Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

CoreOS Linux 899.17.0 Released with OpenSSL 1.0.2h, NTPd 4.2.8p7, and Git 2.7.3

The CoreOS developers have released a new version of the Linux kernel-based operating system engineered for massive server deployments, CoreOS 899.17.0. Powered by Linux kernel 4.3.6, CoreOS 899.17.0 arrived on May 3, 2016, as an upgrade to the previous release of the GNU/Linux operating system, which system administrators can use for creating and maintaining open-source projects for Linux Containers, version 899.15.0. Read more

Black Lab Brings Real-Time Kernel Patching to Its Enterprise Desktop 8 Linux OS

A few moments ago, Softpedia has been informed by Black Lab Software about the general availability of the sixth DP (Developer Preview) build of the upcoming Black Lab Linux Enterprise Desktop 8 OS. Sporting a new kernel from the Linux kernel from the 4.2 series, Black Lab Linux Enterprise Desktop 8 Developer Preview 6 arrives today for early adopters and public beta testers with real-time kernel patching, which means that you won't have to reboot your Black Lab Linux Enterprise OS after kernel upgrades. "DP6 offers you a window into what's new and whats coming when Black Lab Enterprise Desktop and Black Lab Enterprise Desktop for Education is released. As with our other developer previews it also aids in porting your applications to the new environment," said Roberto J. Dohnert, CEO, Black Lab Software. Read more

USB stick brings neural computing functions to devices

Movidius unveiled a “Fathom” USB stick and software framework for integrating accelerated neural networking processing into embedded and mobile devices. On April 28, Movidius announced availability of the USB-interfaced “Fathom Neural Compute Stick,” along with an underlying Fathom deep learning software framework. The device is billed as “the world’s first embedded neural network accelerator,” capable of allowing “powerful neural networks to be moved out of the cloud, and deployed natively in end-user devices.” Read more

ImageMagick Security Bug Puts Sites at Risk

  • Open Source ImageMagick Security Bug Puts Sites at Risk
    ImageMagick, an open source suite of tools for working with graphic images used by a large number of websites, has been found to contain a serious security vulnerability that puts sites using the software at risk for malicious code to be executed onsite. Security experts consider exploitation to be so easy they’re calling it “trivial,” and exploits are already circulating in the wild. The biggest risk is to sites that allows users to upload their own image files. Information about the vulnerability was made public Tuesday afternoon by Ryan Huber, a developer and security researcher, who wrote that he had little choice but to post about the exploit.
  • Huge number of sites imperiled by critical image-processing vulnerability
    A large number of websites are vulnerable to a simple attack that allows hackers to execute malicious code hidden inside booby-trapped images. The vulnerability resides in ImageMagick, a widely used image-processing library that's supported by PHP, Ruby, NodeJS, Python, and about a dozen other languages. Many social media and blogging sites, as well as a large number of content management systems, directly or indirectly rely on ImageMagick-based processing so they can resize images uploaded by end users.
  • Extreme photo-bombing: Bad ImageMagick bug puts countless websites at risk of hijacking
    A wildly popular software tool used by websites to process people's photos can be exploited to execute malicious code on servers and leak server-side files. Security bugs in the software are apparently being exploited in the wild right now to compromise at-risk systems. Patches to address the vulnerabilities are available in the latest source code – but are incomplete and have not been officially released, we're told.