Re: DHCP - rootkit

2002-11-02 Thread Phillip Hofmeister
On Fri, 01 Nov 2002 at 06:41:43PM -0400, Peter Cordes wrote: MD5 is still believed to be secure. i.e. Nobody can modify a binary so that it has different contents but the same MD5 hash, unless they are _very_ _very_ lucky. The task becomes even more difficult if you check the length of the

Re: DHCP - rootkit

2002-11-02 Thread Phillip Hofmeister
On Fri, 01 Nov 2002 at 06:41:43PM -0400, Peter Cordes wrote: MD5 is still believed to be secure. i.e. Nobody can modify a binary so that it has different contents but the same MD5 hash, unless they are _very_ _very_ lucky. The task becomes even more difficult if you check the length of the

Re: DHCP - rootkit

2002-11-01 Thread Peter Cordes
On Tue, Oct 29, 2002 at 05:10:12PM -0800, Alvin Oga wrote: am not as worried about the determined hacker/crackers that can modify binaries such that md5sum matches my tripewire db and other security precautions (databases and baseline) of my servers MD5 is still believed to be secure. i.e.

Re: DHCP - rootkit

2002-11-01 Thread Peter Cordes
On Tue, Oct 29, 2002 at 05:10:12PM -0800, Alvin Oga wrote: am not as worried about the determined hacker/crackers that can modify binaries such that md5sum matches my tripewire db and other security precautions (databases and baseline) of my servers MD5 is still believed to be secure. i.e.

Re: DHCP - rootkit

2002-10-29 Thread Alvin Oga
hi ya rick yes... got that part ... ( the after breaking in part ) was exepecting to see it helps one to breakin and exploit the vulnerabilities so it didn't sink in at first when i was reading all the talk-backs ( didnt see what i wanted to see ;-) thanx alvin On Mon, 28 Oct 2002,

Re: DHCP - rootkit

2002-10-29 Thread Dale Amon
A rootkit is a selection of modified standard programs that usually replace (among others) ls ps netstat users and pretty much everything else you would use to check your machine. It will also include a backdoor. Sometimes the primary part of the rootkit is

Re: DHCP - rootkit

2002-10-29 Thread Alvin Oga
hi ya dale Rootkits are *INSTALLED* after a successful root exploit. maybe i missing something here ... that i been wonderng about for years.. if they exploited a root vulnerability and got in... why modify silly binaries like ps, top, ls, find, etf ?? that gives themself away as having

Re: DHCP - rootkit

2002-10-29 Thread Alvin Oga
hi ya dale if anybody modifies the typical binaries.. i'll know within the hour.. hourly/randomly system checks or instaneously if i happen to be reading emails at the time ... they are attacking... i say modifying files is a give away .. that says come find me which is trivial since its

Re: DHCP - rootkit

2002-10-29 Thread Noah L. Meyerhans
On Tue, Oct 29, 2002 at 04:12:54PM -0800, Alvin Oga wrote: i say modifying files is a give away .. that says come find me which is trivial since its modified binaries If they do it right, it's not a giveaway. If they're quick, thorough, and accurate, they can certainly do it right. On

Re: DHCP - rootkit

2002-10-29 Thread Alvin Oga
hi ya noah On Tue, 29 Oct 2002, Noah L. Meyerhans wrote: On Tue, Oct 29, 2002 at 04:12:54PM -0800, Alvin Oga wrote: i say modifying files is a give away .. that says come find me which is trivial since its modified binaries If they do it right, it's not a giveaway. If they're

Re: DHCP - rootkit

2002-10-29 Thread Alvin Oga
hi ya rick yes... got that part ... ( the after breaking in part ) was exepecting to see it helps one to breakin and exploit the vulnerabilities so it didn't sink in at first when i was reading all the talk-backs ( didnt see what i wanted to see ;-) thanx alvin On Mon, 28 Oct 2002,

Re: DHCP - rootkit

2002-10-29 Thread Dale Amon
A rootkit is a selection of modified standard programs that usually replace (among others) ls ps netstat users and pretty much everything else you would use to check your machine. It will also include a backdoor. Sometimes the primary part of the rootkit is

Re: DHCP - rootkit

2002-10-29 Thread Alvin Oga
hi ya dale Rootkits are *INSTALLED* after a successful root exploit. maybe i missing something here ... that i been wonderng about for years.. if they exploited a root vulnerability and got in... why modify silly binaries like ps, top, ls, find, etf ?? that gives themself away as having

Re: DHCP - rootkit

2002-10-29 Thread Dale Amon
On Tue, Oct 29, 2002 at 03:28:20PM -0800, Alvin Oga wrote: if they exploited a root vulnerability and got in... why modify silly binaries like ps, top, ls, find, etf ?? that gives themself away as having modified the system No it doesn't. It makes them and everything they do vanish into thin

Re: DHCP - rootkit

2002-10-29 Thread Alvin Oga
hi ya dale if anybody modifies the typical binaries.. i'll know within the hour.. hourly/randomly system checks or instaneously if i happen to be reading emails at the time ... they are attacking... i say modifying files is a give away .. that says come find me which is trivial since its

Re: DHCP - rootkit

2002-10-29 Thread Noah L. Meyerhans
On Tue, Oct 29, 2002 at 04:12:54PM -0800, Alvin Oga wrote: i say modifying files is a give away .. that says come find me which is trivial since its modified binaries If they do it right, it's not a giveaway. If they're quick, thorough, and accurate, they can certainly do it right. On

Re: DHCP - rootkit

2002-10-29 Thread Alvin Oga
hi ya noah On Tue, 29 Oct 2002, Noah L. Meyerhans wrote: On Tue, Oct 29, 2002 at 04:12:54PM -0800, Alvin Oga wrote: i say modifying files is a give away .. that says come find me which is trivial since its modified binaries If they do it right, it's not a giveaway. If they're

Re: DHCP - rootkit

2002-10-28 Thread Alvin Oga
hi ya rick On Mon, 28 Oct 2002, Rick Moen wrote: Quoting Alvin Oga ([EMAIL PROTECTED]): Um, Alvin? You might want to look up the definition of rootkit. my definition ... anything that allows an un-educated user to just run that tool to break into other peoples network and machines

Re: DHCP - rootkit

2002-10-28 Thread Rick Moen
Quoting Alvin Oga ([EMAIL PROTECTED]): i read all the talkbacks... - no definition of rootkit posted in the talkbacks Look again. Anyhow, a rootkit is not anything that allows an un-educated user to just run that tool to break into other peoples network and machines. It's something the

Re: DHCP - rootkit

2002-10-28 Thread Alvin Oga
hi ya rick On Mon, 28 Oct 2002, Rick Moen wrote: Quoting Alvin Oga ([EMAIL PROTECTED]): Um, Alvin? You might want to look up the definition of rootkit. my definition ... anything that allows an un-educated user to just run that tool to break into other peoples network and machines

Re: DHCP - rootkit

2002-10-28 Thread Rick Moen
Quoting Alvin Oga ([EMAIL PROTECTED]): i read all the talkbacks... - no definition of rootkit posted in the talkbacks Look again. Anyhow, a rootkit is not anything that allows an un-educated user to just run that tool to break into other peoples network and machines. It's something the