From louissypher@atdot.org Sun Dec 19 13:48:07 1999 Received: from mxu4.u.washington.edu (mxu4.u.washington.edu [140.142.33.8]) by lists.u.washington.edu (8.9.3+UW99.09/8.9.3+UW99.09) with ESMTP id NAA18388 for ; Sun, 19 Dec 1999 13:48:06 -0800 Received: from dagda.sunflower.com (dagda.sunflower.com [24.124.0.1]) by mxu4.u.washington.edu (8.9.3+UW99.09/8.9.3+UW99.08) with ESMTP id NAA19876 for ; Sun, 19 Dec 1999 13:48:05 -0800 Received: from dv136s60.lawrence.ks.us (IDENT:admin@dv136s60.lawrence.ks.us [24.124.60.136]) by dagda.sunflower.com (8.9.1a/8.9.1) with SMTP id PAA07187 for ; Sun, 19 Dec 1999 15:48:14 -0600 (CST) From: "M. Osten" To: linux@u.washington.edu Subject: Re: Detecting rootkit installations: ark Date: Sun, 19 Dec 1999 15:48:23 -0600 X-Mailer: KMail [version 1.0.28] Content-Type: text/plain References: In-Reply-To: MIME-Version: 1.0 Message-Id: <99121915494801.01974@dv136s60.lawrence.ks.us> Content-Transfer-Encoding: 8bit > I am breaking a little with tradition, and attaching ark to this message - > it is only 2045 bytes. It was developed on a RedHat 6.0 linux system, but > modification for use on *any* unix system should be trivial. > > Suggestions for improvement are welcome... Um, we're talking about rootkits, and you want us to install a untrusted binary posted to a mailing list? -- ------------ Michael Osten .