Rootkit

[John Summerfield]

Chris wrote:
> On Sat, 20 Oct 2007 15:29:53 -0600
> Karl Larsen <k5di at zianet.com> wrote:
> 
>>     I put rootkit in Google and learned they are mainly aimed at 
>> Windows. I know Windows from about XP have a kernel but it really
>> does little. The rootkit designs I saw were aimed at the kernel for
>> some reason. No where could I find mention of a Linux rootkit.
>>
>>
> 
> Karl - 
> 
> 	Trust me - there ARE rootkits that work under *nix of all
> types. That's why it's a good idea to install chkrootkit.

I've seen one that didn't do what they installer intended (it tried to 
email its IP address to someone, but assumed eth0 was the interface to 
the world. it was, but had a private IP address on it.

It also installed binaries that caused the system to crash, and that 
alerted me (and ensured that even if the intruder found it, he'd not be 
able to use it).

On another system, a kit penetrated a user account (the boss's wife's), 
couldn't crack the kernel, though it had tools to test known sploits, 
installed an IRC bot and proceeded to scan the Internet for vulnerable 
systems.

The IRC bot was GPL-licenced, and the intruder complied with the license 
by providing me with the source;-)

It didn't run for long, I tend to notice when people test my firewall:-)



> 
> 	In fact - Sony got busted for having some sorta rootkit on
> blank media some time back.

Sony did? The one I knew of was Sony's DRM stuff that stuffed Windows, 
and cost Sony lotsa goodwill and dollars.


> 


-- 

Cheers
John

-- spambait
1aaaaaaa at coco.merseine.nu  Z1aaaaaaa at coco.merseine.nu

Please do not reply off-list