Package: unhide (20121229-1 and others)

[ Source: unhide  ]

Forensic tool to find hidden processes and ports

Unhide is a forensic tool to find processes and TCP/UDP ports hidden by rootkits, Linux kernel modules or by other techniques. It includes two utilities: unhide and unhide-tcp.

unhide detects hidden processes using the following six techniques:

  * Compare /proc vs /bin/ps output
  * Compare info gathered from /bin/ps with info gathered by walking thru the
    procfs.
  * Compare info gathered from /bin/ps with info gathered from syscalls
    (syscall scanning).
  * Full PIDs space occupation (PIDs bruteforcing)
  * Reverse search, verify that all thread seen by ps are also seen by the
    kernel (/bin/ps output vs /proc, procfs walking and syscall)
  * Quick compare /proc, procfs walking and syscall vs /bin/ps output

unhide-tcp identifies TCP/UDP ports that are listening but are not listed in /bin/netstat through brute forcing of all TCP/UDP ports available.

This package can be used by rkhunter in its daily scans.

Tags: Implemented in: C, User Interface: Command Line, Role: role::program, scope::utility, Security: Forensics, Intrusion Detection

Other Packages Related to unhide

• sug: rkhunter

  rootkit, backdoor, sniffer and exploit scanner

Download unhide

Download for all available architectures

Architecture	Version	Package Size	Installed Size	Files
alpha (unofficial port)	20121229-1	1,314.4 kB	2,851.0 kB	[list of files]
amd64	20121229-1	1,231.8 kB	2,974.0 kB	[list of files]
armel	20121229-1	1,013.0 kB	2,131.0 kB	[list of files]
armhf	20121229-1	941.3 kB	1,629.0 kB	[list of files]
hppa (unofficial port)	20100201-1	860.4 kB	1,788.0 kB	[list of files]
i386	20121229-1	1,067.1 kB	2,264.0 kB	[list of files]
ia64	20121229-1	1,749.1 kB	4,855.0 kB	[list of files]
m68k (unofficial port)	20121229-1	952.5 kB	1,984.0 kB	[list of files]
mips	20121229-1	1,160.8 kB	2,773.0 kB	[list of files]
mipsel	20121229-1	1,153.3 kB	2,774.0 kB	[list of files]
powerpc	20121229-1	1,182.5 kB	2,538.0 kB	[list of files]
powerpcspe (unofficial port)	20121229-1	1,170.7 kB	2,408.0 kB	[list of files]
s390	20121229-1	1,157.2 kB	2,412.0 kB	[list of files]
s390x	20121229-1	1,191.3 kB	2,734.0 kB	[list of files]
sh4 (unofficial port)	20121229-1	1,188.5 kB	2,359.0 kB	[list of files]
sparc	20121229-1	1,149.7 kB	2,505.0 kB	[list of files]
sparc64 (unofficial port)	20121229-1	1,129.6 kB	2,422.0 kB	[list of files]