Re: Kernel Rootkits

Andre Tomt
2005-04-15T19:20:04Z

Lennart Sorensen wrote:
> