I put rootkit in Google and learned they are mainly aimed at Windows. I know Windows from about XP have a kernel but it really does little. The rootkit designs I saw were aimed at the kernel for some reason. No where could I find mention of a Linux rootkit.
Karl Larsen wrote:
I put rootkit in Google and learned they are mainly aimed at Windows. I know Windows from about XP have a kernel but it really does little. The rootkit designs I saw were aimed at the kernel for some reason. No where could I find mention of a Linux rootkit.
http://www.google.co.in/search?q=linux+rootkits
Eahul
On 10/20/07, Karl Larsen k5di@zianet.com wrote:
I put rootkit in Google and learned they are mainly aimed at
Windows. I know Windows from about XP have a kernel but it really does little. The rootkit designs I saw were aimed at the kernel for some reason. No where could I find mention of a Linux rootkit.
Karl F. Larsen, AKA K5DI
Google "linux rootkit"
On Sat, 20 Oct 2007 15:29:53 -0600 Karl Larsen k5di@zianet.com wrote:
I put rootkit in Google and learned they are mainly aimed at
Windows. I know Windows from about XP have a kernel but it really does little. The rootkit designs I saw were aimed at the kernel for some reason. No where could I find mention of a Linux rootkit.
Karl -
Trust me - there ARE rootkits that work under *nix of all types. That's why it's a good idea to install chkrootkit.
In fact - Sony got busted for having some sorta rootkit on blank media some time back.
Chris wrote:
On Sat, 20 Oct 2007 15:29:53 -0600 Karl Larsen k5di@zianet.com wrote:
I put rootkit in Google and learned they are mainly aimed at
Windows. I know Windows from about XP have a kernel but it really does little. The rootkit designs I saw were aimed at the kernel for some reason. No where could I find mention of a Linux rootkit.
Karl -
Trust me - there ARE rootkits that work under *nix of all types. That's why it's a good idea to install chkrootkit.
I've seen one that didn't do what they installer intended (it tried to email its IP address to someone, but assumed eth0 was the interface to the world. it was, but had a private IP address on it.
It also installed binaries that caused the system to crash, and that alerted me (and ensured that even if the intruder found it, he'd not be able to use it).
On another system, a kit penetrated a user account (the boss's wife's), couldn't crack the kernel, though it had tools to test known sploits, installed an IRC bot and proceeded to scan the Internet for vulnerable systems.
The IRC bot was GPL-licenced, and the intruder complied with the license by providing me with the source;-)
It didn't run for long, I tend to notice when people test my firewall:-)
In fact - Sony got busted for having some sorta rootkit on blank media some time back.
Sony did? The one I knew of was Sony's DRM stuff that stuffed Windows, and cost Sony lotsa goodwill and dollars.
On Sun, 21 Oct 2007 07:38:52 +0800 John Summerfield debian@herakles.homelinux.org wrote:
El Snipo
In fact - Sony got busted for having some sorta rootkit on blank media some time back.
Sony did? The one I knew of was Sony's DRM stuff that stuffed Windows, and cost Sony lotsa goodwill and dollars.
Yup - I believe that's the one.
Chris wrote:
On Sun, 21 Oct 2007 07:38:52 +0800 John Summerfield debian@herakles.homelinux.org wrote:
El Snipo
In fact - Sony got busted for having some sorta rootkit on blank media some time back.
Sony did? The one I knew of was Sony's DRM stuff that stuffed Windows, and cost Sony lotsa goodwill and dollars.
Yup - I believe that's the one.
The media were't blank, they had music on them.
On Sun, 21 Oct 2007 08:36:55 +0800 John Summerfield debian@herakles.homelinux.org wrote:
Chris wrote:
On Sun, 21 Oct 2007 07:38:52 +0800 John Summerfield debian@herakles.homelinux.org wrote:
El Snipo
In fact - Sony got busted for having some sorta rootkit on blank media some time back.
Sony did? The one I knew of was Sony's DRM stuff that stuffed Windows, and cost Sony lotsa goodwill and dollars.
Yup - I believe that's the one.
The media were't blank, they had music on them.
I stand corrected - this is true.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
John Summerfield wrote:
Chris wrote:
On Sun, 21 Oct 2007 07:38:52 +0800 John Summerfield debian@herakles.homelinux.org wrote:
El Snipo
In fact - Sony got busted for having some sorta rootkit on
blank media some time back.
Sony did? The one I knew of was Sony's DRM stuff that stuffed Windows, and cost Sony lotsa goodwill and dollars.
Yup - I believe that's the one.
The media were't blank, they had music on them.
I think their explanation was they were trying to avert someone from copying the music on their computer. They were defending their illegal act by saying that someone who was trying to copy our product would be the only ones effected. I don't believe the people or government were very happy with this reasoning.
- -James
El Domingo, 21 de Octubre de 2007 01:38, John Summerfield escribió:
I've seen one that didn't do what they installer intended (it tried to email its IP address to someone, but assumed eth0 was the interface to the world. it was, but had a private IP address on it.
It also installed binaries that caused the system to crash, and that alerted me (and ensured that even if the intruder found it, he'd not be able to use it).
Even when I run chkrootkit I don't feel safe cause if you're system has been owned, are you sure you can trust the results the anti rootkit is reporting you?
From my point of view, if you got a rootkit the best thing you can do it,
firstly, figure out how you got hacked and then just re-install the system, otherwise, the system is not going to be truly reliable anymore.
Sometimes it's also a good idea to have the "strings" command in mind when you think you have been hacked, string ls string reboot and string some other important commands is usually a good start (bearing in mind that string could have been replace, hence we're in the same loop again) :-)
On another system, a kit penetrated a user account (the boss's wife's), couldn't crack the kernel, though it had tools to test known sploits, installed an IRC bot and proceeded to scan the Internet for vulnerable systems.
It reminds me when I was working with some AIX and we got a visitor who uploaded linux exploits and tried to run them forever, I'd pay to see his face saying something..."why these damn exploits are not running in this system, they run perfectly on my linux box..."
All the best Manuel.
Even when I run chkrootkit I don't feel safe cause if you're system has been owned, are you sure you can trust the results the anti rootkit is reporting you?
Well... you can certainly trust them if they're telling you that you are totally screwed. It's if they're telling you that there is no problem that you will experience some ambiguity. So it might tell you when you need to start thinking about a re-install. There are probably better ways, but this one is pretty easy, good for lazy ignorant types like me.
You can trust the results if you reboot your system from a CD, with the caveat that there might be some new exploit that rkhunter and chkrootkit do not know about. Or a bot that runs only in memory and so went away (for now) when you rebooted (only to return later probably).
Even without rebooting, it gives your intruders one more thing to think about and bungle. If you attribute them with god-like powers of foresight and concentration, there's no point in trying to avoid intrusions - this god-like being will certainly know some unpublicized exploit and predict every countermeasure you take and set up some kernel hack that tells you everything is fine when it is not. On the other hand, if they are merely human, it will be worth the trouble. The lock on my front door can be picked, but I still lock it when I leave the house.
From my point of view, if you got a rootkit the best thing you can do it,
firstly, figure out how you got hacked and then just re-install the system, otherwise, the system is not going to be truly reliable anymore.
Well, yeah. But how do you know you've got a rootkit and how do you figure out how you've been hacked? rkhunter or chkrootkit can tell you a lot about that, though it's true that they may tell you nothing. They're a couple of tools in the kit.
You are also assuming that it is practical to take the system offline. I'd say you definitely should have enough slack in your plans that you could take any particular machine offline and re-install it, but sometimes people find themselves facing unanticipated trade-offs and would like to have the option of doing something quicker though perhaps more risky. Well, let's hope we never go there.
There's also the case where things are less clear cut - maybe there's something wrong, but you don't yet know. I guess monitoring your network traffic may be less ambiguous, but hey, who's to say the hacker can't fool you there too? Whatever the intruder does, it is possible to try to camouflage it, given time and ingenuity. Just because there are stealth bombers doesn't mean you turn off your radar.
Of course, all this makes me want to move "learn about snort" higher on my list of things I need to do.
What method do you use to watch out for intrusion attempts?
buena suerta, Dave
On Sunday 21 October 2007 22:38:52 Dave Burns wrote:
You can trust the results if you reboot your system from a CD, with the caveat that there might be some new exploit that rkhunter and chkrootkit do not know about. Or a bot that runs only in memory and so went away (for now) when you rebooted (only to return later probably).
From my experience, rebooting a hacked system is not a pretty good idea, who
knows if they have changed the origina "reboot" binary from a shellscript which delete logs, delete hard disk or whatever you might want to do in order to hide any proofs, in the end a logic bomb. Rather than rebooting I, firstly plug off the network cable and try to be careful when collecting proofs and data in order to get as much information as possible before rebooting and making the final analysis.
Even without rebooting, it gives your intruders one more thing to think about and bungle. If you attribute them with god-like powers of foresight and concentration, there's no point in trying to avoid intrusions - this god-like being will certainly know some unpublicized exploit and predict every countermeasure you take and set up some kernel hack that tells you everything is fine when it is not. On the other hand, if they are merely human, it will be worth the trouble. The lock on my front door can be picked, but I still lock it when I leave the house.
Well, yeah. But how do you know you've got a rootkit and how do you figure out how you've been hacked? rkhunter or chkrootkit can tell you a lot about that, though it's true that they may tell you nothing. They're a couple of tools in the kit.
I do support the use of rkhunter or chkrootkit, I just said that you might need to use other systems, such like tripewire and stuff to have more primary sources to evalue if your systems is ok or you've had visitors :-) Thank god in the majority of the cases they do nothing just a defaced or some stupid things. I only had one case where the cracker did nothing out loud, so he didn't want to show his friends how cool or good he was, (which is in the other hand, the main reason for script-kiddies to try to hack systems), and we caught him cause he sent by error an email to "root". Othewise he was doing pretty well, no rootkits, nothing in /tmp...
You are also assuming that it is practical to take the system offline. I'd say you definitely should have enough slack in your plans that you could take any particular machine offline and re-install it, but sometimes people find themselves facing unanticipated trade-offs and would like to have the option of doing something quicker though perhaps more risky. Well, let's hope we never go there.
There's also the case where things are less clear cut - maybe there's something wrong, but you don't yet know. I guess monitoring your network traffic may be less ambiguous, but hey, who's to say the hacker can't fool you there too? Whatever the intruder does, it is possible to try to camouflage it, given time and ingenuity. Just because there are stealth bombers doesn't mean you turn off your radar.
Of course, all this makes me want to move "learn about snort" higher on my list of things I need to do.
What method do you use to watch out for intrusion attempts?
Loads of them, I mean, I'm quite paranoic about security since I work in this field. To evalue my general system security I use babel (http://babel.sf.net), then snort for some critical machines, tripewire and logcheck (run everynight and send me the results to the email) I run every hour netstat -putan | grep -i listen to see if I have any unexpect port listening on my systems. I have also a very strong security policy regarding to passwords (Babel helps me to find out who's using a weak password...) I have wrote some bash scripts to automatize som other security tasks I want to be awared of, such like last user logged, last IP... I'll continue later, since I'm at the office and I have a meeting :-)
Best regards from Madrid :-) Un saludo!
Manuel
On 10/21/07, Manuel Arostegui Ramirez manuel@todo-linux.com wrote:
On Sunday 21 October 2007 22:38:52 Dave Burns wrote:
You can trust the results if you reboot your system from a CD,
From my experience, rebooting a hacked system is not a pretty good idea,
Exactly. So there are three contexts in which you are using the tools:
1) Not sure you've been hacked, just suspicious or vigilant. 2) Sure you've been hacked, have not yet rebooted, looking for information. 3) Sure you've been hacked, rebooted using a CD (e.g. knoppix) or other known-good /.
In situation 1 and 2, you can't totally trust your tools, unless they're giving you bad news. In situation 3 your can trust the tools as much as you can trust the "known-good /" where they are located. So you're never totally sure you're in the clear.
I guess the truly paranoid might boot from a CD and do an audit periodically, I guess that might make me feel pretty confident. Hard to automate it (and may open up new vulnerabilities), no one wants it happening during ordinary working hours, and I don't want to be doing it by hand outside ordinary hours. Yuck.
To evalue my general system security I use babel
Is that comparable to nagios, or more security oriented?
gracias, Dave
On Mon, 2007-10-22 at 11:48 -1000, Dave Burns wrote:
On 10/21/07, Manuel Arostegui Ramirez manuel@todo-linux.com wrote:
On Sunday 21 October 2007 22:38:52 Dave Burns wrote:
You can trust the results if you reboot your system from a CD,
From my experience, rebooting a hacked system is not a pretty good idea,
Exactly. So there are three contexts in which you are using the tools:
- Not sure you've been hacked, just suspicious or vigilant.
- Sure you've been hacked, have not yet rebooted, looking for information.
- Sure you've been hacked, rebooted using a CD (e.g. knoppix) or
other known-good /.
In situation 1 and 2, you can't totally trust your tools, unless they're giving you bad news. In situation 3 your can trust the tools as much as you can trust the "known-good /" where they are located. So you're never totally sure you're in the clear.
