Re: Positive uses for rootkits -> off-topic: booting tricks.

[Alex Schütz <antitrack_legend () TELEKABEL AT>]

At 16:46 25.03.01 -0500, you wrote:

> Something I like doing is leaving the kernel source there, but modify it
> so it is unbootable.

I guess you now know why I usually have my kernel on a write-protected
bootdisk. The PC server default-boots from that disk. Many attackers are
not smart enough to modify the CMOS bios boot options before rebooting.
Even if they did, the boot-device is a SCSI harddisk on an SCSI controller
that has no boot-bios (NCR cheapo-controller), so it might be *really*
impossible to hack anything this way. And no IDE devices !

So we've found something 100% safe from remote-rebooting "a modified
kernel" at least. If that ever helps? God knows :-) Anyhow, sorry for being
so off-topic. Talk to you later,

Alex