Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

GNU/Linux Leftovers

  • World Wide Web became what it is thanks to Linux
    Linux is used to power the largest websites on the Internet, including Google, Facebook, Amazon, eBay, and Wikipedia.
  • SFC's Kuhn in firing line as Linus Torvalds takes aim
    A few days after he mused that there had been no reason for him to blow his stack recently, Linux creator Linus Torvalds has directed a blast at the Software Freedom Conservancy and its distinguished technologist Bradley Kuhn over the question of enforcing compliance of the GNU General Public Licence. Torvalds' rant came on Friday, as usual on a mailing list and on a thread which was started by Software Freedom Conservancy head Karen Sandler on Wednesday last week. She suggested that Linuxcon in Toronto, held from Monday to Thursday, also include a session on GPL enforcement.
  • Linux at 25: A pictorial history
    Aug. 25 marks the 25th anniversary of Linux, the free and open source operating system that's used around the globe in smarphones, tablets, desktop PCs, servers, supercomputers, and more. Though its beginnings were humble, Linux has become the world’s largest and most pervasive open source software project in history. How did it get here? Read on for a look at some of the notable events along the way.

Security News

  • OpenSSL 1.1.0 released
  • Security advisories for Friday
  • Openwall 3.1-20160824 is out
    New Openwall GNU/*/Linux ISO images and OpenVZ container templates are out.
  • Scorpene Leak Could Be Part Of 'Economic War,' Says French Maker: 10 Facts
    The leak, was first reported in The Australian newspaper. Ship maker DCNS has a nearly 38 billion dollar contract with Australia, but the leak has no mention of the 12 vessels being designed for Australia.
  • Homeland Security has 'open investigation' into Leslie Jones hacking
    The Department of Homeland Security is investigating the cyberattack against Ghostbusters actor Leslie Jones one day after her personal information and explicit images were leaked online. In a short statement on Thursday, a spokesperson for the US Immigration and Customs Enforcement agency said that the Homeland Security investigations unit in New York “has an open investigation into this matter”. “As a matter of agency policy and in order to protect the integrity of an ongoing investigation, we will not disclose any details,” the statement said. “As a matter of agency policy, we are unable to disclose any information related to an active investigation,” a spokeswoman said.

GNOME Usability and Keysign

Android Leftovers