Hello guys. There weekend iv recieved 2 alerts from a busy server about hidden ports, both high ports. In that server i have oracle xe, but it shows the ports in netstat. We had checked absolutly everything and it doesnt look bad, so, i must asume that those where false possitives... Daniel, can you put some ligth in this mistery? Can you explain how the rootkit detector works?, i mean, the internals, i will give the source code a try, but human words can help :) Thanks! Cheers! -- Nicolas Arias Security Officer +54 11 4109 1885 +54 9 11 5455 0055 nicolas.arias@xxxxxxxxxxx
Attachment:
signature.asc
Description: This is a digitally signed message part