Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

How I welcomed an immigrant family with a Linux laptop

From the LibriVox website, I downloaded the free, public domain audio reading of Helen Keller’s amazing autobiography, The Story of My Life, which is an excellent book that was first published in 1903. Then, I downloaded the text of the book (it's in the public domain) from Project Gutenberg and imported the text into Calibre, the free ebook reading software. Using my favorite Linux screencasting software, SimpleScreenRecorder, I married the text (in a large font) to the audio recording. I created the first 11 chapters of the book as video files in this way, and uploaded them to YouTube. I also copied these onto the Dell Inspiron 9400, so these video files could be viewed offline. Read more

Linux Practicality vs Activism

One of the greatest things about running Linux is the freedom it provides. Where the division among the Linux community appears is in how we value this freedom. For some, the freedom enjoyed by using Linux is the freedom from vendor lock-in or high software costs. Most would call this a practical consideration. Others users would tell you the freedom they enjoy is software freedom. This means embracing Linux distributions that support the Free Software Movement, avoiding proprietary software completely and all things related. Read more

What is the Fedora Modularity project and how do you get involved ?

The Fedora Modularity Project is an effort to fix several problems that all distributions face. One of them is the disconnect between Fedora's release cycle and the release cycle of larger Fedora components like for example GNOME, KDE or even the kernel. Those components obviously don't have the same lifecycle that Fedora follows and Fedora can't always wait for major components to be released upstream and on the other hand doesn't want to ship outdated software. An earlier attempt to work around this disconnect were the Fedora Rings with a central core 'base design', a concentric ring #2 around it for 'environments and stacks' and a ring #3 for applications. It wasn't possible to have different release cycles for packages in ring #2 as dependencies wouldn't allow that most of the time. Read more

antiX 16 & OpenMandriva 3.0 Beta 2 Release, openSUSE Numbers

It was a busy day in Linux with Slack, antiX, and OpenMandriva all working towards their next releases. Sam Varghese quoted Alberto Planas who said openSUSE sees about 1600 new installations each month and Gentoo's Donnie Berkholz posted his retirement notice. Bruce Byfield posted two interesting articles today, one explaining the difference between an Open Source user and a Free Software Activist and the other describing the stringent Debian packaging policies. As a bonus, a lady in California won a $10,000 award in small claims court from Microsoft over its Windows 10 behavior. Read more Also: OpenMandriva Lx 3.0 Beta2 is here! New Releases!