How would an attacker prevent another system user from viewing malicious files added to an existing Linux directory?

The correct answer is C. Replacing the Is command. Programs are often replaced by rootkits to hide an attacker's presence on the system. On a Linux system, files can be hidden by changing the Is command so it does not display the attacker's The ps command is used for processes. Stopping syslog won't have any affect on what…

Malware Analysis & Advanced Persistent Threats

Question

Options

ADeleting the find command
BStopping the syslog service
CReplacing the Is command
DRedirecting the ps command

How the community answered

(49 responses)

A
8% (4)
B
2% (1)
C
86% (42)
D
4% (2)

Explanation

Programs are often replaced by rootkits to hide an attacker's presence on the system. On a Linux system, files can be hidden by changing the Is command so it does not display the attacker's The ps command is used for processes. Stopping syslog won't have any affect on what files are displayed. Deleting find would not prevent the viewing of files as there are more common methods (e.g. the Is command).

Topics

#covering tracks#ls replacement#anti-forensics#rootkit technique

Community Discussion

No community discussion yet for this question.

Full GCIH Practice