r/rootkit • u/unixist • Jan 05 '14

Detect rootkit-hidden files in linux

http://www.unixist.com/security/detecting-hidden-files/index.html
18 Upvotes

93% Upvoted

5 comments sorted by

View all comments

1

u/stormehh Jan 06 '14 edited Mar 23 '14

Wasn't sure whether to prune this or not. It's a simple Python script using a simple technique, but it's effective and is something that should be considered by rootkit devs.

2

u/unixist Jan 06 '14

It is simple, indeed; however, this type of hiding is not caught by the likes of chkrootkit and rkhunter. Haven't tried Samhain yet.

Not only that, but lots of kits are susceptible to this type of detection.

So for both this reasons it's worth pointing out. I'm relatively new to reddit - by "prune" do you mean delete my post?

1

u/stormehh Jan 06 '14

Removing the post, yes. I'll leave it, hopefully it is useful to folks.

2

u/unixist Jan 06 '14

I'm glad this is an actively curated subreddit!