Illegal privilege escalation detection method, device, electronic device and storage medium
The method and device monitor user identifiers at LSM points and verify sudo escalations to detect and prevent illegal privilege escalations, improving system security by identifying and alerting unauthorized privilege changes.
Patent Information
- Application Number
- CN202111130815.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-09-26
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2041-09-26
AI Technical Summary
Existing systems fail to effectively detect and defend against privilege escalation attacks, particularly those exploiting hardware and processor vulnerabilities, which compromise system security by illegally elevating privileges.
A method and device that monitor user identifiers at Log Structured Merge (LSM) monitoring points, checking for inconsistencies and tampering, and verify sudo privilege escalations to identify and alert illegal privilege escalation operations.
Effectively detects and prevents illegal privilege escalations by continuously monitoring user identifiers, enhancing system security through timely detection and protective measures.
Smart Images
Figure CN113987435B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to an illegal privilege escalation detection method, device, electronic device and storage medium. Background Art
[0002] Privilege escalation attacks are usually carried out by low-privilege users who illegally escalate privileges through hardware vulnerabilities and / or processor vulnerabilities of the device, elevating privileges to high privileges, such as root privileges, and then perform various operations as root, such as maliciously reading and writing data, downloading virus programs, and other malicious operations, which seriously affect system security.
[0003] In the face of vulnerability-based privilege escalation attacks, how to effectively detect and defend against illegal privilege escalation operations is a technical problem that needs to be solved urgently. Summary of the invention
[0004] In view of the problems in the prior art, embodiments of the present invention provide a method, device, electronic device and storage medium for detecting illegal privilege escalation.
[0005] Specifically, the embodiment of the present invention provides the following technical solutions:
[0006] In a first aspect, an embodiment of the present invention provides a method for detecting illegal privilege escalation, the method comprising:
[0007] When the first log structure merge LSM monitoring point detects the first process, obtaining the current user identifier of the first process;
[0008] Obtaining a pre-stored target user identifier of the first process;
[0009] When the current user identifier of the first process is inconsistent with the target user identifier of the first process, it is determined that the first process is an illegal privilege escalation operation.
[0010] Furthermore, the method further comprises:
[0011] When the second LSM monitoring point detects that the second process is a critical process and the static stack rule matching check on the second process fails, it is determined that the second process has an illegally set user identifier; wherein the second LSM monitoring point is provided with a static stack rule matching, and the second LSM monitoring point is used to detect whether the second process has an illegally set user identifier.
[0012] Furthermore, the method further comprises:
[0013] When it is detected that a user executes a sudo program and sets a user identifier setuid to elevate privileges, a query request is sent to an application layer of the electronic device; wherein the query request is used to request the application layer to verify whether the user has the sudo privilege escalation qualification;
[0014] In the case that the user does not have the sudo privilege escalation qualification, the setuid privilege escalation is determined to be an illegal privilege escalation operation.
[0015] Furthermore, the type of the user identification includes at least one of the following:
[0016] The actual user ID uid, the saved set user ID suid, the effective user ID euid, and the file system user ID fsuid.
[0017] Furthermore, after determining that the first process is an illegal privilege escalation operation, the method further includes:
[0018] Generate a first prompt message for the first process; wherein the first prompt message is used to indicate that the first process is an illegal privilege escalation operation.
[0019] In a second aspect, an embodiment of the present invention provides an illegal privilege escalation detection device, the device comprising:
[0020] A first acquisition module is used to acquire a current user identifier of the first process when the first log structure merge LSM monitoring point detects the first process;
[0021] A second acquisition module, used to acquire a pre-stored target user identifier of the first process;
[0022] The first determination module is configured to determine that the first process is an illegal privilege escalation operation when the current user identifier of the first process is inconsistent with the target user identifier of the first process.
[0023] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the illegal privilege escalation detection method described in the first aspect are implemented.
[0024] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the illegal privilege escalation detection method as described in the first aspect.
[0025] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the illegal privilege escalation detection method described in the first aspect.
