0

Today I installed Ubuntu 18.10 and ran rkhunter on it. At first it said that there are 4 possible rootkits, but after second check it detected 7. During checking there was everything green and ok, except one warning:

 Checking for suspicious (large) shared memory segments        [ Warning ]

But I don't think that this would cause rkhunter's suspicion that there are some rootkits, would it? Or is it possible that I really got any rootkit even though there was no red "found" at any of those "known rootkits" check?

There is the output from the last check:

System checks summary
=====================

File properties checks...
    Files checked: 149
    Suspect files: 0

Rootkit checks...
    Rootkits checked : 479
    Possible rootkits: 7

Applications checks...
    All checks skipped

Any ideas?


Edit: I tried to install Fedora instead of Ubuntu and everything seems fine, even that warning is no longer here. So maybe Fedora somehow fixed that warning, thus rkhunter doesn't think that there is any danger whatsoever, not sure.

0

" Or is it possible that I really got any rootkit even though there was no red "found" at any of those "known rootkits" check?"

Yes, there are many unknown rootkits...

If it was a clean install from a verified source CD/DVD I would research firmware rootkits.

Good luck mate.

3
  • Is there any utility like rkhunter for detecting firmware rootkits? I've searched but haven't found anything. – expl0it.py Jan 5 '19 at 20:08
  • I don't know any utility for detecting firmware rootkits also the information about it is almost non-existent. I would search in DEFCON Conference youtube videos. – John Doe Jan 6 '19 at 8:57
  • Also visit media.ccc.de/search/?q=rootkit – John Doe Jan 6 '19 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.