Re:Rootkit infects Linux web servers
by mercurial on Wednesday November 21, 2012 @04:02PM
(#4816294)
Actually, this may be a way of detecting it. If you ls -l rc.local, ls should read the file size out of its inode (ie, not by reading the file itself). Which means that saving the buffer you get while reading rc.local in vim to another file will result create a file with a different size than the real rc.local.
[ Parent
| on HN ]
There are no comments on this comment yet.