Search for rootkit malware with chkrootkit

Rootkit Sleuth

Author(s):

Linux can be infected by rootkit malware that is hidden and hard to detect. The chkrootkit program can help find rootkit infections.

The chkrootkit package examines key system files to determine whether they have been tampered with or infected by malware known as rootkits. An infected system can leak valuable data such as user credentials, can allow hackers to steal banking information, can provide remote control capability, and can disrupt security software. The fact that rootkits can remain on a system for long periods of time undetected makes them particularly dangerous.

Changing Attitudes on Linux Malware

Contrary to popular belief, Linux does suffer from malware infections and attacks. Rootkits are one type of malware designed to infect, gain elevated access, and remain hidden from detection for long periods of time. Rootkits are especially malicious, because they not only remain hidden but also can disable or disrupt security software making them hard to remove. Once infected, often the only recourse is to re-image (wipe and reinstall) the system.Symantec has identified five types of rootkits:

  • Hardware/firmware – installed in the computer’s BIOS, firmware, or other hardware components
  • Bootloader – the system’s bootloader is active before the operating system loads
  • Memory – RAM-based rootkits only last while the computer is powered on and generally do not persist after a reboot unless the file is set to reload on boot
  • Application – application rootkits alter standard programs that appear to work normally while infected
  • Kernel mode – core operating system alterations access and control the computer’s lowest operational levels

[...]

Use Express-Checkout link below to read the full article (PDF).

Buy Linux Magazine

SINGLE ISSUES
 
SUBSCRIPTIONS
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • chkrootkit

    Detect rootkits, worms, and other malware with chkrootkit.

  • Expert Security Intro

    Internet intruders have many ingenious ways of escalating privileges and hiding their presence once they get inside your system. The best protection is to keep them out in the cold.

  • Host-Based IDS

    A host-based intrusion detection system is a simple but powerful tool for finding traces of an attacker's footprint.

  • Trinity Rescue Kit

    Trinity Rescue Kit is driven by the practical requirements of the admin’s daily work, integrating a full set of tools for maintaining and rescuing Linux and Windows PCs.

  • Charly's Column – Whowatch

    For no particular reason, Charly occasionally patrols his server farm and hunts down attackers. He has put together a neat toolbox for this job.

comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News