RE: RootKits Under Linux



I can't answer your entire question but I can provide a good resource.

http://www.packetstormsecurity.org/UNIX/penetration/rootkits/

Packet Storm has A LOT of known rootkits listed there with descriptions
and links to other sites.

Another tool you might look into is Rootkit Hunter (rkhunter).

Good Luck!

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Ahmed Zaki
Sent: Thursday, January 31, 2008 1:41 PM
To: focus-ids@xxxxxxxxxxxxxxxxx
Subject: RootKits Under Linux

Hi all

I am currently doing a project on rootkits under linux os. I am
specially interested in loadable kernel module rootkits. I wanted to
know
where does research stand now in terms of detecting such rootkits. It
would
be very helpful if you would be able to point me to resources where I
gain
information on the diverse variations of these rootkits and current
available methods of detecting them. Also if there are mechanisms that
can
be used to totally avoid detection that would be used by rootkits.



Regards

Zeeq


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaig
n=intro_sfw
to learn more.
------------------------------------------------------------------------


-----------------------------------------
Confidentiality Notice: This e-mail message, including any
attachments, is for the sole use of the intended recipient(s) and
may contain confidential and privileged information. Any
unauthorized review, use, disclosure, or distribution is
prohibited. If you are not the intended recipient, please contact
the sender by reply e-mail and destroy all copies of the original
message.

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------



Relevant Pages

  • Re: Does Norton Anivirus detect rootkits?
    ... Windows is running is to act as a preventative ... ... Recognizing (detecting and blocking) known rootkit install ... rootkits that disable mainstream av and software firewalls. ...
    (alt.comp.anti-virus)
  • Re: RootKits Under Linux
    ... interrupt descriptor table (IDT). ... Packet Storm has A LOT of known rootkits listed there with descriptions ... Subject: RootKits Under Linux ... where does research stand now in terms of detecting such rootkits. ...
    (Focus-IDS)
  • Re: RootKits Under Linux
    ... maybe you can get some info in the chkrootkit project ... I am currently doing a project on rootkits under linux os. ... where does research stand now in terms of detecting such rootkits. ... with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)
  • Re: RootKits Under Linux
    ... You can check on Adore rootkit for Linux, ... I am currently doing a project on rootkits under linux os. ... where does research stand now in terms of detecting such rootkits. ... Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. ...
    (Focus-IDS)