From: Christian <evil@g-house.de>
To: Samium Gromoff <deepfire@ibe.miee.ru>
Cc: linux-kernel@vger.kernel.org
Subject: Re: [OT] Rootkit queston
Date: Sat, 06 Dec 2003 16:07:09 +0100 [thread overview]
Message-ID: <3FD1F09D.6020501@g-house.de> (raw)
In-Reply-To: <874qwehxf1.wl@drakkar.ibe.miee.ru>
Samium Gromoff wrote:
> On Mon, 1 Dec 2003, Richard B. Johnson wrote:
>
>>You can check for a common 'root attack', if you have inetd,
>>by looking at the last few lines in /etc/inetd.conf.
>>It may have some access port added that allows anybody
>>who knows about it to log in as root from the network.
>>It will look something like this:
>>
>># End of inetd.conf.
>>4002 stream tcp nowait root /bin/bash --
>>
[...]
>
> How is it an attack?
> (in order to write to inetd.conf you need to be root already)
he probably meant "rootkit" instead of "root attack" and as the subject
reveals, that's what the thread was all about.
Christian.
--
BOFH excuse #13:
we're waiting for [the phone company] to fix that line
next prev parent reply other threads:[~2003-12-06 16:07 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-12-06 13:45 [OT] Rootkit queston Samium Gromoff
2003-12-06 15:01 ` Måns Rullgård
2003-12-06 15:10 ` Doug McNaught
2003-12-06 15:07 ` Christian [this message]
2003-12-08 13:49 ` Richard B. Johnson
-- strict thread matches above, loose matches on Subject: below --
2003-12-02 21:24 Albert Cahalan
2003-12-01 21:11 Markus Hästbacka
2003-12-01 22:19 ` Richard B. Johnson
2003-12-01 23:36 ` Måns Rullgård
2003-12-01 23:47 ` Mike Fedyk
2003-12-01 22:48 ` Bernd Eckenfels
2003-12-05 17:29 ` dean gaudet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3FD1F09D.6020501@g-house.de \
--to=evil@g-house.de \
--cc=deepfire@ibe.miee.ru \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox