:00 PM
West Bank Standard Time-(UTC+02:00) Gaza, Hebron 5/3/2018 8:00:00 PM
South Africa Standard Time-(UTC+02:00) Harare, Pretoria 5/3/2018 7:00:00 PM
FLE Standard Time-(UTC+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius 5/3/2018 8:00:00 PM
Israel Standard Time-(UTC+02:00) Jerusalem 5/3/2018 8:00:00 PM
Kaliningrad Standard Time-(UTC+02:00) Kaliningrad 5/3/2018 7:00:00 PM
Sudan Standard Time-(UTC+02:00) Khartoum 5/3/2018 7:00:00 PM
Libya Standard Time-(UTC+02:00) Tripoli 5/3/2018 7:00:00 PM
Namibia Standard Time-(UTC+02:00) Windhoek 5/3/2018 7:00:00 PM
Arabic Standard Time-(UTC+03:00) Baghdad 5/3/2018 8:00:00 PM
Turkey Standard Time-(UTC+03:00) Istanbul 5/3/2018 8:00:00 PM
Arab Standard Time-(UTC+03:00) Kuwait, Riyadh 5/3/2018 8:00:00 PM
Belarus Standard Time-(UTC+03:00) Minsk 5/3/2018 8:00:00 PM
Russian Standard Time-(UTC+03:00) Moscow, St. Petersburg, Volgograd 5/3/2018 8:00:00 PM
E. Africa Standard Time-(UTC+03:00) Nairobi 5/3/2018 8:00:00 PM
Iran Standard Time-(UTC+03:30) Tehran 5/3/2018 9:30:00 PM
Arabian Standard Time-(UTC+04:00) Abu Dhabi, Muscat 5/3/2018 9:00:00 PM
Astrakhan Standard Time-(UTC+04:00) Astrakhan, Ulyanovsk 5/3/2018 9:00:00 PM
Azerbaijan Standard Time-(UTC+04:00) Baku 5/3/2018 9:00:00 PM
Russia Time Zone 3-(UTC+04:00) Izhevsk, Samara 5/3/2018 9:00:00 PM
Mauritius Standard Time-(UTC+04:00) Port Louis 5/3/2018 9:00:00 PM
Saratov Standard Time-(UTC+04:00) Saratov 5/3/2018 9:00:00 PM
Georgian Standard Time-(UTC+04:00) Tbilisi 5/3/2018 9:00:00 PM
Caucasus Standard Time-(UTC+04:00) Yerevan 5/3/2018 9:00:00 PM
Afghanistan Standard Time-(UTC+04:30) Kabul 5/3/2018 9:30:00 PM
West Asia Standard Time-(UTC+05:00) Ashgabat, Tashkent 5/3/2018 10:00:00 PM
Ekaterinburg Standard Time-(UTC+05:00) Ekaterinburg 5/3/2018 10:00:00 PM
Pakistan Standard Time-(UTC+05:00) Islamabad, Karachi 5/3/2018 10:00:00 PM
India Standard Time-(UTC+05:30) Chennai, Kolkata, Mumbai, New Delhi 5/3/2018 10:30:00 PM
Sri Lanka Standard Time-(UTC+05:30) Sri Jayawardenepura 5/3/2018 10:30:00 PM
Nepal Standard Time-(UTC+05:45) Kathmandu 5/3/2018 10:45:00 PM
Central Asia Standard Time-(UTC+06:00) Astana 5/3/2018 11:00:00 PM
Bangladesh Standard Time-(UTC+06:00) Dhaka 5/3/2018 11:00:00 PM
Omsk Standard Time-(UTC+06:00) Omsk 5/3/2018 11:00:00 PM
Myanmar Standard Time-(UTC+06:30) Yangon (Rangoon) 5/3/2018 11:30:00 PM
SE Asia Standard Time-(UTC+07:00) Bangkok, Hanoi, Jakarta 5/4/2018 12:00:00 AM
Altai Standard Time-(UTC+07:00) Barnaul, Gorno-Altaysk 5/4/2018 12:00:00 AM
W. Mongolia Standard Time-(UTC+07:00) Hovd 5/4/2018 12:00:00 AM
North Asia Standard Time-(UTC+07:00) Krasnoyarsk 5/4/2018 12:00:00 AM
N. Central Asia Standard Time-(UTC+07:00) Novosibirsk 5/4/2018 12:00:00 AM
Tomsk Standard Time-(UTC+07:00) Tomsk 5/4/2018 12:00:00 AM
China Standard Time-(UTC+08:00) Beijing, Chongqing, Hong Kong, Urumqi 5/4/2018 1:00:00 AM
North Asia East Standard Time-(UTC+08:00) Irkutsk 5/4/2018 1:00:00 AM
Singapore Standard Time-(UTC+08:00) Kuala Lumpur, Singapore 5/4/2018 1:00:00 AM
W. Australia Standard Time-(UTC+08:00) Perth 5/4/2018 1:00:00 AM
Taipei Standard Time-(UTC+08:00) Taipei 5/4/2018 1:00:00 AM
Ulaanbaatar Standard Time-(UTC+08:00) Ulaanbaatar 5/4/2018 1:00:00 AM
North Korea Standard Time-(UTC+08:30) Pyongyang 5/4/2018 1:30:00 AM
Aus Central W. Standard Time-(UTC+08:45) Eucla 5/4/2018 1:45:00 AM
Transbaikal Standard Time-(UTC+09:00) Chita 5/4/2018 2:00:00 AM
Tokyo Standard Time-(UTC+09:00) Osaka, Sapporo, Tokyo 5/4/2018 2:00:00 AM
Korea Standard Time-(UTC+09:00) Seoul 5/4/2018 2:00:00 AM
Yakutsk Standard Time-(UTC+09:00) Yakutsk 5/4/2018 2:00:00 AM
Cen. Australia Standard Time-(UTC+09:30) Adelaide 5/4/2018 2:30:00 AM
AUS Central Standard Time-(UTC+09:30) Darwin 5/4/2018 2:30:00 AM
E. Australia Standard Time-(UTC+10:00) Brisbane 5/4/2018 3:00:00 AM
AUS Eastern Standard Time-(UTC+10:00) Canberra, Melbourne, Sydney 5/4/2018 3:00:00 AM
West Pacific Standard Time-(UTC+10:00) Guam, Port Moresby 5/4/2018 3:00:00 AM
Tasmania Standard Time-(UTC+10:00) Hobart 5/4/2018 3:00:00 AM
Vladivostok Standard Time-(UTC+10:00) Vladivostok 5/4/2018 3:00:00 AM
Lord Howe Standard Time-(UTC+10:30) Lord Howe Island 5/4/2018 3:30:00 AM
Bougainville Standard Time-(UTC+11:00) Bougainville Island 5/4/2018 4:00:00 AM
Russia Time Zone 10-(UTC+11:00) Chokurdakh 5/4/2018 4:00:00 AM
Magadan Standard Time-(UTC+11:00) Magadan 5/4/2018 4:00:00 AM
Norfolk Standard Time-(UTC+11:00) Norfolk Island 5/4/2018 4:00:00 AM
Sakhalin Standard Time-(UTC+11:00) Sakhalin 5/4/2018 4:00:00 AM
Central Pacific Standard Time-(UTC+11:00) Solomon Is., New Caledonia 5/4/2018 4:00:00 AM
Russia Time Zone 11-(UTC+12:00) Anadyr, Petropavlovsk-Kamchatsky 5/4/2018 5:00:00 AM
New Zealand Standard Time-(UTC+12:00) Auckland, Wellington 5/4/2018 5:00:00 AM
UTC+12-(UTC+12:00) Coordinated Universal Time+12 5/4/2018 5:00:00 AM
Fiji Standard Time-(UTC+12:00) Fiji 5/4/2018 5:00:00 AM
Kamchatka Standard Time-(UTC+12:00) Petropavlovsk-Kamchatsky - Old 5/4/2018 6:00:00 AM
Chatham Islands Standard Time-(UTC+12:45) Chatham Islands 5/4/2018 5:45:00 AM
UTC+13-(UTC+13:00) Coordinated Universal Time+13 5/4/2018 6:00:00 AM
Tonga Standard Time-(UTC+13:00) Nuku'alofa 5/4/2018 6:00:00 AM
Samoa Standard Time-(UTC+13:00) Samoa 5/4/2018 6:00:00 AM
Line Islands Standard Time-(UTC+14:00) Kiritimati Island 5/4/2018 7:00:00 AM

