Re: Detecting a compromised system

2009-02-15 Thread Boyd Stephen Smith Jr.
On Sunday 15 February 2009 18:06:55 Nikolaus Rath wrote: > But why do I need to make an explicit > snapshot of the system if all debian packages already contain the > necessary information? This information is tool-specific. It doesn't belong in the package. One Debian tool, debsums, does occas

Re: Detecting a compromised system

2009-02-15 Thread Nikolaus Rath
"Boyd Stephen Smith Jr." writes: > On Sunday 15 February 2009 13:06:29 Nikolaus Rath wrote: >> I expected that it would be pretty easy to spot these modifications. >> So I did exactly the above and then tried to "detect" my changes. >> >> I first looked for any additional packages that might help

Re: Detecting a compromised system

2009-02-15 Thread Boyd Stephen Smith Jr.
On Sunday 15 February 2009 13:06:29 Nikolaus Rath wrote: > I expected that it would be pretty easy to spot these modifications. > So I did exactly the above and then tried to "detect" my changes. > > I first looked for any additional packages that might help me with > this and installed (and config

Re: Detecting a compromised system

2009-02-15 Thread Micha Feigin
On Sun, 15 Feb 2009 14:06:29 -0500 Nikolaus Rath wrote: > Hello, > > I recently though about the least sophisticated way to introduce a > backdoor into a system if a already had a root shell. My naive > approach would be to > > a) create a setuid root shell somewhere in the fs, > > or > > b

Detecting a compromised system

2009-02-15 Thread Nikolaus Rath
Hello, I recently though about the least sophisticated way to introduce a backdoor into a system if a already had a root shell. My naive approach would be to a) create a setuid root shell somewhere in the fs, or b) modify an existing setuid binary to grant me root access (e.g. when invoce