Immunity, Inc. working on computer security research has released a DR Linux 2.6 rootkit (Debug Register Rootkit for Linux 2.6.x kernel), implementing a fundamentally new technique for hiding network sockets, files and malicious processes. The rootkit also provides the ability to remotely control, through a specially designed backdoor, working as a hidden user process.
')
In addition, child processes and sockets spawned by hidden programs are automatically hidden, while for such programs all the resources hidden by the rootkit are open. Installing DR Linux 2.6 is done by loading the kernel module.
Instead of the classic interception of processing system calls or the interrupt table (IDT), which are easily detected by utilities to analyze the system for hidden software, the DR Linux rootkit uses trace and debugging features in modern processors (IA32). DR gains control, through installation on system callbacks of hardware breakpoints (breakpoint), and on certain areas of kernel memory - traps (trap).
As a defense, the creators of Linux distributions are recommended to organize access control to the processor debug registers. Another method in detecting a rootkit is related to the possibility of analyzing the signs of loading a kernel module (in the next version of the rootkit, protection against this detection method will be implemented).
Source: https://habr.com/ru/post/39169/
All Articles