My bad, should have said that you can't trust the md5sum tampering(since you stated to have a static copy on the flash drive) but you couldn't trust it since you couldn't trust the system calls.
The immediate moment you have to worry about a legit userland rootkit you have to worry about a kernel rootkit. After all you have to consider the psychology of the attacker. If you were to compromise a box, and cared enough to hide a backdoor they cannot detect without static, write proof media, then you care enough to go the extra step for a kernel rootkit. Otherwise you would be spending even more time and effort to make your userland kit work to satisfaction for a far weaker hold on the box. It would simply be idiotic. And I think we can all agree that an attacker able to do either of the above is not an idiot. On Dec 6, 2011 10:19 AM, "Paul Schmehl" <[email protected]> wrote: > > A "poor man's" root kit detector is to take md5sums of critical system binaries (you'd have to redo these after patching), and keep the list on an inaccessible media (such as a thumb drive). If you think the system is compromised, run md5sum against those files, and you will quickly know. You could even keep statically compiled copies on the thumb drive to use in an investigation.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
