Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

Build Your Own Open-Source SmartWatch

If you’re not up for spending your money on one of the less advanced smart watch models, you may want to check out maker Jonathan Cook’s DIY Open-Source SmartWatch, part of which is 3D printed, something the prognosticators of future tech surely didn’t forecast. Cook shared instructions for making his SmartWatch on the webzine “Make:” and also on his own website, DoNothingBox. You can download the STL files on the DNB site, too. For around $125 or less you can make your own smart phone and you can customize it, something that you wouldn’t be able to do with a store-bought version. Read more

LibreOffice 4.4 Is Coming Soon With New Features

The release plan puts the LibreOffice 4.4.0 as being just days away, but what features are in store for this open-source office suite? Let's take a brief look. Read more

Completely open source, high-end laptop gets closer to reality

If you've wanted a laptop where all the software is free and open source (FOSS), you've usually had to settle for mediocre hardware. Even FOSS champion Richard Stallman is making do with a ThinkPad that's several years old. At last, though, it looks like you won't have to compromise your ideology for the sake of keeping up with the Joneses. Purism has successfully crowdfunded the Librem 15, a portable PC that combines modern parts (such as a 3.4GHz Core i7 and an optional 4K display) with software that's accessible from head to toe. The operating system (a variant of Trisquel GNU/Linux), hardware drivers and included apps are all free and open -- Purism is even trying to loosen up the BIOS and firmware. Read more

Your simple guide to Open Source technology

What does this mean in practice? First and foremost, it means that unlike traditional software development that is done behind closed doors and with the windows barred and by a small team, Open Source software development by its nature has many eye balls on it all of the time. Anyone can submit bug fixes or improvements and this generally translates into fixes and improvements happening at a much faster rate. Security vulnerabilities and exploits are usually fixed quickly too, which is good for everyone. Read more