Local root exploit in NVidia driver

Posted Oct 17, 2006 9:19 UTC (Tue) by job (guest, #670)
In reply to: Local root exploit in NVidia driver by rsidd
Parent article: Local root exploit in NVidia driver

There is also the issue of detection. It's a lot harder to detect a rootkit than some spyware or a keysniffer running as the local user. Of course, you data could still be toast, but botnets and spyware are so much more common these days.

Local root exploit in NVidia driver

Posted Oct 17, 2006 10:15 UTC (Tue) by drag (guest, #31333) [Link]

Yes exactly.

It's trivial to 'comprimise' a user account by tricking them to run a malicious program. A Linux virus is rare, but it's not difficult to make and easy to embed into existing binaries.

Even a simple bash script can nail a user.

However it's easy to recover from something like that. You just log in as root and bingo! you can find and delete the programs very easily. Nothing is safe from root.

If push comes to shove:
rm -rf /home/luser
will do nicely.

However if you add on top of that a local root exploit... Then all of a sudden the best course of action to recover the machine is to format and reinstall.

And I am dead serious about it. It's possible to find a uninstall a root kit, but it's not possible to know everything they did to your computer. It's not worth the time and hassle it would take to clean out a machine. Format and reinstall is the best answer to a compromised machine with a local root hole.