Chris wrote:
On Sat, 20 Oct 2007 15:29:53 -0600
Karl Larsen <k5di@xxxxxxxxxx> wrote:
I put rootkit in Google and learned they are mainly aimed at
Windows. I know Windows from about XP have a kernel but it really
does little. The rootkit designs I saw were aimed at the kernel for
some reason. No where could I find mention of a Linux rootkit.
Karl -
Trust me - there ARE rootkits that work under *nix of all
types. That's why it's a good idea to install chkrootkit.
I've seen one that didn't do what they installer intended (it tried to
email its IP address to someone, but assumed eth0 was the interface to
the world. it was, but had a private IP address on it.
It also installed binaries that caused the system to crash, and that
alerted me (and ensured that even if the intruder found it, he'd not be
able to use it).
On another system, a kit penetrated a user account (the boss's wife's),
couldn't crack the kernel, though it had tools to test known sploits,
installed an IRC bot and proceeded to scan the Internet for vulnerable
systems.
The IRC bot was GPL-licenced, and the intruder complied with the license
by providing me with the source;-)
It didn't run for long, I tend to notice when people test my firewall:-)
In fact - Sony got busted for having some sorta rootkit on
blank media some time back.
Sony did? The one I knew of was Sony's DRM stuff that stuffed Windows,
and cost Sony lotsa goodwill and dollars.
--
Cheers
John
-- spambait
1aaaaaaa@xxxxxxxxxxxxxxxx Z1aaaaaaa@xxxxxxxxxxxxxxxx
Please do not reply off-list