[0026] The illegal privilege escalation detection method, device, electronic device and storage medium provided by the embodiments of the present invention pre-store the target user identifier of the first process when it is created. When the first process enters each LSM monitoring point, the LSM monitoring point detects whether the user identifier of the first process has been tampered with. The user identifier of the first process can be continuously monitored, thereby realizing illegal privilege escalation detection based on the memory instruction level, and can effectively detect illegal privilege escalation operations, and then take protective measures in time to improve system security. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0028] Figure 1 One of the flow charts of the illegal privilege escalation detection method provided by the embodiment of the present invention;
[0029] Figure 2 A second flowchart of the method for detecting illegal privilege escalation provided by an embodiment of the present invention;
[0030] Figure 3 A third flowchart of the method for detecting illegal privilege escalation provided by an embodiment of the present invention;
[0031] Figure 4 A fourth flowchart of the method for detecting illegal privilege escalation provided by an embodiment of the present invention;
[0032] Figure 5 A schematic diagram of the structure of an illegal privilege escalation detection device provided by an embodiment of the present invention;
[0033] Figure 6 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION
[0034] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0035] In order to solve the technical problems existing in the prior art, an embodiment of the present invention provides an illegal privilege escalation detection method, which obtains the current user identifier of the first process when the first process is detected at a first log structured merge (LSM) monitoring point; obtains the pre-stored target user identifier of the first process; and determines that the first process is an illegal privilege escalation operation when the current user identifier of the first process is inconsistent with the target user identifier of the first process. When the first process enters each LSM monitoring point, the LSM monitoring point detects whether the user identifier of the first process is tampered with, and can continuously monitor the user identifier of the first process, thereby realizing illegal privilege escalation detection based on the memory instruction level, and can effectively detect illegal privilege escalation operations, and then take protective measures in time to improve system security.
[0036] Figure 1 One of the flow charts of the illegal privilege escalation detection method provided by the embodiment of the present invention is as follows: Figure 1 As shown, the method includes:
[0037] Step 101: When a first process is detected at a first LSM monitoring point, a current user identifier of the first process is obtained;
[0038] Step 102: Obtain a pre-stored target user identifier of the first process;
[0039] Step 103: When the current user identifier of the first process is inconsistent with the target user identifier of the first process, determine that the first process is an illegal privilege escalation operation.
[0040] Optionally, the illegal privilege escalation detection method provided by the embodiment of the present invention can be applied to the scenario of monitoring and identifying illegal privilege escalation vulnerabilities in the Linux platform. The execution subject of the illegal privilege escalation detection method can be an illegal privilege escalation detection device, such as an electronic device, or a control module in the illegal privilege escalation detection device for executing the illegal privilege escalation detection method.
[0041] Optionally, the type of the user identifier includes at least one of the following: an actual user identifier (userid, uid), a saved set user identifier (saved uid, suid), an effective user identifier (effective userid, euid), and a user identifier for the file system (user effective identifiers for file access, fsuid).
[0042] Optionally, an embodiment of the present invention monitors the user identifier of the first process throughout its life cycle, saves and synchronously updates the set user identifier when the first process is created, and detects whether the user identifier of the first process has been illegally tampered with when the first process enters and exits each LSM monitoring point. If the current user identifier of the first process is inconsistent with the stored target user identifier, it is determined that the first process is an illegal privilege escalation operation.
[0043] The illegal privilege escalation detection method provided by the embodiment of the present invention pre-stores the target user identifier of the first process when it is created. When the first process enters each LSM monitoring point, the LSM monitoring point detects whether the user identifier of the first process has been tampered with. The user identifier of the first process can be continuously monitored, thereby realizing illegal privilege escalation detection based on the memory instruction level, and can effectively detect illegal privilege escalation operations, and then take protective measures in time to improve system security.
[0044] Optionally, after the electronic device determines that the first process is an illegal privilege escalation operation, it generates a first prompt message for the first process; wherein the first prompt message is used to indicate that the first process is an illegal privilege escalation operation. Optionally, the first prompt message may include alarm information, and the alarm information is used to indicate that the first process is an illegal privilege escalation operation.
[0045] Figure 2 The second flow chart of the illegal privilege escalation detection method provided by the embodiment of the present invention is as follows: Figure 2 As shown, the method includes:
[0046] Step 201: The first process enters the first LSM monitoring point;
[0047] Step 202: When a first process is detected at a first LSM monitoring point, a current user identifier of the first process is obtained;
[0048] Optionally, in the cred protection scenario, it is detected whether there is any illegal operation of illegally tampering with the process or the user identification of the program.
[0049] Step 203: Obtain the pre-stored target user identifier of the first process;
[0050] Step 204: determine whether the current user identifier of the first process is consistent with the target user identifier of the first process; if the current user identifier of the first process is inconsistent with the target user identifier of the first process, determine that the first process is an illegal privilege escalation operation, and go to step 205; if the current user identifier of the first process is consistent with the target user identifier of the first process, determine that the first process is a legal privilege escalation operation, and go to step 206;
[0051] Step 205: Generate alarm information for the first process; wherein the alarm information is used to indicate that the first process is an illegal privilege escalation operation.
[0052] Step 206: Release the first process.
