Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S263232AbUCNApJ (ORCPT ); Sat, 13 Mar 2004 19:45:09 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S263233AbUCNApJ (ORCPT ); Sat, 13 Mar 2004 19:45:09 -0500 Received: from twin.jikos.cz ([213.151.79.26]:61906 "EHLO twin.jikos.cz") by vger.kernel.org with ESMTP id S263232AbUCNApF (ORCPT ); Sat, 13 Mar 2004 19:45:05 -0500 Date: Sun, 14 Mar 2004 01:44:51 +0100 (CET) From: Jirka Kosina To: Dave Jones cc: pg smith , linux-kernel@vger.kernel.org Subject: Re: LKM rootkits in 2.6.x In-Reply-To: <20040311184835.GA21330@redhat.com> Message-ID: References: <20040311184835.GA21330@redhat.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1178 Lines: 25 On Thu, 11 Mar 2004, Dave Jones wrote: > > Any thoughts on the future of LKM rootkits in the 2.6 kernel branch ? In > > the last few years I've become quite interested in them (from a defensive > > point of view), but with the 2.6 kernel no longer exporting the syscall > > table, intercepting system calls would appear to be a non-starter now. > Don't bet on it. They'll just start doing what binary-only driver vendors > have been doing for months.. If the table isn't exported, they find a symbol > that is exported, and grovel around in memory near there until they find > something that looks like it, and patch accordingly. Why bother .. just find any symbol (function name) which is exported to modules and also being frequently called somehow indirectly from userland (VFS layer functions, vm functions, ...) and use this function as an open-backdoor spell. It is easy to patch existing rootkits this way. -- JiKos. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/