Linux Rootkits Part 9: Hiding Logged In Users (Modifying File Contents Without Touching Disk)

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

Let’s see if we can hide the fact that a user is logged in! The idea is that we’ll be able to spawn a shell or login in as some user (we’ll choose root) and not have it show up in the output of tools like who or finger. Looking at the output of who, we see a list of all the active terminal devices and the users associated to them.

Read on /posts/linux_rootkits_09/ ↗