Detecting Rootkits In GNU/Linux

An anonymous reader sends note of a blog post on rootkit detection in GNU/Linux. The article mentions only two utilities for ferreting out rootkits — the first comment to the blog post lists three additional ones — but it could be useful for those who haven't thought about the problem much. From the article: "A rootkit... is a collection of tools that a cracker installs on a victim's computer after gaining initial access. It generally consists of log cleaning scripts and trojaned replacements of core system utilities such as ps, top, ifconfig and so on."

Ah! No need for rootkit detector...

[Rosco P. Coltrane]

... with the Internet Freedom Disk [slashdot.org]!

Pish Posh

[eno2001]

It's GNU/Linux. Any hacker worth his salt doesn't want to bother with archaic OSes based on Unix. He wants the 1337 stylings of Windows Vista. No sense in rootkitting a *nix box. You can't do anything with a *nix box. But an army of zombie Vista PCs, now THAT is ULTIMATE POWER!

Re:Ah! No need for rootkit detector...

[Anonymous Coward]

... with the Internet Freedom Disk!

First it was "freedom fries," and now they've gone and corrupted what was once a perfectly fine Internet French Disk with their misplaced patriotism.

Yes, but...

[Darlantan]

You have your l33t ninja with his army of zombie Windows boxes... ...but how do they stack up to the *nix pirates, and their FTPs on the seven seas of the intarwebs? It's the classic clashes, modernized. Who has the REAL Ultimate Power?

I like to leave this up to the FBI

[Timesprout]

When the dark suits turn up on my doorstep with an arrest warrant on charges of attempting to crack confidential government sites I can be pretty sure my machine has been rooted.

Re:ifl

[stoolpigeon]

i have no idea. i've never used any of them. this is a joke gone completely wrong. i just copied and pasted the comment from over at tfa. hence my subject: ifl (it's funny laugh). i figured it'd end up troll, over-rated, but i got such a laugh out of doing it (sorry i'm easily amused) that i figured it was worth it. in what is a horrid twist of fate, i now feel bad for getting modded up.

Re:This is...

[diegocgteleline.es]

Real men and real hackers write their programs in binary code, not in stupid and bloated assembler.

Re:Read Only Drives

[computational super]

Yeah, there's a program you can run to flip them whenever you need to. I had to install it SUID root though.

Meh, I don't trust those tools

[straponego]

I just eyeball /proc/kcore for anything suspicious every day or so.

Re:This is...

[Anonymous Coward]

Cuz people who are looking to install rootkits on your computer are very respectful of copywrite law.

Re:This would have been more appropriate:

[Linker3000]

Hey, AC, There's a guy on the phone for you - says he's from SCO and he'd like a quick word.

The tables have turned, Mr. Bond...

[RealGrouchy]

Joke's on you, Linux boys (and girls?)!

I don't have to worry about this. I use Windows!

Oh wait...

- RG>