Full Disclosure mailing list archives
RE: Rootkit For Spyware? Hide your adware from all Adware removers and Anti-viruses
From: "Todd Towles" <toddtowles () brookshires com>
Date: Thu, 23 Sep 2004 09:27:43 -0500
Most people that work with Linux and UNIX in a corporate network understand the risks involved when using root. There isn't a big push in the Microsoft world for this however. Microsoft can't push the "don't run as admin" rule because the majority of people running it wouldn't understand the risks or wouldn't know how to do it in the first place (home users mostly). Plus a lot of older apps need to run as admin to function correctly. Hence why root kits are so danger on WIN32 environments. CWS has used rootkits in its spyware/adware, nothing new here really, but the more people that get exposed to these facts, the better. -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Harlan Carvey Sent: Thursday, September 23, 2004 8:25 AM To: full-disclosure () lists netsys com Subject: RE: [Full-disclosure] Rootkit For Spyware? Hide your adware from all Adware removers and Anti-viruses
Nothing new about rootkits. They aren't big news because they are old news. Although depressing this is defiantly possible.
Old news, yes...but to some, not everyone. Taking users (home, corporate, academic, etc.) out of it, sysadmins and LEOs are still way behind when it comes to understanding rootkits. Certain privileges are required for the installation of user-mode rootkits, and in the absence of those privs, the rootkits have been shown to *not* install. For some level of detail about this, check out "Windows Forensics and Incident Recovery" (http://www.windows-ir.com). _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Rootkit For Spyware? Hide your adware from all Adware removers and Anti-viruses Todd Towles (Sep 23)