31–39 of 39 posts
Earlier quoted context omitted.
on the other hand, it makes for an interesting rootkit hook.
Which is more dangerous than all the others things you can do as root - like inserting an arbitrary kernel module - how?
[deleted]
Thinking this guy is a 'Ruby person' and branding him as one to try and make some point is just not even wrong. It's completely besides anything near reality. Check out some of his others posts before climbing on your favorite hobbyhorse. He is as much a C programmer as you are.
There is no one language, toolkit or framework.
Plus this guy has some other very nifty articles.
But I guess (glancing at first few comments) that "haterz gonna hate."
Hook root when a process crashes? How long until an exploit?
If you have the ability to modify or create files in /proc you almost certainly already control the system.
Disclosure: I work on the unrEVOked rooting tool for android and we do stuff like this all the time.
Earlier quoted context omitted.
on the other hand, it makes for an interesting rootkit hook.
Which is more dangerous than all the others things you can do as root - like inserting an arbitrary kernel module - how?
it's not a very good rootkit by itself, certainly, as typically rootkits will monkey with the kernel to hide processes and network sockets.
it's interesting because it's probably the simplest rootkit method i can think of (next to setuid binaries). it's less obvious than a setuid. it's not something that anyone sane would use by itself because like i said--it doesn't hide you.