Comment Re:Nice libc hack (Score 1) 96
Since this is a ilbc hack, it would seem that docker would be a great way to detect this, since you can get a different libc.
Running: `docker run -P -it -v
gives you a root shell under a different libc with all of your filesystems mounted under
This is of course speculation since I assume I don't have the rootkit installed, but it seems pretty straightforward.