Re: tornkit

[Talisker <Talisker () NETWORKINTRUSION CO UK>]

t0rn seems to be the topic of the week, apologies to anyone who saw me post
this on incidents, but I thought the thread here warranted it.

I have recently been advised of this tool
chkrootkit
which looks for evidence on your hosts for rootkits having been installed.
I haven't used it myself so I can't vouch for it's effectiveness.
For want of a better place I have put it with file integrity checkers
I have info on it at http://www.networkintrusion.co.uk/integrity/

If anyone has used it I'd love to hear their opinions

Take Care
Andy

http://www.networkintrusion.co.uk/ The IDS List
                    '''
                 (0 0)
  ----oOO----(_)----------
  | The geek shall        |
  |  Inherit the earth     |
  -----------------oOO----
               |__|__|
                  || ||
              ooO Ooo


The opinions contained within this transmission are entirely my own, and do
not necessarily reflect those of my employer.





----- Original Message -----
From: "SULLIVAN, AARON R (PB)" <as7274 () MSG PACBELL COM>
To: <VULN-DEV () SECURITYFOCUS COM>
Sent: Tuesday, September 26, 2000 6:12 PM
Subject: tornkit


> There were some who were wondering where to get a copy of Tornkit.  You
may
> obtain it from packetstorm.  The path is
> http://packetstorm.securify.com/UNIX/penetration/rootkits/tk.tgz