* Willy Tarreau <w@1wt.eu> wrote:

> Then they will simply proceed like this :
>   - patch /boot/vmlinuz
>   - sync
>   - crash system
> 
> => user says "oh crap" and presses the reset button. Patched kernel boots.
>    Game over. Patching vmlinuz for known targetted distros is even easier
>    because the attacker just has to embed binary changes for the most
>    common distro kernels.

a reboot often raises attention. But yes, in terms of end user boxes, 
probably not. Anyway, my points were about transparent rootkits 
installed on a running system without anyone noticing - obviously if the 
attacker can modify the kernel image and the user does not mind a reboot 
it's game over.

	Ingo