Re: New release of Solaris secuirity module Papillon

Good work, once again. In fact, there are probably many really cool projects that could benefit from being built on your work - for example, a kernel rootkit detection tool...

It didn't really detect my 0day local root - or not in a way that it can distinguish between it, and lots of valid popen()s and execves() and other normal activity. You should only warn if the current %PC is on a non .text page, maybe?

-dave

On 20 Apr 2003 15:26:29 +0200
Konrad Rieck <kr@roqe.org> wrote:

> Hello,
Received on Tue Apr 22 17:30:28 2003