How to tell if your Linux box has been cracked

[Phat_Penguin]

Found an interesting article the other day. I could not find if this had been posted before (and I apologise if it has) but I thought I would bring it to the attention of people here, it is especially helpful for Linux newbies interested in the security of their machines.

The article deals with finding out if you have a trojaned process (in this case ps) and how to detect if a cracker has gained access to your Linux Box. The site also contains other interesting security related links worth a look.

How to tell if your Linux Box has been cracked

I hope someone finds the information useful.

[the_JinX]

nice post..

thx ! !

most of it was known, but a good read non-the-less..

[prodikal]

since im a linux n00bie im looking for all the info i can get on it just now thanks for the link phatpenguin

[detoxsmurf]

Good link. One thing I've noticed playing around with lrk4 rootkit is unusual behavior of the trojanized telnet binary.

A regular telnet login will look like this
login:

As with lrk4 the login will look like this
eve login:

Also when you have an incorrect login on a regular telnet server it will show you
login incorrect.

In the lrk4 rootkit it will show you the message
root login refused on this terminal.

Nate