3 ms·
Assuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.
by gizmo686 12y ago
Assuming the trojan has a rootkit, it can patch the kernel so that netstat does not report it.
- mreiland 12y agohonestly I was trying to figure out how this is something new. rootkits have been around for a long time now.
- tptacek 12y agoIs there any evidence that it patches the kernel? If it infiltrates the kernel, you'd think that'd be the most important detail Kaspersky could reveal; forget about whether the authors ran "strip" on the binary or not.
- gizmo686 12y agoYou're right. I misread the article where it said that the Windows malware had a rootkit. Checking the linked technical description [0] it looks like the Linux version does not require privlage escalation. [0] https://securelist.com/blog/research/67962/the-penquin-turla-2/ https://securelist.com/blog/research/67962/the-penquin-turla...