Staying one step ahead of the intruders
Delousing
After detecting a rootkit, the only thing that really helps is to completely reinstall the infected system – the malicious software digs far too deep into a system to let you remove it with any degree of certainty. In this light, it makes sense to do everything you can to prevent a rootkit from compromising your system. Prevention is the only real answer – particularly, installing security patches. To prevent malware exploiting them, you need to make sure that you close all known vulnerabilities.
Latest and Greatest
The principle of using the latest software also applies to rootkit scanners. Zeppoo [7] is almost two years old, for example, and fails to detect any of the current crop of rootkits due to total ignorance of their approaches. It is probably best to leave Zeppoo where it is on SourceForge.
The next best obstacle is a firewall, preferably one that controls network traffic in all layers of the TCP/IP stack. For servers in hostile environments, the use of a static kernel and an intrusion detection tool such as OSSEC.
Keep in mind, however, that humans are possibly the biggest attack vector for rootkits. If a user is enticed by phishing mails or enlargement offers, the best security mechanisms are no doubt doomed to failure.
Infos
- Blue Pill: http://en.wikipedia.org/wiki/Blue_Pill%28malware%29
- Chkrootkit: http://www.chkrootkit.org
- Rootkit Hunter: http://htp://rkhunter.sf.net
- OSSEC: http://www.ossec.net
- Rootcheck signatures: http://www.ossec.net/rootkits
- RK Profiler LX: http://www.trapkit.de/research/rkprofiler/index.html
- Zeppoo: http://sourceforge.net/projects/zeppoo
« Previous 1 2 3 4
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
US / Canada
UK / Australia