Re: Positive uses for rootkits

[Dick Visser <dick () TIENHUIS NL>]

On Fri, 23 Mar 2001, Jonathan James wrote:

> > 1. Are most rootkits simply shell scripts or real programs?
> Most rootkits are installed as Operating System Modules:
> Win95/Win98/WinME:
> - .VxD files
> Windows NT/2000
> - .sys files
> Linux
> - LKMs (Linux Kernel Module)
>
> With Kernel Modules installed you've generally got 100% control of the
> current hosting operating system.
> This means that you can filter output that is sent to the user, hook into
> the filesystem calls etc..
> Kernel modules are hard to detect (for the common everyday user) and can be
> installed so that they are hard to remove.

So that's why I think it's better to build a minimal, static kernel
without modules support. And once your kernel is OK and running, remove
the .config file from your kernel source tree. If someone does get in and
tries to make a new kernel (with modules support) he cannot simply grab
the old configfile and add modules support to it.
If he can make a kernel, at least he will have to configure it right to
make it behave the same like the static kernel.
I say this because it is not the first time I made a kernel and found out
that it was not bootable because of a tiny misconfiguration :)
Comments on this strategy are welcome.

--
Dick Visser