Detecting Pluggable Authentication Module Tampering (T1556.003)

Pluggable authentication modules decide who gets in on most Linux systems and some macOS services. MITRE ATT&CK technique T1556.003, Pluggable Authentication Modules, covers modifying them to access credentials or enable access that should not exist. The tactics are defense impairment, persistence and credential access, and the platforms are Linux and macOS.

How attackers use it

PAM is a modular system of configuration files, libraries and executables that guide authentication for many services. The most common module is pam_unix.so, which retrieves, sets and verifies account authentication information in /etc/passwd and /etc/shadow.

MITRE describes two abuses. First, backdoors: components such as pam_unix.so can be patched to accept arbitrary adversary supplied values as legitimate credentials. Second, theft: PAM resources can be infected with code that harvests credentials, because the values exchanged with PAM components may be plain text, since PAM does not store passwords.

Because every service using PAM passes through the module, one modified library affects SSH, sudo, console logins and more.

How to detect it

MITRE lists no data sources for this page. These checks follow from the description:

• File integrity. Changes to modules under the system PAM library directory and to files under /etc/pam.d/. An auditd watch on those paths records writes.
• Package verification. Module files that no longer match the package that installed them.
• Configuration drift. New auth lines in /etc/pam.d/ pointing to modules you do not recognize.
• Logins that should not work. Successful authentications from accounts with changed or locked passwords.

How to reduce the risk

MITRE lists two mitigations.

1. Multi-factor authentication. A patched password check does little against a second factor verified elsewhere, and MFA reduces the value of stolen credentials.
2. Privileged account management. Limit access to the root account and prevent users from modifying PAM components through privilege separation, for example with SELinux, grsecurity or AppArmor, and by limiting privilege escalation opportunities.

Check your own environment

Read-only commands for Linux:

# Review the PAM stack for SSH
cat /etc/pam.d/sshd

# RPM based systems: verify files from the pam package
rpm -V pam

# Debian or Ubuntu: verify the PAM modules package
dpkg --verify libpam-modules

# List current audit rules, to see whether PAM paths are watched
auditctl -l

Any module that fails verification, or any PAM line that references a module you cannot name, needs investigation.

Quick check

Sources

• MITRE ATT&CK T1556.003 Pluggable Authentication Modules