Re: RootKits Under Linux



The majority of Linux rootkits check /dev/kmem for the address of the
interrupt descriptor table (IDT). This is a table for all the system
calls and their corresponding function pointers. Once you have this,
you can just overwrite the function pointer for any system call to
your own function. So for example you can write you own function for
getdents with is used to get file listings and hide files. Here are
some links with more information:

http://www.phrack.org/archives/59/p59-0x13
http://www.phrack.org/archives/63/p63-0x07_Games_With_Kernel_Memory_FreeBSD_Style.txt
http://reactor-core.org/linux-kernel-hacking.html

So what a lot of rootkit detectors do is just check the IDT for
inconsistencies. You can also compare the output to getdents (or just
ls) to a lower level function call that gets the directory listing.
If there are any differences there's a pretty good chance some file is
being hidden. Hopes this helps.

~John Geddes

On Feb 1, 2008 4:56 PM, Brandon Louder <Brandon.Louder@xxxxxxxxxxxx> wrote:
I can't answer your entire question but I can provide a good resource.

http://www.packetstormsecurity.org/UNIX/penetration/rootkits/

Packet Storm has A LOT of known rootkits listed there with descriptions
and links to other sites.

Another tool you might look into is Rootkit Hunter (rkhunter).

Good Luck!




-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Ahmed Zaki
Sent: Thursday, January 31, 2008 1:41 PM
To: focus-ids@xxxxxxxxxxxxxxxxx
Subject: RootKits Under Linux

Hi all

I am currently doing a project on rootkits under linux os. I am
specially interested in loadable kernel module rootkits. I wanted to
know
where does research stand now in terms of detecting such rootkits. It
would
be very helpful if you would be able to point me to resources where I
gain
information on the diverse variations of these rootkits and current
available methods of detecting them. Also if there are mechanisms that
can
be used to totally avoid detection that would be used by rootkits.



Regards

Zeeq


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaig
n=intro_sfw
to learn more.
------------------------------------------------------------------------


-----------------------------------------
Confidentiality Notice: This e-mail message, including any
attachments, is for the sole use of the intended recipient(s) and
may contain confidential and privileged information. Any
unauthorized review, use, disclosure, or distribution is
prohibited. If you are not the intended recipient, please contact
the sender by reply e-mail and destroy all copies of the original
message.




------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------



------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------



Relevant Pages

  • Re: OT: This sucks (virus/adware)
    ... Rootkits can't be eradicated and require a new image. ... I guess the old the adage you get what you pay for is not true: I paid nothing for linux and have no problems and other suckers paid hundreds for windows xp and have viruses run amock. ... The U.S. government estimates that Linux has approximately twice as many vulnerabilities as Windows. ...
    (rec.audio.opinion)
  • Re: OT: This sucks (virus/adware)
    ... Rootkits can't be eradicated and require a new image. ... I guess the old the adage you get what you pay for is not true: I paid nothing for linux and have no problems and other suckers paid hundreds for windows xp and have viruses run amock. ...
    (rec.audio.opinion)
  • Re: OT: This sucks (virus/adware)
    ... Rootkits can't be eradicated and require a new image. ... I use linux and never have to worry about these problems so basically I ... for windows xp and have viruses run amock. ... The U.S. government estimates that Linux has approximately twice as many ...
    (rec.audio.opinion)
  • Re: OT: This sucks (virus/adware)
    ... Rootkits can't be eradicated and require a new image. ... I use linux and never have to worry about these problems so basically I ... nothing for linux and have no problems and other suckers paid hundreds for ... windows xp and have viruses run amock. ...
    (rec.audio.opinion)
  • Re: Sony ?
    ... > bei Linux ein Problem und schon lange ist das "heilige Linux" kein ... dass rootkits die Pest sind und Sony sich damit ... Prev by Date: ... Next by Date: ...
    (de.rec.film.heimkino)