full-disclosure - Removing ShKit Root Kit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3FE89C58.9090308@umn.edu>
From: eckman at umn.edu (Brian Eckman)
Subject: Removing ShKit Root Kit

Jason wrote:
>>> OK, so how does the attacker get the ADS to run? If you open 
>>> something.txt in notepad, it doesn't launch the ADS 'trouble.exe' as 
>>> an executable file. It's ignored.
>>
> 
> The easy answer is start a command prompt and type
> 
> start something.txt:trouble.exe

You totally missed my point. If the hacker can run "start" anything on 
your system, it's game over anyway.

-- 
Brian Eckman
Security Analyst
OIT Security and Assurance
University of Minnesota


"There are 10 types of people in this world. Those who
understand binary and those who don't."