3 ms·

Can you explain in a more newbie friendly language? How do you detect this? Then how do you remove this? This type of high level tools becoming more mainstream

by jet1 13y ago

Can you explain in a more newbie friendly language? How do you detect this? Then how do you remove this? This type of high level tools becoming more mainstream as time passes. Today there is not much generic anti-tools for this or the upcoming ones!

Tuna-Fish 13y ago
Firstly, this is not some virus or worm that works it's way onto your machine. It's a payload that someone puts there possibly among other things. This means that if you have this on your machine, or if you have reason to think you have this on your machine, simple removal is not an acceptable solution. Whoever put the rootkit on the machine could have done almost anything else while he did it, and you are not guaranteed to find it all. If you find this on your machine, you need to produce a data-only backup of the machine, kill the partitions, and set it up again. As these rootkits are designed by rather smart people to overcome all existing tools, there simply cannot be generic tools that catch them all. If you get hit by a bunch of script kiddies using outdated tools, things like rkhunter and chkrootkit can help. Modern rootkits are almost by definition undetectable by them. If it's actually new, the way you find out about it is typically either a separate NID box between the machine and the wall that alerts, or the behaviour of the box changing.
- keithpeter 13y ago
  So for a low traffic Web server like application, we might be running the OS itself (/) from a read only filesystem (e.g. making a 'live' CD-ROM or USB image) and having read/write only for user files and logs? End user here: I just have a Linux laptop, interested in servers on the 'wild' web
  - rbanffy 13y ago
    Booting from an unchangeable image is the Joyent SmartOS approach, IIRC.
jamesaguilar 13y ago
Typically when you're compromised, you don't bother trying to fix the problem. You wipe the device and start over from a believed-good backup.
- jet1 13y ago
  Even wiping device might not be the solution. What if that softwate injected into boot or any other microcontroller of a hw part.

by jet1 13y ago

Tuna-Fish 13y ago

Firstly, this is not some virus or worm that works it's way onto your machine. It's a payload that someone puts there possibly among other things. This means that if you have this on your machine, or if you have reason to think you have this on your machine, simple removal is not an acceptable solution. Whoever put the rootkit on the machine could have done almost anything else while he did it, and you are not guaranteed to find it all. If you find this on your machine, you need to produce a data-only backup of the machine, kill the partitions, and set it up again. As these rootkits are designed by rather smart people to overcome all existing tools, there simply cannot be generic tools that catch them all. If you get hit by a bunch of script kiddies using outdated tools, things like rkhunter and chkrootkit can help. Modern rootkits are almost by definition undetectable by them. If it's actually new, the way you find out about it is typically either a separate NID box between the machine and the wall that alerts, or the behaviour of the box changing.

keithpeter 13y ago
So for a low traffic Web server like application, we might be running the OS itself (/) from a read only filesystem (e.g. making a 'live' CD-ROM or USB image) and having read/write only for user files and logs? End user here: I just have a Linux laptop, interested in servers on the 'wild' web
- rbanffy 13y ago
  Booting from an unchangeable image is the Joyent SmartOS approach, IIRC.

jamesaguilar 13y ago

Typically when you're compromised, you don't bother trying to fix the problem. You wipe the device and start over from a believed-good backup.

jet1 13y ago
Even wiping device might not be the solution. What if that softwate injected into boot or any other microcontroller of a hw part.