The Mysteriously Persistently Exploitable Program

This week, we'll take a look at a successful and somewhat puzzling machine compromise. The machine in question was a production machine that had been up and running for about a year - one of those machines that had so much on it that you're afraid to ever reboot it, lest something not come back up.

Monitoring File or Directory Changes

Many modern systems provide a way to watch a directory for events (new files, reading the directory, modification of a file in the directory, etc.). This facility can be done in various ways, from providing hooks in the filesystem code itself to something that watches for inode changes. Linux and BSD have several possibilities in that regard, including dnotify, changedfiles, and watch.