New Attack Sneaks Rootkits Into Linux Kernel
April 15, 2009 – 4:48 AMKernel rootkits are tough enough to detect, but now a researcher has demonstrated an even sneakier method of hacking Linux.
The attack attack exploits an oft-forgotten function in Linux versions 2.4 and above in order to quietly insert a rootkit into the operating system kernel as a way to hide malware processes, hijack system calls, and open remote backdoors into the machine, for instance. At Black Hat Europe this week in Amsterdam, Anthony Lineberry, senior software engineer for Flexilis, will demonstrate how to hack the Linux kernel by exploiting the driver interface to physically addressable memory in Linux, called /dev/mem.
“One of bonuses of this [approach] is that most kernel module rootkits make a lot noise when they are inserting [the code]. This one is directly manipulating” the memory, so it’s less noticeable, he says.
The /dev/mem “device” can be opened like a file, and you can read and write to it like a text file, Lineberry says. It’s normally used for debugging the kernel, for instance.
Lineberry has developed a proof-of-concept attack that reads and writes to kernel memory as well as stores code inside the kernel, and he plans to release a framework at Black Hat that lets you use /dev/mem to “implement rootkit-like behaviors,” he says.
The idea of abusing /dev/mem to hack the Linux kernel is not really new, he says. But the rootkit connection is a new spin on it: “People have known what you can do with these /dev/mem devices, but I have never seen any rootkits with dev/mem before.”
You must be logged in to post a comment.