News for hackers. Stuff that matters.

A comment on The paranoid #! Security Guide.

Re:The paranoid #! Security Guide by daviddede on Sunday July 14, 2013 @09:34AM (#6040839)
Why people still recommend chkrootkit? It is an old tool that havent't been updated in a long while and wont find any new linux rootkits/malware.
[ Parent | on HN ]
Re:The paranoid #! Security Guide by pavs on Sunday July 14, 2013 @09:38AM (#6040848)
How is rkhunter?
[ Parent | on HN ]
Re:The paranoid #! Security Guide by nisa on Sunday July 14, 2013 @01:28PM (#6041457)
Out of the box it's probably useless but if you spend some time to configure rkhunter it can be a worthwhile help in finding malware. But for anything that goes beyond script-kiddie attempts I'd not count on it.

- It can verify hashes using the package manager.

- It can report use of deleted files. After clearing the false-positives this can help to detect some malware that is only in memory and already deleted on disk

- Support for unhide¹ - This should help against rootkits - but I'm not sure how reliable it is nowadays

1: http://www.unhide-forensics.info/

[ Parent | on HN ]