lkml.org 
[lkml]   [1999]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectProcess hiding from ps?
I have succeeded in getting a program to hide itself from a 'ps -ax'
listing simply by zeroing out the argument table.

--cut--
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
int i;

/* destroy the argument table */
for(i = 0; i < argc; i++)
memset(argv[i], 0, strlen(argv[i]));

while(1); /* hang around, just kill me with ctrl-c */
}
--cut--

I think this is a potential security problem as someone might easily
misuse this to hide a 'malicious' program, and you would not be able to
identify it so easily using ps.

Cheers,
Alex
--

Legalise cannabis today!

http://www.tahallah.demon.co.uk


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.021 / U:1.408 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site