Re: LKM Trojan installed

On Sat, 8 Feb 2003, terry white wrote:

> on "2-7-2003" "Craig Holmes" writ:

Yes, indeed, but how do you prevent the ps from using a tampered glibc or other libs? I usually statically compile a standard set of utilities (ls, ps, netstat, chkrootkit, etc.), tar.Z them up (some systems still don't have gzip or bzip2) and dump the tools into a working directory on the "suspect" system. Then I set my path to utilize that directory during my inspection. This limits the toolset such that all I have to worry about is a tampered shell.

Just a suggestion, seeing as the source is so readily available and works spectacularly on Linux.

Sincerely,

Shawn M. Jones Received on Tue Feb 11 10:57:23 2003