Language Selection

English French German Italian Portuguese Spanish

Unix/Linux rootkits 101

Filed under
Security

The term rootkit originated with a reference to the root user account on Unix systems. Rootkits are not limited to Unix, however, or even to administrative user accounts like the Unix root account. No matter what operating system you use, you should be familiar with good practices for detecting and dealing with the threat of rootkits.

What is a rootkit?

As Mike Mullins explained in Windows rootkits 101, rootkits are not exploits. They are not the means of cracking security and accessing your system in the first place. Instead, rootkits are inserted into your system after it has already been compromised for the first time. Rootkits then cover the malicious security cracker’s tracks when he or she revisits the system later, or the tracks of other malicious software left behind. A rootkit may also include a “back door” allowing the security cracker to gain access at any time in the future.

On Unix systems such as Solaris or FreeBSD, and on Unix-like systems such as Linux, a number of different means may be employed to cover the security cracker’s tracks. Common tactics include replacing system utility binaries such as ls and diff so that when they are used they will hide changes to the system and files on it from the user. The key point to keep in mind when dealing with the threat of rootkits is that once a rootkit has been installed on your system, you are no longer able to trust any of the tools installed on that system to give you accurate information.

This can make accurate detection of rootkits and other changes to a system by malicious security crackers a challenge.

Rootkit detection




Also:

Like a lot of people, I use the free anti-virus program Clamav on my mail server. Last week, I was seriously impressed with its performance.

It started last wednesday, 25 July. At about noon, I received a mail by amavisd-new that it had blocked an e-mail containing a virus, Trojan.Downloader-11827. What was strange, is that I received this message on an e-mail account which is protected by my ISPs proprietary anti-virus solution. So it had not caught this virus, while Clamav did. Then I submitted the file to virustotal.com, and apparently only a few (about five) anti-virus programs detected the virus. Amongst others, Kaspersky, F-Secure, NOD32, Bitdefender, Symantec and of course Clamav. In the clamav-virusdb mailing list archives, I found that Clamav had detection for this virus since 7h21 CEST, so it was really amongs the first to detect this virus.

Clamav is great

More in Tux Machines

Linux Growth Demands Bigger Talent Poo

Today at LinuxCon and CloudOpen we're making an announcement that signifies the natural next step in helping to build a qualified talent pool of Linux professionals worldwide:The Linux Foundation Certification Program. We sought to create a new Linux certification program that is innovative, highly valued among Linux pro’s and employers and advances the state-of the-art of certification exams. We think it's a different approach to testing and can help advance Linux by bringing more Linux talent into the market. The exams are available anytime, anywhere; performance based with testing in the command line; and distribution flexible. Let me tell you a bit more about why we believe this is so important. Linux today powers most of the technology infrastructure that runs our daily lives. It is the fastest growing platform in nearly every sector of technology from embedded systems, mobile devices and consumer electronics to the cloud, enterprise server, high performance computing and more. Read more

Linux Foundation to offer new certification for IT workers

With an eye toward deepening the global Linux talent pool, the Linux Foundation today announced that it will offer two new certifications for engineers and administrators. The Linux Foundation Certified System Administrator, or LFCS, and the Linux Foundation Certified Engineer, or LFCE certificates will be granted to applicants who pass an automated online exam. The cost will be $300, although the foundation will hand out 1,000 free passes to attendees at LinuxCon, where the announcement was made. Read more More: Linux Foundation Debuts Linux Certification Effort

Parsix GNU/Linux 7.0 Test 1 Is an Interesting Debian and GNOME 3.12 Combination

Parsix GNU/Linux 7.0 Test 1, a live and installation DVD based on Debian, aiming to provide a ready-to-use, easy-to-install desktop and laptop-optimized operating system, has been released and is now ready for testing. Read more

Linux Founder Linus Torvalds 'Still Wants the Desktop'

The Linux faithful gathered today at LinuxCon to hear core Linux developers, especially Linus Torvalds—and the audience wasn't disappointed. In a keynote panel session, Torvalds spoke of his hopes and the challenges for Linux in 2014. Linux kernel developer Greg Kroah-Hartman moderated the discussion and commented that Linux already runs everywhere. He asked Torvalds where he thinks Linux should go next. Read more