Identifying these can aid, for example, in detecting the creation of files in user home directories that can be later used for backdoor access. Improperly set access control lists on system tools may indicate that an intruder has located and executed security tools that were installed by the authorized system administrator. These may signify that a file or service has been replaced with the intruder's version including the installation of a Trojan horse or backdoor. An intruder inadvertently enabling debugging can easily quadruple the size of a file. These can reveal the presence of sniffer logs or pro- grams.
Sniffers are able to capture user keystrokes containing host, account, and password information.
In general, the techniques described above will not be useful in distinguishing normal changes to these file types from those that might have been caused by intruders. Techniques based on transaction auditing are more useful in these cases. Detecting changes in files and directories with native tools on Solaris 2.X Footnotes Intruder actions of this type can be accomplished using tools that are part of rootkit. Copyright 2000 Carnegie Mellon University. See the conditions for use, disclaimers, and copyright information.