I guess the truly paranoid might boot from a CD and do an audit periodically, I guess that might make me feel pretty confident. Hard to automate it (and may open up new vulnerabilities), no one wants it happening during ordinary working hours, and I don't want to be doing it by hand outside ordinary hours. Yuck.
I keep a write-protectable USB FLASH disk with necessary utilities on it such as netstat, ls, ps, rm, chattr, lsattr, find, chkrootkit, etc. I plug it in, mount it (typically at /media/DeHack) and do forensics such as
# /media/DeHack/bin/netstat -lpn
That way I know I'm using an uncompromised version of the utilities I need.
With F7 and such, you could boot a live CD of the system and do your forensics that way, but you won't see the hacked network stuff since the hacked system won't be booted and the suspect stuff won't be running. It would be a good way to get uncompromised versions of the programs onto your forensics media, however.
Best bet: Unplug the suspect machine from your network, plug in your dehacking tools drive (write protected, of course) and have at it.
To evalue my general system security I use babel
Is that comparable to nagios, or more security oriented?
gracias, Dave
---------------------------------------------------------------------- - Rick Stevens, Principal Engineer rstevens@internap.com - - CDN Systems, Internap, Inc. http://www.internap.com - - - - Memory is the second thing to go, but I can't remember the first! - ----------------------------------------------------------------------
Rick Stevens wrote:
On Mon, 2007-10-22 at 11:48 -1000, Dave Burns wrote:
On 10/21/07, Manuel Arostegui Ramirez manuel@todo-linux.com wrote:
On Sunday 21 October 2007 22:38:52 Dave Burns wrote:
You can trust the results if you reboot your system from a CD, From my experience, rebooting a hacked system is not a pretty good idea,
Exactly. So there are three contexts in which you are using the tools:
- Not sure you've been hacked, just suspicious or vigilant.
- Sure you've been hacked, have not yet rebooted, looking for information.
- Sure you've been hacked, rebooted using a CD (e.g. knoppix) or
other known-good /.
In situation 1 and 2, you can't totally trust your tools, unless they're giving you bad news. In situation 3 your can trust the tools as much as you can trust the "known-good /" where they are located. So you're never totally sure you're in the clear.
I guess the truly paranoid might boot from a CD and do an audit periodically, I guess that might make me feel pretty confident. Hard to automate it (and may open up new vulnerabilities), no one wants it happening during ordinary working hours, and I don't want to be doing it by hand outside ordinary hours. Yuck.
I keep a write-protectable USB FLASH disk with necessary utilities on it such as netstat, ls, ps, rm, chattr, lsattr, find, chkrootkit, etc. I plug it in, mount it (typically at /media/DeHack) and do forensics such as
# /media/DeHack/bin/netstat -lpn
That way I know I'm using an uncompromised version of the utilities I need.
With F7 and such, you could boot a live CD of the system and do your forensics that way, but you won't see the hacked network stuff since the hacked system won't be booted and the suspect stuff won't be running. It would be a good way to get uncompromised versions of the programs onto your forensics media, however.
Best bet: Unplug the suspect machine from your network, plug in your dehacking tools drive (write protected, of course) and have at it.
To evalue my general system security I use babel
Is that comparable to nagios, or more security oriented?
gracias, Dave
- Rick Stevens, Principal Engineer rstevens@internap.com -
- CDN Systems, Internap, Inc. http://www.internap.com -
-
- Memory is the second thing to go, but I can't remember the first! -
While reading this thread it occurred to me that if disk drives had a read-only switch, then systems would be uncrackable. Automated updates would be impossible, but I could live with a complicated update process if it would guarantee that my programs couldn't be compromised.
Can someone tell me why this isn't a good idea? There must be a fatal flaw that I don't see, or else someone would be selling drives like this.
Regards,
John
John Wendel wrote:
While reading this thread it occurred to me that if disk drives had a read-only switch, then systems would be uncrackable. Automated updates would be impossible, but I could live with a complicated update process if it would guarantee that my programs couldn't be compromised.
Can someone tell me why this isn't a good idea? There must be a fatal flaw that I don't see, or else someone would be selling drives like this.
There are several possible interactions. These occur to me immediately.
First, if this were done on a disc which contained the syslogs, then no syslogs could be made.
Second, if this were done where mount info and so forth get stored, then the system couldn't boot.
Third, if this were done to a "data file only" disc, then access time information could not be stored.
