lkml.org 
[lkml]   [1999]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: Disabling module loading with a module?
On 17 Aug, Horst von Brand wrote:
+-----
| > I must admit, the more I'm exposed to the cynisism of the list, the more I
| > begin to wonder if it would all be worth it, except for maybe the odd
| > university etc. Congratulations :-)
|
| I'ts not cynicism, it's just that this is a rather hard way to hide
| evidence, vermin will use simpler methods. They aren't this easy to stop,
| either.
+--->8

Regrettably false. I have copies of a "psmod" used by vermin attacking
Solaris systems, which hides processes from /proc (and therefore ps).
So far such a hacked module has been found installed on *every* Solaris
box we've found that had been cracked.

--
brandon s. allbery os/2,linux,solaris,perl allbery@kf8nh.apk.net
system administrator kthkrb,heimdal,gnome,rt allbery@ece.cmu.edu
carnegie mellon / electrical and computer engineering kf8nh
We are Linux. Resistance is an indication that you missed the point.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.045 / U:3.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site