Never Hacked or Infected--Yet (Was: Re: End of life for FC12?)

James Mckenzie jjmckenzie51 at earthlink.net
Thu Nov 11 15:15:28 UTC 2010


Patrick Bartek <bartek047 at yahoo.com> wrote:
>
>--- On Wed, 11/10/10, Andras Simon <szajmi at gmail.com> wrote:
>
[massive snip]
>> I've spent enough time fixing friends' infected
>> Windows machines that I've
>> gotten a "feel" for when something is amiss. 
>> It's not a definitive feeling,
>> just an indicator to start checking for something
>> wrong.
>> 
>> 
>> I hope that you're not deluding yourself...
>
>Why would you think I am?
>
There are 'stealth' infections that only appear when triggered.  Several of the 'bots function that way.  You get the spyware infection that downloads an appropriate payload into a known good directory.  Your system is added to the list of known systems.  It sends out an ack/syn/ack pattern when you boot up and connect to the Internet on a known 'good' port (nothing like the 37733 port that is blocked by just about everyone.)  It sits and waits.  You would only become aware when the 'bot fires and then it is too late.  That is why there are such things as rootkit hunters and spyware applications for Linux.  However, it is your choice not to use them.  I do.

James McKenzie



More information about the users mailing list