lkml.org 
[lkml]   [2005]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: Kernel Rootkits
From
Date
On Fri, 2005-04-15 at 13:33 -0400, Malita, Florin wrote:
> On Fri, 2005-04-15 at 13:16 -0400, Richard B. Johnson wrote:
> > I'm not sure there really are any "kernel" rootkits. You need to be
> > root to install a module and you need to be root to replace a kernel
> > with a new (possibly altered) one. If you are root, you don't
> > need an exploit.
>
> rootkit != exploit
>
> The exploit is used to gain root privileges while the rootkit is used
> after that to install & hide backdoors, sniffers, keyloggers etc.
>
> http://en.wikipedia.org/wiki/Rootkit
>

"Rootkit" is sometimes used to refer to the all-in-one bundle, that
contains the exploit and the tools the attacker installs once they are
in.

OT: the dumbest rootkit I ever came across came from someone who cracked
one of our nameservers via an openssh hole. They were careful to
replace netstat, ps, etc but apparently didn't know about lsof, which
was the first thing I tried of course. Then they hid the old binaries
in a subdirectory of /dev (because no one would ever look there).
Thanks to the "l33t skillz" of the author, I didn't even have to wipe
the machine to recover it.

Lee

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-04-15 20:15    [W:0.022 / U:0.016 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site