Re: how to fix rootkit?
Michael,
I think you're talking about syscall interceptions and related stuff.
You're right, we can't trust, but it in this case we're talking about
a very specialized malware and I don't see any fast action to bypass
it. Maybe the conclusion is that we can't trust anything, so we can't
do anything, but something need to be done, right?
An option is load another kernel with kexec but we can't trust kexec.
What we do?
Sometimes we need to assume some risks otherwise we can't proceed. ;-)
BR,
Fernando Mercês
Linux Registered User #432779
www.mentebinaria.com.br
softwarelivre-rj.org
@MenteBinaria
------------------------------------
II Hack'n Rio - 23 e 24/11
hacknrio.org
------------------------------------
On Wed, Feb 8, 2012 at 5:15 PM, Michael Stummvoll <michael@stummi.org> wrote:
> Am 08.02.12 19:51, schrieb Jutta Zalud:
>> Michael Stummvoll wrote:
>>
>>> And who says, that the new binarys don't work in "compromized
>>> mode", e.g. with a LD_PRELOAD? ;)
>>
>>> you can't trust a compromized system, not even when you running
>>> (or think you are running) own binaries. Who knows, what the
>>> kernel does.
>>
>> What exactly do you mean by "system"?
>
> The Operating System.
>
> As I understand Fernando he suggested to run extern self-compiled
> binaries withing the compromized OS to be sure, and what i want to say
> is that you can't be sure in this case.
>
> Kind Regards,
> Michael
>
>
>
> --
> To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
> with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
> Archive: 4F32C9D7.30009@stummi.org">http://lists.debian.org/4F32C9D7.30009@stummi.org
>
Reply to: