News for hackers. Stuff that matters.
Re:Rootkit infects Linux web servers by mercurial on Wednesday November 21, 2012 @04:02PM (#4816294)
Actually, this may be a way of detecting it. If you ls -l rc.local, ls should read the file size out of its inode (ie, not by reading the file itself). Which means that saving the buffer you get while reading rc.local in vim to another file will result create a file with a different size than the real rc.local.

There are no comments on this comment yet.