Messages in this thread | | | Date | Tue, 17 Aug 1999 16:58:08 +0100 (GMT) | From | Matthew Kirkwood <> | Subject | RE: Disabling module loading with a module? |
| |
On Tue, 17 Aug 1999, Jones D (ISaCS) wrote:
> > > Sorry, I fail to see the connection between kernel modules and > > > trusted networks. > > Kernel modules can hide evidence of a crack, thus allowing crackers to > > penetrate further into the network. > > Care to explain to me how ? > Maybe I'm missing something here..
Search rootshell.com for heroin.c. You insert the module, and send signal 31 (IIIRC) to any process you wish no longer to have appear in any process list.
Similar hacks are, I believe, available to hide sockets from netstat.
This hack works on systems with read-only / and/or /usr, and it won't be caught by tripwire.
> d. [Not cynical, just confused]
Clearly :)
Matthew.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |