3 ms·
The nice thing about this method is that you don't have to muck about in the kernel with a kernel module or anything like that. Also, you don't have to replace
by colonelxc 17y ago
The nice thing about this method is that you don't have to muck about in the kernel with a kernel module or anything like that. Also, you don't have to replace any binaries on the system, so everything _looks_ fine to an md5 comparison. Also, if you've setup something like tripwire to only watch specific configuration files and services, it might not catch the newly created /etc/ld.so.preload file.
Some programs (such as login), are already statically compiled to prevent this exact thing from happening.
- viraptor 17y agoI think that the default tripwire config (and definitely the default samhain config) includes monitoring new files in /etc, so at least there's that protection. Unfortunately not many people use those applications in real deployments.
- joeyh 17y agoHmm, I have not encountered a suid login. Since login runs passwd, and passwd uses pam, and pam is heavily based on demand-loaded libraries, that would be rather hard and big. Static shell? Sure, sash. Also helpful when ldso or libc is busted via non-rootkit means.