Re: hacked

[Bruce Ferrell <bferrell@baywinds.org>]

Agreed, it will only tell you if executables (and/or libraries) have 
been modified.  That's what vsl is for... it hunts down those nasty 
hidden things (directories etc.)... If They're part of a known 
rootkit...  (Big if, I know).

In general, my experience is that when someone hacks in, they tend to 
install rootkits to maintain their foothold.  Between RPM -Va and a 
rootkit search, it's generally possible, in the real world, to have a 
reasonable assurance of a clean system.

Tripwire won't tell you if something you're not watching has changed. It 
won't tell you if a file has been added either.  It can only tell you if 
something you have under surveillance has changed.

Sometime a complete re-install just isn't feasible, no matter how desirable.

Can we move on now?

Glynn Clements wrote:

> Bruce Ferrell wrote:
> 
> 
>>search google for vsl and vetes
>>
>>You find like to a pretty nice kit for locating rootkits and the like. 
>>You don't mention what distro your system is.  Hate to say it but if 
>>it's RPM based, you can use the -V option to verify every stinking file 
>>on the system if necessary
>>
> 
> But "rpm -V" suffers from the same problem as re-installing the OS
> onto an existing filesystem. It will tell you if any of the files
> which were installed from the RPM have changed, but it won't tell you
> if a new file has been added.
> 
> IOW, just because "rpm -Va" doesn't find any problems, that doesn't
> mean that you're safe.
> 
>