| |||||||||||||
A new Adore root kitA new Adore root kitPosted Mar 24, 2004 6:38 UTC (Wed) by jzbiciak (✭ supporter ✭, #5246)In reply to: A new Adore root kit by xorbe Parent article: A new Adore root kit Won't it at least have to bind to the first port of the "knocking" sequence?
(Log in to post comments)
A new Adore root kit Posted Apr 3, 2004 0:30 UTC (Sat) by alterself (guest, #1746) [Link] The idea is not that you bind to the port... but that you log attempts to open the port.On a normal tcp/ip stack... the stack sends a request denied on attempts to open closed ports. I would imagine that if the module tied into the tcp/ip stack, it could monitor for attempts to open a specific set of ports...
|
|||||||||||||