3,070 reputation
11318
bio website stratigery.com
location Denver, CO
age 54
visits member for 4 years, 3 months
seen Jul 2 at 1:56

Jul
2
comment Why use oddly compiled ELF files for Linux malware?
@AriTrachtenberg - The linux "file" command does a good deal more than looking at magic bytes: support.f5.com/kb/en-us/solutions/public/16000/300/… "file" has an ELF file parser, and it caused some problems. Note that the "strings" utility uses libbfd, also parses ELF headers, and also had a vulnerability: lcamtuf.blogspot.com/2014/10/…
Jul
1
comment Why use oddly compiled ELF files for Linux malware?
@AriTrachtenberg - certainly. The post-processor could be any hex editor, in the case of the mangled SHeader executable. And maybe such a trick fools anything that uses libelf, but it won't fool anything more robust - it doesn't fool the kernel's loader. But why keep a Linux 2.0.0 machine (or VM) around? What's the advantage there?
Jun
30
asked Why use oddly compiled ELF files for Linux malware?
Jun
10
awarded  Nice Answer
May
17
awarded  Popular Question
Mar
24
awarded  Yearling
Mar
18
comment Why would malware try to remove other malware?
Does the removing program qualify as "malware" if it's removing malware?
Nov
3
asked Specific Dangers in Joining a Linux Botnet?
Aug
4
awarded  Good Answer
Aug
3
revised How do you know a computer is not compromised when you first get it?
Change "intellectual privacy" to "intellectual property", which is what I meant.
Aug
3
comment Is Linux really that secure, with only root password denying external access?
@SPRBRN - you don't need root access. It's certainly possible to set up a particular linux installation so that doing "sudo pacman -S spork" is what you would do. I believe Ubuntu and maybe Debian do things that way - no root user, just temporary permissions. But an installer is a pretty intimate piece of software - if you can get someone to install kinked software, the system can be corrupted, ACLs, root users or sudo or some other mechanism.
Aug
2
awarded  Nice Answer
Aug
2
answered Is Linux really that secure, with only root password denying external access?
May
21
comment What attack requests “wp-admin” URLs without login cookies?
see updated question for extra information. My site has only ever run a honey pot that resembles WordPress. The requests appear isolated - not preceded by requests for wp-login.php, or followed by requests for anything else.
May
21
revised What attack requests “wp-admin” URLs without login cookies?
Add extra info as requested by an "answer".
Mar
24
awarded  Yearling
Feb
25
comment How big is the threat of Desktop Linux malware?
@curiousguy - great. Write your own explanation of why Linux has so much more malware than Windows. Oh, wait...
Feb
24
answered How big is the threat of Desktop Linux malware?
Feb
24
asked What attack requests “wp-admin” URLs without login cookies?
Nov
26
awarded  Popular Question