[0053] Based on the above embodiments, an embodiment of the present invention further provides a solution for detecting whether a user identifier is illegally set in a cred protection scenario; specifically, when the second LSM monitoring point detects that the second process is a critical process and the static stack rule matching check of the second process fails, it is determined that the second process has an illegally set user identifier; wherein static stack rule matching is set in the second LSM monitoring point, and the second LSM monitoring point is used to detect whether the second process has an illegally set user identifier.
[0054] Figure 3 The third flow chart of the illegal privilege escalation detection method provided by the embodiment of the present invention is as follows: Figure 3 As shown, the method includes:
[0055] Step 301: The second process enters the second LSM monitoring point;
[0056] Step 302, determine whether the second process is a key process; if the second process is a key process, go to step 303; if the second process is not a key process, go to step 305;
[0057] Step 303: Perform a static stack rule matching check on the second process;
[0058] Optionally, the second LSM monitoring point may include task_fix_setuid, and static stack rule matching is added at the second LSM monitoring point to detect whether there is an illegal privilege escalation operation of illegally setting the user identifier.
[0059] Step 304, determine whether the check is passed; if the check is passed, go to step 305; if the check is not passed, it is determined that the second process is an illegal setting of the user identifier, and go to step 306;
[0060] Step 305: Release the second process.
[0061] Step 306: Generate alarm information for the second process; wherein the alarm information is used to indicate that the second process is an illegal privilege escalation operation.
[0062] On the basis of the above-mentioned embodiments, the embodiments of the present invention further provide a scheme for monitoring illegal operations performed by exploiting sudo vulnerabilities in sudo protection; specifically, when it is detected that a user executes a sudo program and sets a user identifier (setuid) to elevate privileges, a query request is sent to an application layer of an electronic device; wherein the query request is used to request the application layer to verify whether the user is eligible for sudo privilege escalation; when the user is not eligible for sudo privilege escalation, the setuid privilege escalation is determined to be an illegal privilege escalation operation.
[0063] Figure 4 A fourth flow chart of the illegal privilege escalation detection method provided by an embodiment of the present invention is as follows: Figure 4 As shown, the method includes:
[0064] Step 401: The user executes the sudo program;
[0065] Step 402: Elevate privileges through setuid;
[0066] Step 403: Send a query request to the application layer; wherein the query request is used to request the application layer to verify whether the user has the sudo privilege escalation qualification, and receive the query result;
[0067] Step 404, based on the query result, determine whether the user has the sudo privilege escalation qualification; if the user does not have the sudo privilege escalation qualification, determine that the setuid privilege escalation is an illegal privilege escalation operation, and go to step 405; if the user has the sudo privilege escalation qualification, go to step 406.
[0068] Step 405: Generate alarm information for the setuid privilege escalation; wherein the alarm information is used to indicate that the setuid privilege escalation is an illegal privilege escalation operation.
[0069] Step 406: Allow the setuid privilege escalation operation.
[0070] The following is a description of an illegal privilege escalation detection device provided by an embodiment of the present invention. The illegal privilege escalation detection device described below and the illegal privilege escalation detection method described above can be referenced to each other.
[0071] Figure 5 A schematic diagram of the structure of an illegal privilege escalation detection device provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the illegal privilege escalation detection device 500 includes: a first acquisition module 501, a second acquisition module 502 and a first determination module 503; wherein,
[0072] A first acquisition module 501 is used to acquire a current user identifier of a first process when a first process is detected at a first LSM monitoring point;
[0073] A second acquisition module 502 is used to acquire a pre-stored target user identifier of the first process;
[0074] The first determination module 503 is used to determine that the first process is an illegal privilege escalation operation when the current user identifier of the first process is inconsistent with the target user identifier of the first process.
[0075] The illegal privilege escalation detection device provided by the embodiment of the present invention pre-stores the target user identifier of the first process when it is created. When the first process enters each LSM monitoring point, the LSM monitoring point detects whether the user identifier of the first process has been tampered with. The user identifier of the first process can be continuously monitored, thereby realizing illegal privilege escalation detection based on the memory instruction level, and can effectively detect illegal privilege escalation operations, and then take protective measures in time to improve system security.
[0076] Optionally, the device further comprises:
[0077] The second determination module is used to determine that the second process has illegally set the user identifier when the second LSM monitoring point detects that the second process is a critical process and the static stack rule matching check on the second process fails; wherein the second LSM monitoring point is provided with static stack rule matching, and the second LSM monitoring point is used to detect whether the second process has illegally set the user identifier.
