Installing and enabling Known Exploit Detection
One of the most critical things to do to secure your system (and, more importantly, the data in the system) is to implement the ability to detect when the bad guys are trying to break in. Ksplice has a unique feature called Known Exploit Detection (KED) that will report on known attacks against the kernel. Normally, only exploits that allow the hacker to access additional privileges are instrumented for KED and, for these to trigger, the kernel should already have been spliced for the vulnerability.
Getting ready
To do this, you will need a test system running Oracle Linux 8, with Ksplice set up.
How to do it…
This is done via tripwire code, which is triggered when specific events are detected. Normally, only events that enable the attacker to gain privileged access are monitored. This package is available on both x86 and ARM systems.
To enable this, the pack must first be installed by using the following command...
