I found this small rootkit source code implemented as a Linux kernel module.


Basically, as you can see, it changes the file_operations structure from the file inode and overwrite the readdir function to hide itself from ls and lsmod.

In that case, how would be possible to detect this rootkit?

migrated from security.stackexchange.com Feb 16 '16 at 15:29

This question came from our site for information security professionals.

  • 1
    Run a pattern match for that code snippet? I'm not sure what you are asking. Detect before it infects or after? – schroeder Feb 15 '16 at 20:22
  • After infected. Pattern match would not work, since it's impossible to find the file using simple commands like cat, ls, grep, etc. – rootkit_newbie Feb 15 '16 at 22:55
  • Btw, I know that mounting the hard drive using another trusted machine would not load the module, and then it would be possible to find the module file. But why I would do this without a good reason (suspect)? I was wondering if I could check (somewhere) in memory for some kernel module code "without" a correspondent lsmod module file. – rootkit_newbie Feb 15 '16 at 22:59
  • 1
    so, you don't necessarily want to detect the rootkit, but this one setting - you might get great answers on the unix/linux SE site – schroeder Feb 15 '16 at 23:04
  • Rootkit - if you want, @schroeder can move it to that site, he has magical powers here. Just ask him if you're interested – Neil Smithline Feb 16 '16 at 1:49

View proc/kallsyms. It contains most of the kernel symbols and is updated dynamically as LKMs are added.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy