Hacker News Reader

This kind of thing is trivially detected with basic system integrity tools [0][1] but I think a lot of those kinds of sysadmin tools have gone out of vogue at this point.

[0] https://access.redhat.com/documentation/en-us/red_hat_enterp...

[1] https://www.redhat.com/sysadmin/security-monitoring-tripwire

View on HN

rkhunter and samhain are two other similar tools. Both are available in the regular Debian repositories.

rkhunter is nothing but a false sense of security. The detection mechanisms are crude and trivially bypassed. Have a read of the code for yourself.

Yes, it's very simplistic. It does not claim otherwise.

However, it did manage to detect a rootkit on one of my system once (many years ago, when I used to phpMyAdmin, which had some kind of RCE). So it's better than nothing, and it would probably have detected the backdoor from the article (which does not even attempt to hide itself).

Reply on news.ycombinator.com