/tags/rootkit/ Recent content in Rootkit on scarbrough.co.uk Hugo en-us Sat, 05 May 2012 00:00:00 +0000 /post/security/linux-rootkit-case-study/ Sat, 05 May 2012 00:00:00 +0000 /post/security/linux-rootkit-case-study/ !!! info Original post on my WordPress site The Scenario The following is a summary of what’s presented in the case study. It begins with the discovery of the following in file inetd.conf on a workstation running Red Hat Linux: netstat stream tcp nowait root /usr/lib/netstat netstat A graphical CPU load monitor showed 100% load, the top command indicated only 90%, and there were apparently no running processes listed that accounted for the discrepancy.