Introduction to the prevention of rootkit attacks on the Solaris Server

The term rootkit has existed for more than 10 years. It is a toolkit consisting of useful small programs, allowing attackers to maintain "root" access to the user with the highest permissions on the computer ". In other words, rootkit is a group of programs and code that can persist, reliably, and cannot be detected on a computer. In the above rootkit definition, the keyword is "unable to detect ". Most rootkit technologies and.
All tips are used to hide code and data on a computer. For example, many rootkits can hide files and directories. Other features of rootkit are usually used for remote access and eavesdropping-for example, to sniff packets on the network. When these features are combined, they bring a devastating impact to safety.

To gain control of a host, the simplest of course is to attempt to log on by using a login program (such as login, ssh, telnet, etc.) and a program that guesses the password. However, because most login programs have a limit on the number of logins, it is not so popular to use password guesses. For the sake of system network security, Senior hackers write programs to Test Service vulnerabilities on their hosts. After detecting vulnerabilities in some services, they will report the maintenance groups of the services, or contribute your own repair methods to supplement the security of your system. After receiving such a notification, the Service Development/maintenance team will modify the program in the shortest time and notify and release the patch for the vulnerability on the Internet.