The Most Overlooked Cracker Haven

    Date05 Dec 2002
    3268
    Posted ByAnthony Pell
    Crackers can cause their software to be run by adding entries to /etc/inittab, a file frequently missed by administrators. I told folks to discount any change which required kernel modifications. A change to the MBR probably doesn't qualify in that . . . Crackers can cause their software to be run by adding entries to /etc/inittab, a file frequently missed by administrators. I told folks to discount any change which required kernel modifications. A change to the MBR probably doesn't qualify in that regard, but it would certainly seem out of scope nonetheless.[3] Similarly, a change to the bootloader or initrd ram disk[4] fall under kernel changes to some degree, and thus weren't the correct answer, based on my phrasing.

    Many folks suggested that it was root's .bashrc, or global /etc/profile and similar files that was the culprit. By logging in, root's shell would execute commands that were hidden in those files. That's definately a possibility, but the fact that moniker had PID 15 meant that it had to have started before root logged in, so that's not the culprit.

    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"15","type":"x","order":"1","pct":53.57,"resources":[]},{"id":"88","title":"Should be more technical","votes":"4","type":"x","order":"2","pct":14.29,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"9","type":"x","order":"3","pct":32.14,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.