Page 1 of 1
Please enlighten me regarding rootkit
Posted: Tue Apr 26, 2005 1:21 pm
by Judland
Been doing some reading about rootkits and chkrootkit recently (
http://www.chkrootkit.org/ ).
Can anyone share with me knowledge they may know about what a rootkit exactly is and if/how it affects me as a Linux user?
Posted: Wed Apr 27, 2005 3:22 am
by mrben
According to wikipedia:
"A root kit is a set of tools used by an intruder after cracking a computer system. These tools can help the attacker maintain his or her access to the system and use it for malicious purposes. Root kits exist for a variety of operating systems such as Linux, Solaris, and versions of Microsoft Windows. "
Traditionally a rootkit will replace some of the system binaries with modified versions to prevent the system owner from discovering the presence of the cracker. So, for instance, if the cracker is running a trojan of some sort, they will install a modified version of ps that doesn't show that it is running. And they might replace ls so that you can't see certain files.
chkrootkit (and other rootkit checkers like rk-hunter) generally check for things like open ports, but also check for any modified binaries. Tripwire, another security tool, makes a special database of your main system files and their md5 sums so that you can check if they have been modified.
HTH