Mike
Mike McCarty wrote:
John Wendel wrote:
While reading this thread it occurred to me that if disk drives had a read-only switch, then systems would be uncrackable. Automated updates would be impossible, but I could live with a complicated update process if it would guarantee that my programs couldn't be compromised.
Can someone tell me why this isn't a good idea? There must be a fatal flaw that I don't see, or else someone would be selling drives like this.
There are several possible interactions. These occur to me immediately.
First, if this were done on a disc which contained the syslogs, then no syslogs could be made.
Second, if this were done where mount info and so forth get stored, then the system couldn't boot.
Third, if this were done to a "data file only" disc, then access time information could not be stored.
Mike
I guess most people wouldn't want to dedicate an entire disk for this function, but I'm sure that the disk drive firmware could write protect just a portion of the drive. Maybe the first 10GB (or some jumper selectable size) could be read-only (with a switch).
/var needs to be on a writable partition. But there shouldn't be any executable files in /var. There are special filesystems ("unionfs" ?) that redirect writes to a read-only file to a copy of the file in a writable partition (I think).
/etc needs to be cleaned up so that any configuration or status files that require dynamic updates are stored in /var/etc. Again, maybe the unionfs would fix this problem.
Maybe a small ramdisk could hold the config files from /etc that need to change when the system boots.
I always mount my data disks with noatime and noexec. But I'm not really concerned with data files, just executable programs.
I suspect that all the software pieces to make this happen already exist, used now for live-CDS and such. Somebody just needs to make the read-only disk drive.
Regards,
John
While reading this thread it occurred to me that if disk drives had a read-only switch, then systems would be uncrackable.
Well, that would go a long way to make intrusion more difficult, but not impossible. Intruder just mounts something on top of your read only partition that looks a lot like your partition but with a few well chosen modifications. He then has to hide evidence of his trick, which would not be easy (at least for me!), but that's not to say it could not be done. In fact I have heard of a very similar approach being used (sort of the opposite - an innocuous partition mounted over a partition full of rootkit stuff to keep it hidden), though apparently the intruder had not perfected it yet, since the admin eventually figured out what was going on.
There are special filesystems ("unionfs" ?) that redirect writes to a read-only file to a copy of the file in a writable partition (I think).
Yeah, but wouldn't that defeat the idea? Are you making it read only so that you know for sure it is good and can use it with confidence or so that you can easily recover your original files after getting (expletive deleted)? This "read-only" partition approach is only worth the trouble if it actually takes some capability away from the intruder. If the filesystem is read/write but your "originals" are read only, that only bothers the intruder if he actually wants to erase them. What does he want to erase? Log files, which do not belong on a read only filesystem in any case.
You could use it for monitoring - if it was easy to do a check whether ps and lsof and other critical executables were actually on the read-only part of disk or had been modified. The utility that does the check had better be on the read only partition, but what do you use to check it? If you're totally hacked you can't be sure that the utilities that you execute are actually coming from that disk. You might be logged in to an emulator! Might as well use tripwire or aide and not bother with the read-onlyness.
This has got me thinking. Dave
Mike McCarty wrote:
John Wendel wrote:
While reading this thread it occurred to me that if disk drives had a read-only switch, then systems would be uncrackable. Automated updates would be impossible, but I could live with a complicated update process if it would guarantee that my programs couldn't be compromised.
Can someone tell me why this isn't a good idea? There must be a fatal flaw that I don't see, or else someone would be selling drives like this.
There are several possible interactions. These occur to me immediately.
First, if this were done on a disc which contained the syslogs, then no syslogs could be made.
You can syslog over the network to a remote machine which accepts only syslog packets. Onbce upon a time decades ago the solution was to log to a hardcopy terminal.
Second, if this were done where mount info and so forth get stored, then the system couldn't boot.
To some extent true, but look at the union filesystem stuff, I think you could handle this and also see exactly which files were changed.
Third, if this were done to a "data file only" disc, then access time information could not be stored.
That's not necessarily a bad thing. Mounting noatime or relatime is a performance trick.
El Lunes, 22 de Octubre de 2007 23:48, Dave Burns escribió:
Exactly. So there are three contexts in which you are using the tools:
- Not sure you've been hacked, just suspicious or vigilant.
- Sure you've been hacked, have not yet rebooted, looking for information.
- Sure you've been hacked, rebooted using a CD (e.g. knoppix) or
other known-good /.
