22 ms·
How do you know if you have a bootkit? I could have one running on my system right now syphoning off data, I probably don't but I can't think of any way that I
by jiggy2011 14y ago
How do you know if you have a bootkit?
I could have one running on my system right now syphoning off data, I probably don't but I can't think of any way that I could prove that I didn't even if I ran every anti-malware program in the world.
- rjbond3rd 14y agoNot proof, I guess, but possible countermeasures: * run the OS from (known good) media mounted read-only (in the olden days, some websites ran off Knoppix CD's and rebooted often :) * (Red Hat): rpm -Va to verify the package database, binaries, config files etc. (after verifying the original package database hasn't changed, by checksumming / diffing with an offline copy) * iptables rules which drop (and log) all traffic on all interfaces (then selectively add minimalist rules)
- DanBC 14y ago> in the olden days, some websites ran off Knoppix CD's and rebooted often That sounds horrific for performance.
- beagle3 14y agoNot at all. Once the OS and webserver (and whatever apps you need) are in memory, it's just as fast as a hard-drive. Non executable data (the majority of data served by webservers) can still reside on magnetic media or on a NAS.