Webinar Registration

Received knowledge firmly states that if you are root you can do anything; that there’s no control over you; you can circumvent any policy and avoid being monitored. In this webinar, I’m going to show you Linux’s dynamic linker and how it uses LD_PRELOAD environment variable. This provides a powerful way to intercept system calls and modify or replace the normal behavior of the library in question. The power of LD_PRELOAD is great, and it can be used for good or evil. But, why do we need LD_PRELOAD for controlling admins in the first place? Isn’t that what sudo is for? Let’s go back in time a bit…

In the elder days, all admins were created good and there was no need to limit their authority, audit their activities or even individually identify them. Everyone logged in as root—and it was like paradise.

But, then maturity (i.e. compliance, governance, and best practice) darkened the land and departments grew to hundreds and thousands. And root was now too powerful for everyone to be entrusted with.

So, a wise programmer built sudo so that certain accounts could be delegated specific privileges without tempting them with the full power of root. However, the sudoers file is written in a complicated language few can master, and its “default deny” model requires that every possible command a user might need to run as root be anticipated in advance. This led to many shops taking the easy way out and defining weak sudoers files that allow IT accounts to run any command, which largely defeats the purpose of sudo. In addition, evil individuals have found ways to bypass sudo by “shelling out” from applications allowed in sudoers. Sudo has ways to protect against this, but they tend to cause other problems. Malicious actors hide their nefarious commands in script files and find ways to execute them. 

The bottom line is that sometimes you still need to be root. Wouldn’t it be nice if there were a way to implement the opposite type of control? Whereas sudo is based on a “default deny” or whitelist concept, what we need is a default allow / blacklist control for when users really do need root access. 

That’s where LD_PRELOAD comes in. In this real training-for-free session, I’ll show you how dynamic libraries work in Linux (similar to DLLs in Windows) and how you can specify an alternative library to load before the normal library. As noted earlier, this gives you the ability to intercept systems calls and augment, replace, or just cancel the behavior of the intended library’s implementation of the function.

This technique does require some pretty sophisticated programming. And that’s where Paul Harper, from our sponsor BeyondTrust, comes in. Paul will show you how the Advanced Control and Audit (ACA) feature, released in PowerBroker for Unix & Linux 9.0, traps file system-related library calls and allow, disallow, and audit the calls. This enables you to specify operations (e.g. open/read/write/exec) that can or cannot be performed on a file (using shell style file patterns to match files) and will also specify an auditing level. This creates some incredible abilities to block specific actions by users with access to root, and creates an unprecedented audit trail, even of what happens inside scripts.

Please join me for this technical deep dive into how Linux works internally, and how that can be leveraged to provide control and audit over root access.

First Name:   
Last Name:   
Work Email:  
Phone:  
Organization:  
Country:    
State:  
How many employees in your organization?:
What is your job function?:
What is your role within your department?:
I'd like to schedule a personalized demo with a BeyondTrust rep for:
 

Your information will be shared with the sponsor.


 

 

Additional Resources