Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

Red Hat Financial News

Leftovers: Gaming

  • Unreal Engine 4.16 Enters Public Preview State
    Epic Games on Friday released the first public preview of the upcoming Unreal Engine 4.16. There are many changes to find with Unreal Engine 4.16 while some of the highlights include volumetric fog support, a new clothing solver, optimized distance field lighting, garbage collection improvements, and more.
  • Unreal Engine 4.16 Preview
    A Preview of the upcoming 4.16 release is available now on the Launcher and Github. We have made this Preview available so that our developer-community can help us catch issues before the final release. As fixes are implemented, we will release updated previews throughout the development cycle. Please be aware that the preview releases are not fully quality tested, that they are still under heavy active development, and that they should be considered as unstable until the final release. Developers should not convert their projects for active development on preview releases. Please test on copies of your project instead.
  • Watch this highlight reel of iAlwaysSin's Alien Isolation livestreams!
    Last Thursday the newest member of the GOL Livestream Team, iAlwaysSin, completed her live playthrough of the extremely scary Alien Isolation. And, to commemorate this achievement (and all the deaths that occurred in the process) I decided to download and edit all the VODs together into a nice highlight reel. With my sarcastic remarks, of course.

Kernel and Graphics in Linux

Manjaro Linux: Reliable and Up to Date, Geekdom Optional

Regular readers can pretty much ignore this one. We’ll be back to cartoons, O’s baseball and the usual inanity soon, tomorrow in fact. I just wanted to revisit my dedication to Linux, prompted by a recent mixed bag of experiences that left me feeling even more positive about a relative newcomer to the distro scene: Manjaro. It all started a few days ago, when I decided to finally try to update the eight remaining Linux installs on my main desktop PC. I’ve been using Linux Mint (18.1 Cinnamon) as my daily driver for several months, originally in an attempt to keep my bandwidth usage to a reasonable level, and then due to inertia/lack of issues. I could have gone with my trusty Debian stable install, my go-to for years up till then, but I guess I was just getting bored. Read more