Hacker News Reader

Comment by from-nibly | Hacker News Reader

This sounds like a food youtuber trying to explain how easy cooking a Turkey is. Yeah sure in a vaccum maybe, but I don't spend all day cooking food. Ive got other stuff to do.

Maybe its easy to find rootkits if you know what you are doing and use a statically compiled tcpdump. Do you know how many times I've done a TCP dump on my computer to check for root kits statically compiled or not? 0. I don't spend my time doing that. All it has to do is use less CPU and RAM than my corporate anti virus already does ( which is a lot ) and I'm never going to find it, cause im never gonna look.

View on HN

Agreed that it still seems decently hard to find if you aren't looking for it. Though the tone of the blog post made a lot more sense to me when I saw the over-top-top title of the article[0] it's responding to: 'Analysis of a New, Nearly-Impossible-to-Detect Linux Threat':

[0] https://intezer.com/blog/research/new-linux-threat-symbiote/

In retrospect I really should have included the title with the link.

The target here is not a random YouTube watcher though. If you're doing actual rootkit hunting, you're in a larger org with lots of other indicators in place. You'll have DNS and traffic logs (hopefully), some local agents, maybe managed devices.

You're not going to find rootkits randomly by deciding to check with tcpdump. You're looking for them in the first place, because they tripped some other detector. That's a big prerequisite.

Yeah but this is more from the perspective of a blue teamer, someone actively looking for/protecting against malware or performing forensics. If you're not in that position, just have some good AV and don't do anything that might make you a target.

> don't do anything that might make you a target.

Like "don't get connected to the Internet"? That's a tall order.

You may not have noticed, everyone is on the internet. From the penthouses in new york to small villages in the savannah. Just being connected to the internet isn't noteworthy or targeted.

Being targeted by an adversary is not the same as being hit by random drive-by attacks hitting every IP in the relatively limited IPv4 address space.

That is what the antivirus is for. If you are not a high value target, then your risk is virus that are being widely distributed; and those will quickly find their way into an AV database.

If you are a high value target, AV is useless, since the attackers you care about will target you with bespoke mallare, that will not be in an AV database.

Cooking turkey in a vacuum… sous vide is your idea of easy? Props, dude!

Put meat in bag, put bag in water, receive protein?

A turkey might be hard by size, but sous vide is basically the easy-bake of cooking, takes no effort or creativity during the cook and you can only really impact it before and after.

Reply on news.ycombinator.com