
Permalink for comment 468414
Member since:

Uh, no...

The term rootkit originated in Unix systems, and Linux is not immune, the source of most rootkits in Unix\Linux is crackers who gain root access through normal means, mainly security holes in other software running on the system. The cracker then installs the rootkit himself, if the exploit he used allows him to gain root access. This allows him access even if the original exploit is fixed.


Now on the other hand, they are much easier to detect in Linux\Unix, so I think a lot of the cracker types are falling back on the old standbys of replacing standard commands like login with trojans, which is easier to do, and if you do that to a bunch of commands, you can cover more bases.

Reply Parent Score: 6