Re: DoS Trojan on Solaris

[dittrich () CAC WASHINGTON EDU (Dave Dittrich)]

On Wed, 2 Feb 2000, Roderick Padilla wrote:

> It was discovered that the following programs had trojan replacements:
> /usr/lib/nfs/lockd
> /usr/lib/nfs/statd
> /usr/openwin/bin/rpc.ttdbserverd
> /usr/bin/login
> /usr/bin/ps
> /usr/bin/inetd
> /usr/sbin/in.rlogind
> /usr/sbin/login

Sorry I wasn't reading this folder sooner, but I have a paper on root
kits that explains some things (and ways to get around them - if anyone
else knows of others, let me know):

        http://staff.washington.edu/dittrich/misc/faqs/rootkits.faq

David Brumley also has an article in September (I believe) issue of
;login: magazine.

--
Dave Dittrich                 Client Services
dittrich () cac washington edu   Computing & Communications
                              University of Washington

<a href="http://www.washington.edu/People/dad/";>
Dave Dittrich / dittrich () cac washington edu [PGP Key]</a>

PGP 6.5.1 key fingerprint:
FE 97 0C 57 08 43 F3 EB  49 A1 0C D0 8E 0C D0 BE  C8 38 CC B5