-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Brendan Halpin writes:
> Update: replacing /sbin/init with /sbin/initsk12 (byte-identical to
> original) "solves" the EIP oops. This allows chkrootkit to run fully,
> and to find no problems. Can I consider this machine OK now? There
> certainly was a breakin (via user test), and a privilege escalation to
> allow the insertion of the compromised (and buggy) init file, and of
> /usr/lib/.ss/sk (SucKIT).
I would definitely recommend being a bit more paranoid :(
Verify checksums of as many system files as you can. (you can do this
by copying md5sum and its dependent libs from another known-good source,
getting checksums, and comparing against what they should be. and
hoping there's no kernel-level rootkit in place....)
You should really restore from backup, but that's not too practical
a lot of the time ;)
- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS
iD8DBQFBK3icQTcbUG5Y7woRApWIAKCQ1l1Zrq35mhODXfl4KAsZaKNfmgCgyF82
Mb1jmZtC1LayCUJ/fCfZptY=
=1K6z
-----END PGP SIGNATURE-----
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
