[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: I've been hacked by DevilSoul

Henrique de Moraes Holschuh <hmh@debian.org> writes:

> On Fri, 11 Jan 2002, Ricardo B wrote:
> > Isn't there a way to turn module loading off (a way that can't be chagend
> > back - without rebooting) ?
> None that cannot be undone if you're root in a non-ACL kernel. It gets hard
> if the kernel has no module support at all, but not impossible.

There are already rootkits using such technology, see for example:


OTOH, a preloaded shared library can have an effect similar to a
patched kernel, at least on most systems.

Florian Weimer 	                  Weimer@CERT.Uni-Stuttgart.DE
University of Stuttgart           http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT                          +49-711-685-5973/fax +49-711-685-5898

Reply to: