Hacker News new | ask | show | jobs
by FooBarWidget 5746 days ago
Which is more dangerous than all the others things you can do as root - like inserting an arbitrary kernel module - how?
3 comments

Dangerous: no, but he said interesting, so perhaps. The advantage of using little known features, for rootkits, is that people are less likely to look for them.
i never said more dangerous nor intended it.

it's not a very good rootkit by itself, certainly, as typically rootkits will monkey with the kernel to hide processes and network sockets.

it's interesting because it's probably the simplest rootkit method i can think of (next to setuid binaries). it's less obvious than a setuid. it's not something that anyone sane would use by itself because like i said--it doesn't hide you.

it's not (yet) an obvious place to look.