/etc/inittab - The Most Overlooked Cracker Haven
Crackers can cause their software to be run by adding entries to /etc/inittab, a file frequently missed by administrators.
I told folks to discount any change which required kernel modifications. A change to the MBR probably doesn't qualify in that regard, but it would certainly seem out of scope nonetheless. Similarly, a change to the bootloader or initrd ram disk fall under kernel changes to some degree, and thus weren't the correct answer, based on my phrasing.
Many folks suggested that it was root's .bashrc, or global /etc/profile and similar files that was the culprit. By logging in, root's shell would execute commands that were hidden in those files. That's definately a possibility, but the fact that moniker had PID 15 meant that it had to have started before root logged in, so that's not the culprit.
[ Read more ]
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.