News for hackers. Stuff that matters.

A comment on EUD Security Guidance: Ubuntu 18.04 LTS. Parent comment

Re:EUD Security Guidance: Ubuntu 18.04 LTS by viraptor on Tuesday July 31, 2018 @06:23AM (#17651944)
If the process actually tries to be stealthy you won't see open UDP sockets like this. If the data is only sent out, or the all is using polling, the socket can be created and destroyed as needed.

A better approach could be systemtap which has a whole system visibility.

[ Parent | on HN ]
Re:EUD Security Guidance: Ubuntu 18.04 LTS by isostatic on Tuesday July 31, 2018 @11:06AM (#17653737)
Presumably it would show up in a netstat, but only while the packet was being written to the network stack?

  open(SOCK)
  // now visible 
  write(SOCK, contents)
  close(SOCK)
  // no longer visible
[ Parent | on HN ]