A Look at BSD Rootkits

blackbearnh writes "Windows has a reputation for being easily exploited by rootkits, but just because you're using Linux or BSD doesn't mean you're safe from infection. In an interview on O'Reilly's ONLamp site, Joseph Kong (author of Designing BSD Rootkits ), talks about how to build and defend against Rootkits under BSD. 'I know a lot of people who refer to rootkits and rootkit-detectors as being in a big game of cat and mouse. However, it's really more like follow the leader — with rootkit authors always being the leader. Kind of grim, but that's really how it is. Until someone reveals how a specific (or certain class of) rootkit works, nobody thinks about protecting that part of the system. And when they do, the rootkit authors just find a way around it. This is what I meant earlier when I said rootkit hunting is hard — as you really have to validate the integrity of the entire system.'"

Illegal Book?

[Numbah One]

is this book illegal in Germany?

Run your system off of CD

[Nom du Keyboard]

Run your system off of a bootable CD. A little slower to boot, but once it's in memory...

Re:Pardon me, but I'm not surprised

[jalet]

> based on my penetration testing and signature analysis.
> E. Wyatt Tomlinson

OK, so we finally analyzed your signature above, and now we would like to proceed with the penetration testing of you.

Please advise.

A BSD rootkit?

[wumpus188]

Theo must really pissed this guy off.

but once it's in memory...

[Anonymous Coward]

but once it's in memory...
 
What can I say? BSD is in our memory, rest in peace BSD! You will remain in our memories..

Re:*BSD developers leave behind trail of corpses

[BosstonesOwn]

Fact: DragonflyBSD, yet another offshoot of the beleaguered FreeBSD "project", is already collapsing under the weight of internal power struggles and in-fighting. "They haven't done a single decent release," notes Mark Baron, an industry watcher and columnist. "Their mailing lists read like an online version of a Jerry Springer episode, complete with food fights, swearing, name-calling, and chair-throwing." Netcraft reports that DragonflyBSD is run on exactly 0% of internet servers.

Since when did Steve Balmer start working at dragonflyBSD ?

Re:Run your system off of CD

[dedazo]

Good idea, as long as it's not a Sony CD...

Re:There is no fundamental reason

[nuzak]

> Have the compiler randomize the kernel's ABI.

I believe this is called the Linux Kernel Development Process. It even scrambles the API's pretty good between iterations.

Re:Run your system off of CD

[that this is not und]

You only have one CD-ROM drive in your system??

Re:Once you're penetrated you're ****ed.

[turing_m]

"Security is like sex... once you're penetrated you're ****ed."

I think a car analogy would work better here... at least cars are something most people here have a passing familiarity with.