Server security experts define rootkits as a collection of programs that enable an attacker to get the same privilage as the root user in a linux or unix system. The word is composed of two portions: ‘root’ – meaning the application will provide the highest access level of the root/administrator in the system and ‘kit’ – meaning it has a number of tools.
Attackers after getting access to a server, will install a rootkit to hide their identity and run desired scripts anywhere within the server. It makes the life of a hacker easy once installed. Rootkits are not easily detectable. Sometimes, if the rootkit is one of the latest ones without a diagnosis, the server will have to be rebuild from scratch.
A rootkit will have multiple applications for cracking the entire server, some of them are:
Server Access Applications (Back door application)
These applications will create a backdoor to log in to the hacked system without using the exploit again.
Log clearing Applications
These applications clear the logs of the events performed by the hacker or the applications used. They all the associated log files in the server.
Packet sniffing Applications
These applications monitor the data through the various interfaces in the server at particular ports.
Malicious Scripts
Many scripts will be installed like IRC bots, ddos daemons, spam servers, trojans, worms etc.
There are mainly two kinds of root kits. The application rootkit and the kernel rootkit.
Application rootkits
These rootkits mimic a particular application and will hide the attackers files/processes from being revealed by the original application. To illustrate, a rootkit ls application will perform all the task of a normal ls but will not display any of the files of the attacker. Other application rootkits will create backdoors for unauthorised access, packet sniffers etc which go undetected or are hidden by renaming. Application rootkits are the most common.
Kernel rootkits
Kernel rootkits modify the kernel and apply patches to the kernel and device drivers. They also hide the applications and files of the attacker. As antivirus and other applications run beneath the kernel, they are the most undetectable rootkits.
‘Prevention is better than cure’ – as this saying goes, it is always better to keep the system secure and updated when ever possible to stop these installations. There are some applications which help detect any known rootkits running in the system. One such is the chkrootkit.
chkrootkit is one of the popular rootkit detectors (an anti-rootkit) which are really helpful for server security experts and it is known to detect common rootkits on Unix/Linux servers. chkrootkit relies on basic string processing techniques to determine the presence of rootkits. It scans specific sytem files and binaries targeted by rootkits for known signatures.
The following are the instructions to install chkrootkit version 0.49 in a server.
cd /usr/local/ wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.md5 md5sum -c chkrootkit.md5 # to check if the downloaded file is intact tar -xzf chkrootkit.tar.gz cd chkrootkit-0.49/ make sense ./chkrootkit
chkroootkit will check all the files and display the status of the files analysed. This information may be logged for future reference. For this a cron job may be set up to be run at least once a month.
Inserting an entry like the one below into the systems cron tasks (executed at least once a month) will send the report of the chkrootkit vulnerabilities to the server security experts concerned.
/usr/local/chkrootkit-0.49/chkrootkit | mail -s "chkrootkit report $(date +%d/%m/%y)" "admin@domain.com"
