Full Disclosure mailing list archives
Re: Removing ShKit Root Kit
From: Wesley D Craig <wes () umich edu>
Date: Mon, 22 Dec 2003 11:18:11 -0500
On 22 Dec 2003, at 10:11, nicholas wrote:
To avoid this sort of thing in the future, and to help you find out whatchanged on your box, i'd look into www.lids.org, aide.sf.net,ippersonality.sf.net and bits and pieces of the openwall.com project forserver level security (not network/firewall level).
In addition to filesystem integrity checking, our tool: http://radmind.org/can reverse the changes made by a root kit, providing you boot from known good media. Of course, it is theoretically possible for a root kit to be totally undetectable, even by a tripwire...
:wes _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Removing ShKit Root Kit Chris (Dec 21)
- Re: Removing ShKit Root Kit Cael Abal (Dec 21)
- Re: Removing ShKit Root Kit Alexander Schreiber (Dec 21)
- Re: Removing ShKit Root Kit Chris (Dec 22)
- Re: Removing ShKit Root Kit Ron DuFresne (Dec 22)
- <Possible follow-ups>
- Re: Removing ShKit Root Kit nicholas (Dec 22)
- Re: Removing ShKit Root Kit Wesley D Craig (Dec 22)
- re: Removing ShKit Root Kit nicholas (Dec 22)
- RE: Removing ShKit Root Kit Schmehl, Paul L (Dec 22)
- Re: Removing ShKit Root Kit Brian Eckman (Dec 22)
- Re: Removing ShKit Root Kit Gino Thomas (Dec 22)
- Message not available
- Re: Removing ShKit Root Kit Gino Thomas (Dec 22)
- Re: Removing ShKit Root Kit Brian Eckman (Dec 22)
- Re: Removing ShKit Root Kit Nathan Bates (Dec 22)
- Re: Removing ShKit Root Kit Brian Eckman (Dec 22)
- Re: Removing ShKit Root Kit Nathan Bates (Dec 23)
- Re: Removing ShKit Root Kit Larry W. Cashdollar (Dec 22)
- Re: Removing ShKit Root Kit Brian Eckman (Dec 22)