Test Plan

Builder-Test

• TO DO : produce a set of config files
• for each config file, run Core-Test.

Core-Test

• ./builder

• TO DO : produce a banned word list in the binary

• for wordlist in $(cat banlist.txt) ; do cat libselinux.so | grep $word ; done

• Compare hooked functions with standard functions:

  LD_PRELOAD=/path/to/my/libselinux.so $cmd > $cmd_output_libselinux.txt
  $cmd > $cmd_output_default.txt`
  diff $cmd_output_libselinux.txt $cmd_output_default.txt

• Manual Test.

---

Types of tests:

Core tests

(Tests that impact [core] only)

Unit tests

A collection of simple tests to ensure that all public functions are working as expected on hooking library.

TODO: determine unit-test setup on core

Victim-side stability

Ensure that the system still works as expected from victim's point of view, and no bug happens once the rootkit is installed.

Binary leaks

Check compiled library for symbols and strings that should not be leaked.

Client tests

(Tests that impact [client] only)

Unit tests

A collection of simple tests to ensure that client functions are working as expected.

TODO: determine unit-test setup on core

Generic tests

(Tests that impact both [core] and [client])

Client connectivity

Verify if the client can connect to an infected machine in many scenarios.

Stealth tests

Ensure that the victim cannot detect any suspect activity while the attacker plays with the system remotely.

It includes checking open processes, remote connections, etc...

Anti Anti-RootKit tests

Check if common anti-rootkits can detect BEURK as a malicious program.