In situation 1 and 2, you can't totally trust your tools, unless they're giving you bad news. In situation 3 your can trust the tools as much as you can trust the "known-good /" where they are located. So you're never totally sure you're in the clear.
Well, in case 2, you'd not be 100% confident, rootkit are there and they might installed one on your system, so, let's start to doubt :)
I guess the truly paranoid might boot from a CD and do an audit periodically, I guess that might make me feel pretty confident. Hard to automate it (and may open up new vulnerabilities), no one wants it happening during ordinary working hours, and I don't want to be doing it by hand outside ordinary hours. Yuck.
Good point, that's totally crazy in production enviroments.
To evalue my general system security I use babel
Is that comparable to nagios, or more security oriented?
Well, I'm one of the main developers of Babel, so don't take this as a spam, it fits perfectly in this scenario. It's security oriented, Babel performs a security level check of the machine, or hardening. The check consists of a number of auditing tests that obtain a snap of the security status of each machine. The result is a security index of the system that is given after each execution.
Just totally off-topic, I'm just curious, Dave, do you speak spanish? Un saludo!!
Manuel
Is [babel] comparable to nagios, or more security oriented?
[...]Babel performs a security level check of the machine, or hardening. The check consists of a number of auditing tests that obtain a snap of the security status of each machine. The result is a security index of the system that is given after each execution.
So are you familiar with nagios? It's more of a ordinary monitoring tool, but it seems to me you could get it to monitor security vulnerabilities as well as how full your disk is and has your web server crashed.
To put the babel question another way, can I put some custom stuff into my babel config so that it will send me an alert if my web server crashes? Or is it more intended for running at night as a cron job? If someone attacks you will it try to tell you as it is happening, or when cron runs it, or not at all?
Or there's nmap and netstat for checking open ports. And there is nessus, that I think actually tries out exploits on your machine to see whether it responds like a vulnerable system. (I don't use it - I have enough problems without attacking myself!)
Just totally off-topic, I'm just curious, Dave, do you speak spanish?
Just enough to find out where the bathroom is, or start a bar-fight. I ought to be much more fluent, having grown up in Texas where Spanish is spoken by many people. And I studied it in school for years. But I guess I never had to speak Spanish to get by, never got enough practice to become fluent. Que lastima! Anyhow, I should compliment you on your excellent English. Have you spent some time in an English-speaking country?
Dave
On Sat, 20 Oct 2007 15:29:53 -0600 Karl Larsen k5di@zianet.com wrote:
I put rootkit in Google and learned they are mainly aimed at
Windows.
Some are.
I know Windows from about XP have a kernel but it really does little.
All operating systems have a kernel. The kernel controls everything. Your statement is 100% incorrect.
The Commodore 64 has a kernel. MSDOS has a kernel. And so on.
The rootkit designs I saw were aimed at the kernel for some reason
Kernel rootkits make sense, if you're planning a rootkit. Read my statement above to see why.
No where could I find mention of a Linux rootkit.
You didn't look very hard. I can find all kinds of mention. Type "kernel rootkit" into google and enjoy.
Now... did you have any point to make when you posted your message, or a question that you wanted to ask?
Karl Larsen wrote:
I put rootkit in Google and learned they are mainly aimed at Windows. I know Windows from about XP have a kernel but it really does little. The rootkit designs I saw were aimed at the kernel for some reason. No where could I find mention of a Linux rootkit.
FWIW, I been running rkhunter on Unix and Linux systems for several years, on a regular basis. I also occasionally run chkrootkit, but I like rkhunter better. It checks for more than 100 rootkits and trojans http://www.rootkit.nl/projects/rootkit_hunter.html
And it checks md5 values for a number of files, in the easiest case against the rpm db. e.g. rkhunter -c --pkgmgr rpm
Regards, Doug Wyatt
On Sat, 2007-10-20 at 22:31 -0500, Doug Wyatt wrote:
Karl Larsen wrote:
I put rootkit in Google and learned they are mainly aimed at Windows. I know Windows from about XP have a kernel but it really does little. The rootkit designs I saw were aimed at the kernel for some reason. No where could I find mention of a Linux rootkit.
FWIW, I been running rkhunter on Unix and Linux systems for several years, on a regular basis. I also occasionally run chkrootkit, but I like rkhunter better. It checks for more than 100 rootkits and trojans http://www.rootkit.nl/projects/rootkit_hunter.html
Woah! That's the old web site and no longer accessible. The rkhunter project was taken over and has now moved to SourceForge:
http://sourceforge.net/projects/rkhunter
John.