Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

netOS Server 10.65.1 Released, Based on Ubuntu 16.04 LTS and Xfce 4.12 Desktop

Black Lab Software CEO Roberto J. Dohnert is informing Softpedia today about the release and general availability of the netOS Server 10.65.1 server-oriented and open-source operating system. Read more

Ubuntu GNOME 17.04 Final Beta Features GNOME 3.24 with Night Light, Flatpak 0.8

As part of yesterday's Ubuntu 17.04 Final Beta release, the Ubuntu GNOME 17.04 operating system got its second Beta milestone bringing with it the latest development version of the recently released GNOME 3.24 desktop environment. Read more Also: Kubuntu 17.04 Beta 2 Includes KDE Plasma 5.9 Desktop, KDE Applications 16.12.3 Ubuntu Budgie 17.04 Beta 2 Brings Latest GNOME 3.24 Apps, Budgie 10.2.9 Desktop

SAS, Canonical turn silly over open source

Zemlin's job, in other words, isn't to convince companies to adopt open source, but rather to provide a home for the nurturing of open source projects, so they're worthy of adoption. Similarly, Canonical can focus on contributing code rather than spooking enterprises into adopting more. And SAS? Well, it should probably start with 40 percent open source adoption and grow from there. Read more

This Raspberry Pi-powered Linux computer packs a keyboard and display into a phone-sized case

What would you get if you crossed the $10 Raspberry Pi Zero W with a smartphone? You might end up with the Zero Terminal. The Zero Terminal is a homemade project by a maker known as Node, who has turned the Pi Zero W into a phone-sized computer with a slide-out QWERTY keyboard and touchscreen display. Rather than running a phone OS, the Zero Terminal runs a full desktop, the Linux-based system Raspbian. Read more