[0078] Optionally, the device further comprises:
[0079] A sending module, configured to send a query request to an application layer of the electronic device when it is detected that a user executes a sudo program and sets a user identifier setuid to elevate privileges; wherein the query request is used to request the application layer to verify whether the user has the sudo privilege escalation qualification;
[0080] The third determination module is used to determine that the setuid privilege escalation is an illegal privilege escalation operation when the user does not have the sudo privilege escalation qualification.
[0081] Optionally, the type of the user identifier includes at least one of the following:
[0082] The actual user ID uid, the saved set user ID suid, the effective user ID euid, and the file system user ID fsuid.
[0083] Optionally, the device further comprises:
[0084] A prompt module is used to generate a first prompt message for the first process; wherein the first prompt message is used to indicate that the first process is an illegal privilege escalation operation.
[0085] Figure 6 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Figure 6 As shown, the electronic device 600 includes: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call the logic instructions in the memory 630 to execute the following method: when a first process is detected at a first LSM monitoring point, the current user identifier of the first process is obtained; the target user identifier of the first process stored in advance is obtained; when the current user identifier of the first process is inconsistent with the target user identifier of the first process, the first process is determined to be an illegal privilege escalation operation.
[0086] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.
[0087] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the illegal privilege escalation detection method provided by the above-mentioned methods, and the method includes: when a first process is detected at a first LSM monitoring point, obtaining a current user identifier of the first process; obtaining a pre-stored target user identifier of the first process; and when the current user identifier of the first process is inconsistent with the target user identifier of the first process, determining that the first process is an illegal privilege escalation operation.
[0088] On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the illegal privilege escalation detection method provided by the above-mentioned embodiments, for example, including: when a first process is detected at a first LSM monitoring point, obtaining a current user identifier of the first process; obtaining a pre-stored target user identifier of the first process; and when the current user identifier of the first process is inconsistent with the target user identifier of the first process, determining that the first process is an illegal privilege escalation operation.
[0089] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.
[0090] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0091] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for detecting illegal privilege escalation, characterized in that: The method comprises: When the first log structure merge LSM monitoring point detects the first process, obtaining the current user identifier of the first process; Obtaining a pre-stored target user identifier of the first process; When the current user identifier of the first process is inconsistent with the target user identifier of the first process, determining that the first process is an illegal privilege escalation operation; The method further comprises: In the cred protection scenario, when the second LSM monitoring point detects that the second process is a critical process and the static stack rule matching check of the second process fails, it is determined that the second process has illegally set the user identifier, and an alarm message for the second process is generated; wherein the alarm message is used to indicate that the second process is an illegal privilege escalation operation; static stack rule matching is set in the second LSM monitoring point, and the second LSM monitoring point is used to detect whether the second process has illegally set the user identifier.
2. The method for detecting illegal privilege escalation according to claim 1, characterized in that: The method further comprises: When it is detected that a user executes a sudo program and sets a user identifier setuid to elevate privileges, a query request is sent to an application layer of the electronic device; wherein the query request is used to request the application layer to verify whether the user has the sudo privilege escalation qualification; In the case that the user does not have the sudo privilege escalation qualification, the setuid privilege escalation is determined to be an illegal privilege escalation operation.
3. The method for detecting illegal privilege escalation according to claim 1, characterized in that: The type of the user identification includes at least one of the following: The actual user ID uid, the saved set user ID suid, the effective user ID euid, and the file system user ID fsuid.
4. The method for detecting illegal privilege escalation according to claim 1, characterized in that: After determining that the first process is an illegal privilege escalation operation, the method further includes: Generate a first prompt message for the first process; wherein the first prompt message is used to indicate that the first process is an illegal privilege escalation operation.
5. An illegal privilege escalation detection device, characterized in that: The device comprises: A first acquisition module is used to acquire a current user identifier of the first process when the first log structure merge LSM monitoring point detects the first process; A second acquisition module, used to acquire a pre-stored target user identifier of the first process; A first determination module, configured to determine that the first process is an illegal privilege escalation operation when the current user identifier of the first process is inconsistent with the target user identifier of the first process; The device also includes: The second determination module is used to, in a cred protection scenario, determine that the second process is an illegal setting of the user identifier and generate an alarm message for the second process when the second LSM monitoring point detects that the second process is a critical process and the static stack rule matching check on the second process fails; wherein the alarm message is used to indicate that the second process is an illegal privilege escalation operation; the second LSM monitoring point is provided with a static stack rule matching, and the second LSM monitoring point is used to detect whether the second process is an illegal setting of the user identifier.
6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the illegal privilege escalation detection method according to any one of claims 1 to 4 are implemented.
7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the illegal privilege escalation detection method as claimed in any one of claims 1 to 4 are implemented.
8. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the steps of the illegal privilege escalation detection method as described in any one of claims 1 to 4.