6 ms·
You can audit that the installed files match these from the packages (with the debsums program), though I don't know where to easily get the checksum file from
by Jenda_ 5y ago
You can audit that the installed files match these from the packages (with the debsums program), though I don't know where to easily get the checksum file from an independent trusted source (as the checksums themselves can be tampered with the malware to match).
It is good to run this once a while even for non-security reasons: you can detect hardware problems (notoriously failing SD cards in Raspberry Pis) and mistakes, like installing a custom program to /usr instead of /opt and accidentally overwriting system files.
- yjftsjthsd-h 5y agoThat only works for files altered in place, not extra .so files, cronjobs, lines injected into global bashrc/profile, that kind of thing. (Granted, those are unlikely to survive for many years without breaking or otherwise getting caught)
- Jenda_ 5y agoYou can scan for extra files too. Yeah, backdooring configuration/bashrc is a problem, unfortunately, you will probably copy the configuration after the reinstall, thus copying the backdoor too.