[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Rootkit

Chris wrote:
On Sat, 20 Oct 2007 15:29:53 -0600
Karl Larsen <k5di zianet com> wrote:

I put rootkit in Google and learned they are mainly aimed at Windows. I know Windows from about XP have a kernel but it really
does little. The rootkit designs I saw were aimed at the kernel for
some reason. No where could I find mention of a Linux rootkit.

Karl -
	Trust me - there ARE rootkits that work under *nix of all
types. That's why it's a good idea to install chkrootkit.

I've seen one that didn't do what they installer intended (it tried to email its IP address to someone, but assumed eth0 was the interface to the world. it was, but had a private IP address on it.

It also installed binaries that caused the system to crash, and that alerted me (and ensured that even if the intruder found it, he'd not be able to use it).

On another system, a kit penetrated a user account (the boss's wife's), couldn't crack the kernel, though it had tools to test known sploits, installed an IRC bot and proceeded to scan the Internet for vulnerable systems.

The IRC bot was GPL-licenced, and the intruder complied with the license by providing me with the source;-)

It didn't run for long, I tend to notice when people test my firewall:-)

	In fact - Sony got busted for having some sorta rootkit on
blank media some time back.

Sony did? The one I knew of was Sony's DRM stuff that stuffed Windows, and cost Sony lotsa goodwill and dollars.



-- spambait
1aaaaaaa coco merseine nu  Z1aaaaaaa coco merseine nu

Please do not reply off-list

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]