Honeypots mailing list archives
Re: Sebek not working
From: Siim Põder <siim.poder_1398 () eesti ee>
Date: Wed, 16 Aug 2006 23:42:37 +0300
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yo On 16.08.2006 17:23, r00m213 () gmail com wrote:
How do I install it from a startup script, without anybody seeing where the modules are.
I have little backround on this, but you could try to use the functionality found in most rootkits that hide some files after the rootkit has been loaded. I spotted some potential work on someone doing something like this with a couple of google searches, so there you go, wouldnt hurt to look into it. Or then you could rename the module to something obscure and irrelevant-looking (somesort of alsa sound card driver snd_oss_mixer_emulation_snd_snd_oss blah blah thing) and pretend that it's absolutely neccessary to load. Also worth a shot. - -- Siim Põder At some distance down the corridor it seemed suddenly as if somebody started to beat on a bass drum. He listened to it for a few seconds and realized that it was just his heart beating. He listened for a few seconds more and realized that it wasn't his heart beating, it was somebody down the corridor beating on a bass drum. -- Douglas Adams -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFE44M8dVkoBQGQR+MRAtguAJ973om2RSzdbLpzeCllWNeNNnArPgCfd4S9 E+0CzeH+WJUlLo2Z9L8oVws= =mqH5 -----END PGP SIGNATURE-----
Current thread:
- Sebek not working r00m 213 (Aug 13)
- Re: Sebek not working Mark J. Hufe (Aug 14)
- <Possible follow-ups>
- Re: Re: Sebek not working r00m213 (Aug 16)
- Re: Sebek not working Siim Põder (Aug 16)