[ale] New Linux Rootkit

[Beddingfield, Allen]

I wonder if it is smart enough to instead put something in boot.local or after.local on SUSE?
Security through….not running Redhat or Debuntu?  :D
Allen B.

--
Allen Beddingfield
Systems Engineer
The University of Alabama

From: Scott Plante <splante at insightsys.com<mailto:splante at insightsys.com>>
Reply-To: Atlanta Linux Enthusiasts <ale at ale.org<mailto:ale at ale.org>>
Date: Tuesday, November 20, 2012 4:53 PM
To: Atlanta Linux Enthusiasts <ale at ale.org<mailto:ale at ale.org>>
Subject: Re: [ale] New Linux Rootkit

Well, for one thing, it adds a line to /etc/rc.local. So you could take a look at that and see if there's anything out of place.
Scott
________________________________
Jay Lozier asked:

Quick question - how does determine if the rootkit is running?