Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

Development of Linux 4.15

  • Broadcom Hurricane 2 & Allwinner R40 Supported By Linux 4.15
    More ARM platform upstreaming has taken place for the Linux 4.15 kernel development cycle among other ARM hardware improvements.
  • Intel Coffee Lake & Cannonlake Thermal Support In Linux 4.15
    While Intel Coffee Lake hardware is shipping already, a few bits of tardy kernel code for these "8th Gen Core" CPUs is only hitting the Linux 4.15 kernel. The Intel DRM driver is most notably enabling Coffee Lake graphics by default in 4.15, but there's also some thermal code now landing among other changes now happening. Zhang Rui sent in the thermal updates for Linux 4.15 on Thursday and they include late additions for Coffee Lake but at the same time the relevant additions for Cannonlake that will be shipping in 2018 as the next-gen Intel CPUs.
  • AMDGPU DC Pull Request Submitted For Linux 4.15 Kernel - 132,395 Lines Of Code
    One day after submitting the main DRM feature pull request for Linux 4.15, David Airlie of Red Hat has submitted the secondary pull request that would feature the long-awaited introduction of AMDGPU DC into the mainline kernel.

Tizen News: Knox, YouTube, Financial Apps

Red Hat: OpenShift Container Platform, CTICC, Quote-to-Cash

Kubuntu 17.10 review - Hello darkness my old friend

This must be one of the worst Kubuntu releases I've tried in a long time. Part of the fault lies with the parent distro, and the heartless switch to Gnome, which just shows that the passion to making Ubuntu an important desktop player is gone. This is just inertia and apathy. Still, there's so much wrong with Kubuntu on its own that I feel like a total fool for investing my time in this effort. And it also proves that there is only one good release for every three, showing that distro teams are overstretched roughly by 300%. The whole fast-release bullshit is just the modern-era agile-crap nonsense. It helps no one. Shitty products serve no purpose. Being fast for the sake of it is like running head first into an industrial blender to have your outstretched arms finely chopped by spinning blades. Kubuntu 17.10 Artful Aardvark makes me sad. Makes me angry. Zesty was one of the finest distros ever created. This is one of the worst. That makes no sense. How can it be? Where's the modicum of care and diligence to ensure this kind of stuff does not happen? Application crashes, kernel crashes, media bugs, weird artifacts. Horrible. My suggestion is not to upgrade for now. And even then, the foundation of your sanity is shaken. Come the upgrade, you do not know what will happen. You're hostage to arbitrary code decisions. There's no peace and stability in the Linux desktop. You will always have to dread the update process, not knowing what will break next. That is the essence of amateurism. And I'm right there, advocating Plasma and Kubuntu like the biggest of fools in this universe. Anyway, for the sake of public sacrifice, I'll also check 17.10 in-vivo upgrades on other machines, but my expectations are low. Aardvark gets 4/10. Don't bother for now, give it six months for the bugs to be fixed before a new release erases the slate and the cycle of depression starts again. Read more Also: First Look At Linux Mint 18.3 Sylvia Beta