New answers tagged

3

I pulled out my crystal ball and, Good News!, none of ps, netstat, top, and lsof have been changed! In fact, none of the commands on your system were changed by the rootkit... except for bash. However, bash intercepts calls to all the other utilities in order to hide the continued presence of the rootkit by modifying any output before you see it; you might ...


7

If your system has been compromised, you shouldn't trust anything. I think usually the standard utilities will mostly work correctly, but leave out stuff related to the attacker's processes. Rootkits are designed this way so you're less likely to notice that the machine is compromised. So I think you can generally trust them for looking at your own ...


2

Amazingly, against all the laws of the universe, a car-based analogy is useless here. An Invasion of the Body Snatchers analogy works, though. Any of your system's commands (or the libraries that they depend upon) can be (and probably has been) replaced with a copy that looks and acts almost exactly like the original but also has the secret purpose of ...


18

As the system is compromised, nothing is to be trusted via way of tools. Unless you have the tools validated (e.g. Tripwire FIM), your best bet is to take a similar system, copy over what is necessary, which should run if the systems are similar in architecture, etc. This is not the optimal method though. Because the machine is compromised, depending on your ...


2

Probably, but not necessarily. The attacker could always replace the programs with modified versions of their own if they had root access.



Top 50 recent answers are included