TABLE OF CONTENTS Root kits
Brute force entry attacks and intrusion detection systems
Intrusion prevention systems
Buffer overflow attacks
The goal of a system cracker often is to gain access to a system, not only once, but repeatedly. If at all possible, the cracker wants to secure root (or administrator) access so that he or she can do just about anything with the system. Perhaps the cracker wants to read or copy files; perhaps the hacker wants to install software that will cause the compromised system to take part in a distributed attack on another computer. Whatever the reason, the cracker wants to establish root access, leave behind whatever is necessary to gain access again, and then exit without being detected.
The software a cracker leaves behind is known as a root kit, a collection of programs that allow the cracker to access the system at any desired time and gain root or administrator privileges. In this chapter we will begin by looking at root kits what they are, where they come from, and how you can detect them and then consider how root kits might be installed on your system in the first place and what you can do to thwart such attacks.
Root kits have been around since at least the early 1990s. Commonly they let a hacker
Enter a system at any time.
Open ports on the computer.
Install software on the system.
Run any...
