News for hackers. Stuff that matters.

A comment on Security researchers identify new malware targeting Linux. Parent comment

Re:Security researchers identify new malware targeting Linux by BonusPlay on Friday November 22, 2024 @05:27AM (#42212626)
Seems like you assumed none of your tools got backdoored. I'd start bootstrapping from busybox.
[ Parent | on HN ]
Re:Security researchers identify new malware targeting Linux by usr1106 on Friday November 22, 2024 @11:00AM (#42214881)
Not even that is enough if the malware has loaded a kernel module.
[ Parent | on HN ]
Re:Security researchers identify new malware targeting Linux by xorcist on Saturday November 23, 2024 @08:43AM (#42220817)
If the system is backdoored, do none of these things. Boot from rescue media. Save only non-executable files and wipe the rest.

Do not trust key material, sensitive data or remote logins that the backdoored system have had control over. Repeat the same operation for them.

To check for backdoors, again boot from rescue media and do a full integrity check. Do not limit the check to open files.

[ Parent | on HN ]