3 ms·
The article says to examine 'ld.so' files, but I don't remember the interpreter being named 'ld.so' in remotely recent history. Perhaps it's a Debianism, but i
by newnewpdro 7y ago
The article says to examine 'ld.so' files, but I don't remember the interpreter being named 'ld.so' in remotely recent history.
Perhaps it's a Debianism, but it's been '/lib/ld-linux.so.$ver' for ages:
$ readelf -p .rodata /lib/ld-linux.so.2 | grep '/etc/ld\.so\.preload'
[ 2d9c] /etc/ld.so.preload
- saagarjha 7y agoI don't think the article says this? > The malware will attempt to find the dynamic linker binary within these paths. The dynamic linker filename is usually prefixed with ld-<version number>.
- newnewpdro 7y ago'In addition, in order to check if your system is infected, you can search for “ld.so” files — if any of the files do not contain the string ‘/etc/ld.so.preload’, your system may be compromised.'
- saagarjha 7y agoI think they're assuming that readers will excuse them for a bit of sloppiness for brevity's sake.