Re: Incident investigation methodologies

[Jon Coller <jon () coller org>]

Paul Schmehl wrote:
<snip>
> For example, a statically compiled copy of ls on a CD is going to show 
> you what's on the hard drive of a unix machine no matter what the 
> rootkit may have done.
<snip>

This is most definitely not true!

How do you think ls gets the contents of a directory? (here's a hint, 
the kernel via the getdents system call)

take a read of this for a decent example of how trivial it is to make 
user land tools lie:
http://packetstormsecurity.com/groups/thc/LKM_HACKING.html

-Jon