Ubuntu – How do rootkits get installed on to a ubuntu server


I've seen a few posts on checking for rootkits but haven't been able to find any information on how they get onto a linux system. In particular if you exploit a bug in a php web site (yes I'm talking about drupageddon here) is it possible to install a rootkit even though you can only run as the web-server (www-data) and not as root. The very little information I've found about how these are installed suggests you have to be root to install them (see here).

Best Answer

If it was me I would persue the following method:

  • Get a user to download and install a piece of software (#1). Have that software install the intended software. Hide a binairy blob inside that application lets you download software (ie. a tool you can use to ftp, wget etc).
  • Prompt for the admin account (#2) and use that to use an ftp, wget instance to download and install the rootkit.

Regarding #1: a user should never download random software when using Linux; use the appropriate channels (Ubuntu Software Center) to install software. If it is software that needs to be downloaded outside the appropriate channels make sure the source of the download can be trusted. Think latest versions of Apache software or MySQL. Do not go around downloading random software without checking out different social media about the integrity of that application. Microsoft never centralized software; it resulted in lots of people dabbling with software so their user base is hugh, but that also made it easy to get into computers and start gathering data they can sell.

Regarding #2: fatal user flaw. Never ever ever ever type in your admin password unless you know why it is asked.