How to remediate – YARA Scan Setup (Linux)

1. Introduction

YARA Scan Setup (Linux) configures rules and a binary on a remote Linux host to perform Yara checks. This allows for proactive threat hunting by scanning files for malicious patterns. Affected systems are typically servers, workstations, and any Linux-based device where file integrity monitoring is needed. A successful scan can identify potential malware or unwanted software, impacting confidentiality, integrity, and availability of data if threats are present.

2. Technical Explanation

The vulnerability involves the setup process for Yara on a Linux system. The defined rules and Yara install have been configured on the remote host. An attacker could potentially modify or replace the Yara rules with malicious ones, leading to false negatives or targeted scans that hide their activity. Preconditions include having administrative access to the target Linux host.

• Root cause: The configuration process may not enforce strict permissions or integrity checks on the Yara rules directory and binary.
• Exploit mechanism: An attacker with sufficient privileges could overwrite existing rules with custom, potentially harmful ones. For example, they might create a rule that ignores specific malware signatures.
• Scope: Linux systems where Yara has been installed and configured are affected. Specific distributions aren’t known to be more or less vulnerable without further information on the install method used.

3. Detection and Assessment

Confirming vulnerability involves checking the Yara installation directory and rule files. A quick check is verifying the Yara binary exists, followed by a thorough review of the installed rules for unexpected content.

• Quick checks: Check if the Yara binary exists using which yara.
• Scanning: There are no common scanner signatures specifically for this setup issue. Consider custom Yara rules to detect known malicious patterns in your environment.
• Logs and evidence: Review system logs (e.g., /var/log/syslog or /var/log/auth.log) for any modifications to the Yara installation directory, typically located at /etc/yara/rules/.

which yara

4. Solution / Remediation Steps

Fixing this issue involves securing the Yara rules directory and ensuring only trusted users can modify the installed rules. These steps should be performed with caution to avoid disrupting existing threat hunting activities.

4.1 Preparation

• Back up the entire /etc/yara/rules/ directory before making any changes. Stop any automated scanning processes that rely on Yara if possible.
• Dependencies: Ensure you have administrative privileges (sudo access). A rollback plan involves restoring the backed-up rules directory.
• Change window needs: This change requires a short maintenance window, and approval from the security team is recommended.

4.2 Implementation

1. Step 1: Change ownership of the /etc/yara/rules/ directory to root:root using sudo chown root:root /etc/yara/rules/.
2. Step 2: Restrict write permissions on the /etc/yara/rules/ directory and its contents using sudo chmod 755 /etc/yara/rules/.
3. Step 3: Verify that only root can modify files within the rules directory using ls -l /etc/yara/rules/.

4.3 Config or Code Example

Before

ls -l /etc/yara/rules/
-rw-r--r-- 1 user group 1234 Jan  1 00:00 rule.yar

After

ls -l /etc/yara/rules/
-rwxr-xr-x 1 root root 1234 Jan  1 00:00 rule.yar

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue. Least privilege is key, limiting who can modify critical configuration files. Input validation ensures only trusted rules are added. Secure defaults reduce the attack surface by starting with restrictive permissions.

• Practice 1: Least privilege to limit the impact if an account is compromised.
• Practice 2: Regular review of installed Yara rules for unexpected or malicious content.

4.5 Automation (Optional)

A simple Bash script can automate the permission changes. Be cautious when running scripts with sudo privileges.

#!/bin/bash
sudo chown root:root /etc/yara/rules/
sudo chmod 755 /etc/yara/rules/
echo "Yara rules directory permissions updated."

5. Verification / Validation

Confirm the fix by verifying the file permissions on the Yara rules directory and attempting to modify a rule as a non-root user. A smoke test involves running a basic Yara scan to ensure functionality remains intact.

• Post-fix check: Run ls -l /etc/yara/rules/ and confirm ownership is root:root and permissions are 755.
• Re-test: Attempt to create or modify a file in the /etc/yara/rules/ directory as a non-root user; this should fail with a permission denied error.
• Smoke test: Run a simple Yara scan against a known clean file using yara /etc/yara/rules/*.yar to confirm scanning still works.

ls -l /etc/yara/rules/

6. Preventive Measures and Monitoring

Update security baselines to include the correct permissions for the Yara rules directory. Implement checks in CI or deployment pipelines to prevent unauthorized rule modifications. A sensible patch review cycle ensures timely updates.

• Baselines: Update your Linux security baseline (for example, CIS benchmarks) to reflect the recommended file permissions for the /etc/yara/rules/ directory.
• Pipelines: Add a check in your configuration management pipeline to verify that the Yara rules directory has the correct ownership and permissions.
• Asset and patch process: Review Yara rule updates regularly as part of your overall vulnerability management program.

7. Risks, Side Effects, and Roll Back

Changing file permissions could disrupt existing scanning processes if not done carefully. Incorrect permissions can prevent Yara from functioning correctly. Rolling back involves restoring the backed-up rules directory.

• Risk or side effect 1: Disruption of automated scans if the Yara process requires write access to the rules directory. Mitigation: Test changes in a non-production environment first.
• Risk or side effect 2: Inability to update Yara rules without root privileges. Mitigation: Document the procedure for updating rules with sudo.
• Roll back: Restore the backed-up /etc/yara/rules/ directory using sudo cp -r /path/to/backup/rules/ /etc/yara/rules/.

8. References and Resources

• Vendor advisory or bulletin: http://virustotal.github.io/yara/