Re: Kernel Rootkits

[Lee Revell <rlrevell@joe-job.com>]

On Fri, 2005-04-15 at 13:33 -0400, Malita, Florin wrote:
> On Fri, 2005-04-15 at 13:16 -0400, Richard B. Johnson wrote:
> > I'm not sure there really are any "kernel" rootkits. You need to be 
> > root to install a module and you need to be root to replace a kernel 
> > with a new (possibly altered) one. If you are root, you don't 
> > need an exploit.
> 
> rootkit != exploit
> 
> The exploit is used to gain root privileges while the rootkit is used
> after that to install & hide backdoors, sniffers, keyloggers etc.
> 
> http://en.wikipedia.org/wiki/Rootkit
> 

"Rootkit" is sometimes used to refer to the all-in-one bundle, that
contains the exploit and the tools the attacker installs once they are
in.

OT: the dumbest rootkit I ever came across came from someone who cracked
one of our nameservers via an openssh hole.  They were careful to
replace netstat, ps, etc but apparently didn't know about lsof, which
was the first thing I tried of course.  Then they hid the old binaries
in a subdirectory of /dev (because no one would ever look there).
Thanks to the "l33t skillz" of the author, I didn't even have to wipe
the machine to recover it.

Lee