Computer security 101 - rootkit introduction based on linux. In the 102 I need to introduce the kernel-based rootkit in linux, if possible.

1. Rootkit 101 - 2nd Edition
cmj @ 2015
1

2. > rootkit
rootkit is a stealthy type of software, typically malicious,
designed to hide some running processes / files / network
connections
2

3. Tamper and Hide
3

4. Simple Rootkit Design - lv1
• You can cheat the user
• Replace the command used to get resource status
• ls / ps / top / …etc
• You DID NOT exactly tamper the tool, only cheat the user
4

5. Cheat ls
5

6. Simple Rootkit Design - lv2
• Replace the tool used to get the resource
• A wrapper of the original tool
• Rebuild the tool
• … etc
6

7. Replacement
7

8. • All of the previous tool are reply the unusual response
• Color / syntax missing
• Layout not match
• … etc
• We NEED to keep mysterious and unknown
8

9. Useful Rootkit Design - lv3
• Understand how ls work - ls will call …
• opendir
• readdir
• … etc
• You can trace by strace / dtruss / …etc
9

10. Shared Library Hook
using LD_PRELOAD
10

11. LD_PRELOAD Hook
11

12. But still can find the clue on the system
• The extra library on configure / environment
• Still can find out the file / folder
If I direct using dlopen / dlsym like the rootkit do …
12

13. Robust Rootkit design - lv4
• Tamper from the kernel-level
• Directly replace the response as deeper as possible
• You will never find the rootkit if the response comes
from rootkit
13

14. 朕不給，你不能搶 ∼
14

15. cmj
NEVER know the kernel programming XD
15

16. Concept
1. Hijack the syscall table
2. Hijack the response function
3. Hijack the data in kernel
4. … etc
16

17. Thanks for your attention ~
17