Kernel rootkits and countermeasures

The Spy Within

Article from Issue 147/2013

Author(s): Jürgen Quade

Rootkits allow attackers to take complete control of a computer. We describe the tricks intruders use to gain access to the Linux kernel and provide guidelines on hardening the kernel against such attacks.

In response to a question asked in parliament, the German Federal Government responded in May 2012 that it was able to decrypt PGP messages or SSH connections, at least partially. Experts were exasperated when they heard this. No one seriously believed that PGP encryption had been cracked. More likely, data is sniffed before encryption or after decryption, or the secret service possesses the private key and, possibly, the associated password. Germany’s “Federal Trojan” can infiltrate the kernel as a rootkit for this purpose.

Classically, the term “rootkit” refers to a piece of software that gives an attacker camouflaged access to, and thus control over, a machine. Userland rootkits tend to modify applications to do this. In comparison, the much more powerful kernel rootkits change kernel data structures and code – for example, through system call hijacking.

Buy this article as PDF

Express-Checkout as PDF

Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES

SUBSCRIPTIONS

Print Subs

Digisubs

TABLET & SMARTPHONE APPS

US / Canada

UK / Australia

Related content

How to Write a Rootkit

Today’s rootkits infiltrate a target system at kernel level, thus escaping unwanted attention from administrators. Read on for a practical look at how a kernel rootkit really works.

more »
Security Lessons

We look at the history of the rootkit, including its newest incarnation, the DR RootKit.

more »
Rootkits and Linux Security

Your Linux system may not be so airtight after all. To understand the threats, you need to think like an intruder. We'll show you what the intruders are thinking now about the Linux 2.6 kernel.

more »
Virtualizing Rootkits

A new generation of rootkits avoids detection by virtualizing the compromised system – and the user doesn't notice a thing.

more »
HookSafe Protects Kernel from Rootkits

A research group in the computer sciences faculty at North Carolina State University has written a prototype to prevent rootkits from manipulating kernel object hooks to do their damage.

more »

comments powered by Disqus

Visit Our Shop

Trial Subscription

Digital Subscription

Subscribe

Direct Download

Read full article as PDF:

Price $2.95

News

Nextcloud Announces Raspberry Pi-Powered Home Cloud Box

Innovative system adds a hard drive and Ubuntu Core to the RPi for an IoT hub.
Linus Torvalds Confirms the Date of the First Linux Release

Linux is two weeks younger than we thought!
End of OpenOffice?

OpenOffice

The Apache Software Foundation considers retiring OpenOffice
Adobe Gives New Life to NPAPI Plugin for Linux

Adobe Flash , Flash Player

Adobe won’t kill the plugin in 2017
LinuxCon North America Convenes in Toronto, Canada

Linux Foundation's big event celebrates the 25th anniversary of Linux
Linux Turns 25

Linux has evolved from “won’t be a professional” project to one of the most professional software projects in the history of computers.
Mirantis Joins Hands with SUSE To Offer RHEL Support; Red Hat Not Happy

Competitors get in the game with RHEL without Red Hat
Linux on Windows 10 Poses a Security Risk

Security researchers have already notified Microsoft; some fixes are available
Mirantis to Refactor OpenStack Fuel for Kubernetes

The company is collaborating with Google and Intel to use Kubernetes as an engine for Fuel
Canonical Joins Document Foundation Advisory Board

The upcoming release of LibreOffice will be available as a snap package