Comments for Stereo.lu

Comment on iPod nano in stockings by iPod touch microphone

iPod touch microphone — Tue, 01 Sep 2009 16:13:41 +0000

hahaha, good advertising if apple want do that for all products, lol.

Comment on Chkrootkit finds /lib/init/rw/.ramfs on debian etch by Laurent Raufaste

Laurent Raufaste — Fri, 28 Aug 2009 08:58:13 +0000

Thanks for the tip !

Comment on Chkrootkit finds /lib/init/rw/.ramfs on debian etch by Doug Peterson

Doug Peterson — Sat, 10 Jan 2009 13:24:45 +0000

Instead of:

-and -not -wholename /lib/init/rw/.ramfs

another alternative would be to use:

-and -not -empty

This would ignore any empty dot files. This will not ignore empty dot directories, like ones create by Java.

Comment on Chkrootkit finds /lib/init/rw/.ramfs on debian etch by sputnick

sputnick — Wed, 31 Dec 2008 00:16:58 +0000

Hi,

please, never parse “ls” in your scripts.

Take a look here: http://wooledge.org:8000/BashFAQ
and #bash on irc.freenode.org ;) ( ask “!ls” )

sputnick.

Comment on Chkrootkit finds /lib/init/rw/.ramfs on debian etch by Marc

Marc — Fri, 05 Dec 2008 11:28:18 +0000

I think this is a workaround. And from a security POV: There are tons of other possible filenames an attacker could use so chkrootkit would not notice.

Why should an attacker use ‘/lib/init/rw/.ramfs’ now if he could use ‘/etc/hosts’ for example?
Or ‘/lib/init/rw/myrootkitdata’?

Comment on Stereo.lu supports GreyTuesday.org by F

Thu, 30 Oct 2008 22:01:34 +0000

Merci pour The Grey Album !

Comment on Using iChat from Lancaster by Ann Burgess

Ann Burgess — Mon, 27 Oct 2008 20:34:40 +0000

I’ve just had my first video iChat with my daughter. The thing that stopped us before was that within the local network at Lancaster there are not enough IP addresses for everyone to have one. So when you use resnet you just get the next available IP address which will be different each time you use it. They rely on not everyone wanting to use internet at once.
When I try to invite my daughter to multimedia iChat my computer doesn’t know where to find her. If she, however, tries to contact me, chances are I’ll be on the same network address as before because I’m the only person using it at this location. I would have thought that would make chatting to mates at Lancaster using audio or video well-nigh impossible. But iChat text seems to work differently so that probably works (as does chat in dozens of other apps.). I wouldn’t have thought there would be much demand for audio chat - don’t you get internal ‘phone calls free anyway?

Anyway, that’s my understanding of the situation. I hope I’ve got it right!

Comment on Chkrootkit finds /lib/init/rw/.ramfs on debian etch by BjornW

BjornW — Thu, 28 Aug 2008 10:07:43 +0000

Hi there,

I stumbled upon your blog when I noticed these messages from chrootkit. I had a quick look at your patch and to me it seems a bit weird to hard code the ‘/lib/init/rw/.ramfs’. I can imagine that a root kit author would now use this as a rather convenient place to store its data and using your patch chrootkit would not notice this. Or did I not understand your patch correctly?

Comment on Chkrootkit finds /lib/init/rw/.ramfs on debian etch by tumblingmug

tumblingmug — Sat, 02 Aug 2008 08:32:51 +0000

I applied the patch. But this is of course a securtity issue. A rootkit could use this for a malicious file placement. So I added a /etc/cron.daily/chkramfs script with a line only:
test “$(ls -la /lib/init/rw/.ramfs | cut -d’ ‘ -f5)” != “0″ && echo ‘Alarm!!! File size of /lib/init/rw/.ramfs does not equal 0 Byte!!!!’

Thanks for the hint.

Comment on Stereo.lu supports GreyTuesday.org by syroy

syroy — Mon, 07 Jul 2008 19:14:21 +0000

Merci Guillaume pour le G.r.e.y. A.l.b.u.m., je le cherchais depuis longtemps. Bonne chance pour rester caché d’EMI et l’ASCAP le plus longtemps possible. Salutations du Québec.