lkml.org 
[lkml]   [1999]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRE: Disabling module loading with a module?
On Tue, 17 Aug 1999, Jones D (ISaCS) wrote:

> > > Sorry, I fail to see the connection between kernel modules and
> > > trusted networks.
> > Kernel modules can hide evidence of a crack, thus allowing crackers to
> > penetrate further into the network.
>
> Care to explain to me how ?
> Maybe I'm missing something here..

Search rootshell.com for heroin.c. You insert the module, and send
signal 31 (IIIRC) to any process you wish no longer to have appear
in any process list.

Similar hacks are, I believe, available to hide sockets from netstat.

This hack works on systems with read-only / and/or /usr, and it won't
be caught by tripwire.

> d. [Not cynical, just confused]

Clearly :)

Matthew.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.067 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site