4 ms·
This kind of thing is trivially detected with basic system integrity tools [0][1] but I think a lot of those kinds of sysadmin tools have gone out of vogue at t
by VWWHFSfQ 6y ago
This kind of thing is trivially detected with basic system integrity tools [0][1] but I think a lot of those kinds of sysadmin tools have gone out of vogue at this point.
[0] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-using-aide https://access.redhat.com/documentation/en-us/red_hat_enterp...
[1] https://www.redhat.com/sysadmin/security-monitoring-tripwire https://www.redhat.com/sysadmin/security-monitoring-tripwire
- dbrgn 6y agorkhunter and samhain are two other similar tools. Both are available in the regular Debian repositories.
- jinnko 6y agorkhunter is nothing but a false sense of security. The detection mechanisms are crude and trivially bypassed. Have a read of the code for yourself.
- dbrgn 6y agoYes, it's very simplistic. It does not claim otherwise. However, it did manage to detect a rootkit on one of my system once (many years ago, when I used to phpMyAdmin, which had some kind of RCE). So it's better than nothing, and it would probably have detected the backdoor from the article (which does not even attempt to hide itself).