Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

Latvian Ventspils controls costs with open source

The administration of Ventspils, Latvia’s sixth largest city, is an avid user of free and open source software. The main benefits: cost and resource optimisation. Read more

Ubuntu Touch finds a home on a conflict-free, fair-trade, user-maintainable handset

Handset maker Fairphone is teaming up with the community project UBports, which seeks to get Ubuntu Touch on mobile devices. They will be showing off Ubuntu Touch running on the Fairphone 2 during Mobile World Congress, which starts February 27 in Barcelona. While Ubuntu is probably not the first name that comes to mind when you think of mobile devices, the phone in question offers some compelling features. “UBports Foundation will be showcasing its work at the Canonical booth, the company behind Ubuntu. Canonical is planning to tell about the latest developments around the convergence of its devices and UBports Foundation will share its mission ‘Ubuntu On Every Device’ with the visitors,” UBports said in a February 8 press release. Currently, UBports’ website lists three devices as “fully working as daily drivers:” The OnePlus One, Nexus 5, and the Fairphone 2, with the latter showing all parts as functioning with Ubuntu Touch, save the GPS radio. (Interestingly, the UBports project website for the Fairphone 2 still lists the GSM radio [in addition to the GPS] as a work in progress. However there is a video of two people talking with the handset, so it’s likely the Fairphone 2 project website is out of date.) The website also has instructions for flashing Ubuntu to the Fairphone 2. Read more

BSD Leftovers

  • LLVM/Clang 4.0 Is Running Late Due To Seven Blocker Bugs
    LLVM 4.0 was supposed to have been released by now, but it's running late due to open blocker bugs. Hans Wennborg commented on the mailing list that while the release should have happened on 21 February, serving as release manager, he hasn't tagged the release yet due to open blocker bugs.
  • FreeBSD-Based pfSense 2.3.3 Open-Source Firewall Released with over 100 Changes
    Rubicon Communications' Jim Pingle announced the availability of a new point release to the pfSense 2.3 stable series, which adds over 100 improvements and a bunch of new features. Updated to FreeBSD 10.3-RELEASE-p16, the pfSense 2.3.3 maintenance release is here more than seven months after the 2.3.2 update and introduces several new packages, including TFTP Server, LCDproc, cellular, and tinc, a lot of improvements for the OpenVPN and IPsec implementations, as well as numerous stability and security fixes from FreeBSD. Dozens of bug fixes are included in pfSense 2.3.3 for WebGUI, graphs and monitoring, gateways and routing, notifications, Dynamic DNS, captive portal, NTP and GPS, DNS, resolver and forwarder, DHCP and DHCPv6 servers, router advertisements, HA and CARP, traffic shaping, firewall, rules, NAT, aliases, states, users, authentication, and privileges.
  • “Hi, I’m jkh and I’m a d**k”
    Yesterday, I was privy to a private email message discussing a topic I care deeply about. I contacted the author and said “You really need to make this public and give this a wider audience.” His response boiled down to “if I wanted it to get a wider audience, I was welcome to do so myself.” So here’s my first ever guest post, from Jordan K Hubbard, one of the founders of the FreeBSD Project. While this discussion focuses on FreeBSD, it’s applicable to any large open source project.

Linux Graphics