5 ms·

This sounds like a food youtuber trying to explain how easy cooking a Turkey is. Yeah sure in a vaccum maybe, but I don't spend all day cooking food. Ive got ot

This sounds like a food youtuber trying to explain how easy cooking a Turkey is. Yeah sure in a vaccum maybe, but I don't spend all day cooking food. Ive got other stuff to do. Maybe its easy to find rootkits if you know what you are doing and use a statically compiled tcpdump. Do you know how many times I've done a TCP dump on my computer to check for root kits statically compiled or not? 0. I don't spend my time doing that. All it has to do is use less CPU and RAM than my corporate anti virus already does ( which is a lot ) and I'm never going to find it, cause im never gonna look.

AdeptusAquinas 2y ago
Yeah but this is more from the perspective of a blue teamer, someone actively looking for/protecting against malware or performing forensics. If you're not in that position, just have some good AV and don't do anything that might make you a target.
- Joker_vD 2y ago
  > don't do anything that might make you a target. Like "don't get connected to the Internet"? That's a tall order.
  - denkmoon 2y ago
    You may not have noticed, everyone is on the internet. From the penthouses in new york to small villages in the savannah. Just being connected to the internet isn't noteworthy or targeted. Being targeted by an adversary is not the same as being hit by random drive-by attacks hitting every IP in the relatively limited IPv4 address space.
  - gizmo686 2y ago
    That is what the antivirus is for. If you are not a high value target, then your risk is virus that are being widely distributed; and those will quickly find their way into an AV database. If you are a high value target, AV is useless, since the attackers you care about will target you with bespoke mallare, that will not be in an AV database.
deleted 2y ago
[deleted]
varenc 2y ago
Agreed that it still seems decently hard to find if you aren't looking for it. Though the tone of the blog post made a lot more sense to me when I saw the over-top-top title of the article[0] it's responding to: 'Analysis of a New, Nearly-Impossible-to-Detect Linux Threat': [0] https://intezer.com/blog/research/new-linux-threat-symbiote/ https://intezer.com/blog/research/new-linux-threat-symbiote/
- grugq 2y ago
  In retrospect I really should have included the title with the link.
viraptor 2y ago
The target here is not a random YouTube watcher though. If you're doing actual rootkit hunting, you're in a larger org with lots of other indicators in place. You'll have DNS and traffic logs (hopefully), some local agents, maybe managed devices. You're not going to find rootkits randomly by deciding to check with tcpdump. You're looking for them in the first place, because they tripped some other detector. That's a big prerequisite.
riwsky 2y ago
Cooking turkey in a vacuum… sous vide is your idea of easy? Props, dude!
- abofh 2y ago
  Put meat in bag, put bag in water, receive protein? A turkey might be hard by size, but sous vide is basically the easy-bake of cooking, takes no effort or creativity during the cook and you can only really impact it before and after.

AdeptusAquinas 2y ago

Yeah but this is more from the perspective of a blue teamer, someone actively looking for/protecting against malware or performing forensics. If you're not in that position, just have some good AV and don't do anything that might make you a target.

Joker_vD 2y ago
> don't do anything that might make you a target. Like "don't get connected to the Internet"? That's a tall order.
- denkmoon 2y ago
  You may not have noticed, everyone is on the internet. From the penthouses in new york to small villages in the savannah. Just being connected to the internet isn't noteworthy or targeted. Being targeted by an adversary is not the same as being hit by random drive-by attacks hitting every IP in the relatively limited IPv4 address space.
- gizmo686 2y ago
  That is what the antivirus is for. If you are not a high value target, then your risk is virus that are being widely distributed; and those will quickly find their way into an AV database. If you are a high value target, AV is useless, since the attackers you care about will target you with bespoke mallare, that will not be in an AV database.

deleted 2y ago

[deleted]

varenc 2y ago

Agreed that it still seems decently hard to find if you aren't looking for it. Though the tone of the blog post made a lot more sense to me when I saw the over-top-top title of the article[0] it's responding to: 'Analysis of a New, Nearly-Impossible-to-Detect Linux Threat': [0] https://intezer.com/blog/research/new-linux-threat-symbiote/ https://intezer.com/blog/research/new-linux-threat-symbiote/

grugq 2y ago
In retrospect I really should have included the title with the link.

viraptor 2y ago

The target here is not a random YouTube watcher though. If you're doing actual rootkit hunting, you're in a larger org with lots of other indicators in place. You'll have DNS and traffic logs (hopefully), some local agents, maybe managed devices. You're not going to find rootkits randomly by deciding to check with tcpdump. You're looking for them in the first place, because they tripped some other detector. That's a big prerequisite.

riwsky 2y ago

Cooking turkey in a vacuum… sous vide is your idea of easy? Props, dude!

abofh 2y ago
Put meat in bag, put bag in water, receive protein? A turkey might be hard by size, but sous vide is basically the easy-bake of cooking, takes no effort or creativity during the cook and you can only really impact it before and after.