“This week’s episode: verifying the integrity of your
files.”
“One of the first things your cracker will do is replace
certain files on your system. You will wind up with a new
version of “netstat” so that a “netstat -a” does not show any
evidence of your cracker’s presence. The cracker will also replace
any file that might give him or her away.”
“Since the files have been replaced, simply doing an “ls” will
only confirm that the files are there. There are a number of ways
that you can detect modified files on your system.”