lkml.org 
[lkml]   [1999]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRE: Disabling module loading with a module?
On 17 Aug, Jones D (ISaCS) wrote:
+-----
| > On Tue, 17 Aug 1999, Jones D (ISaCS) wrote:
| > > Sorry, I fail to see the connection between kernel modules and
| > > trusted networks.
| > Kernel modules can hide evidence of a crack, thus allowing crackers to
| > penetrate further into the network.
|
| Care to explain to me how ?
| Maybe I'm missing something here..
+--->8

It's not uncommon on Solaris: hacked machines usually have a "psmod"
module loaded which prevents certain processes from being visible in
/proc, and hence in ps.

I have to agree with Frank on this one, because you can never have 100%
certainty of keeping undesirables out --- so it makes sense to devote
effort to detection (and countermeasures against anti-detection
mechanisms) as well as on keeping them out in the first place.

--
brandon s. allbery os/2,linux,solaris,perl allbery@kf8nh.apk.net
system administrator kthkrb,heimdal,gnome,rt allbery@ece.cmu.edu
carnegie mellon / electrical and computer engineering kf8nh
We are Linux. Resistance is an indication that you missed the point.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.049 / U:0.176 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site