OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[Full-disclosure] fs rootkit performance footprint [was Re: "IO wait chains" in Linux??]

From: coderman (codermangmail.com)
Date: Mon Feb 07 2011 - 19:00:44 CST


On Mon, Feb 7, 2011 at 4:49 PM, coderman <codermangmail.com> wrote:
> ...general idiom is
> setup measurement and load injection, then executive to define peak /
> best capacity configuration.
> ...
> oprofile / kprobes /sysprof help with measurement rather than load injection.

interestingly, memory backed file system performance benchmarks
exhibit a distinct performance degredation depending on the type of
kernel mode rootkit hooking implemented on a compromised host. a poor
rootkit revealer, but surprisingly effective. a good exercise for
reader...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/