📜 ⬆️ ⬇️

DR Linux 2.6 - a fundamentally new type of rootkit

Yesterday, there was news about a new rootkit for Linux that implements hardware interception of the OS control. It is strange that so far the community has not highlighted this fact. I think that this event will interest many. For those who do not like to follow the links below I cite the full text of the news.

Learn how it is possible

Immunity, Inc. working on computer security research has released a DR Linux 2.6 rootkit (Debug Register Rootkit for Linux 2.6.x kernel), implementing a fundamentally new technique for hiding network sockets, files and malicious processes. The rootkit also provides the ability to remotely control, through a specially designed backdoor, working as a hidden user process.
')
In addition, child processes and sockets spawned by hidden programs are automatically hidden, while for such programs all the resources hidden by the rootkit are open. Installing DR Linux 2.6 is done by loading the kernel module.

Instead of the classic interception of processing system calls or the interrupt table (IDT), which are easily detected by utilities to analyze the system for hidden software, the DR Linux rootkit uses trace and debugging features in modern processors (IA32). DR gains control, through installation on system callbacks of hardware breakpoints (breakpoint), and on certain areas of kernel memory - traps (trap).

As a defense, the creators of Linux distributions are recommended to organize access control to the processor debug registers. Another method in detecting a rootkit is related to the possibility of analyzing the signs of loading a kernel module (in the next version of the rootkit, protection against this detection method will be implemented).


Once again, this is a crosspost news from here .
Here you can download DR Linux 2.6 .
Original application.

In turn, I would like to ask specialists: is there any reason to fear the emergence of similar products for other operating systems: BSD-families and Windows?

Source: https://habr.com/ru/post/39169/


All Articles