On 8/4/2010 12:43 PM, Brian wrote:
On Wed 04 Aug 2010 at 10:09:17 -0500, Jordon Bedwell wrote: Correct. It wouldn't be there in the first place and I don't plan on having my root acoount compromised. Besides, I know my system.
Naive but cute you think that though. You obviously don't to the latter.
You're speaking hypothetically. When rootkits with these capabilities exist neither chkrootkit nor rkhunter will detect them. By the time they get round to it my updates will have brought in the fixes, just as they did when Lion, which chkrootkit spuriously claims to defend me against, was about.
Let me know when the security industry does not run on theory and hypothetical (until proven) proof of concepts. if it weren't for theory and hypothetical situations you would still think MD5 was secure because nobody would have hypothesized that if MD5 was vulnerable to clashes and then could be vulnerable to rainbow tables, and then come up with a proof of concept which is now generally accepted as true and proven by the security and non-security industry. The world runs off of hypothetical situations, without them, you would still be using a pen and paper sir, actually, possibly and probably not because you wouldn't even have fire.
Let me know when you can't noexec mount that drive onto a clean system, or onto the current system with a liveCD and check for rootkits so that the rootkit can't constantly hide itself, even if it's in the Kernel.
Chkrootkit does not claim to "defend you", "protect you", "warn you ahead of time with constant monitoring", "secure you" or "fix problems" it merely only claims to try and find rootkits, they don't say on their site "you are protected from rootkits if you use our software", "you will be safe from rootkits if you use our software", "rootkits are no more with our software!", "we will remove the rootkits for you with our software and you will be safe!", no, it only claims to detect them. As a matter of fact, is the tagline of chkrootkit not: "locally checks for signs of a rootkit" not "locally checks and removes rootkits".