Re: [gentoo-security] System knockout :-(

[Tobias Weisserth]

Hi,

Am So, den 04.04.2004 schrieb Holger Kettler um 14:40:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Absender Tobias Weisserth:
> > That's why I install and set up Tripwire right after I did a perfectly
> > good installation. I don't know of any way an intruder could sneak
> > around a good Tripwire setup. It's on all my machines first thing after
>
> Seriously, there *IS* at least one root-kit specially designed to fool
> tripwire.

That's why I wrote a *good* Tripwire setup :-)

How should a root kit fool my Tripwire setup if the necessary binaries
and the database are on a mounted CD? :-) This is *extremely* unlikely
and probably demands a *very* difficult attack approach.

I'm doing the same with chkrootkit. Write protected media can't be
fooled :-)

regards,
Tobias


--
gentoo-security@g.o mailing list