Saint Jude: Modeling and Detecting Unauthorized Root Transitions

Architecture and Background

Tim Lawless - Saint Jude: Modeling, Detecting and Responding to Unauthorized Root Transitions. The recent surge of interest in Security has been a boon for those developing IDS systems.

Vulnerability Analysis

Unfortunately,, the IDS advancements have been disproportional in the realm of Network IDS -- with Host-based IDS lagging behind, only able to detect breaches after the incident. This state of affairs offers administrators, faced with the looming threat of intruders gaining access to their systems via legitimate channels, little protection beyond hardening and continually patching their systems.

Exploitation and Demonstrations

An intruder need only find one hole, the administrator -- all of them. During this session, the Stain Jude project will be presented.

Remediation and Defensive Strategies

Named after the patron saint of hopeless cases, the Saint Jude project is an IDS project that hopes to deliver a model and implementation able to stop a root compromise dead in its tracks, irregardless of the exploits method. Tim Lawless is a Systems Administer with the University of Souther Mississippi on the Stennis Space Center Campus. After having spent many a night sleeping in the machine room after a security breach, he became REALLY interested in the topics of Computer Security and Information Warfare. He is also a member of the ACPO (formerly ACPM), working to remove child pornography from the Internet.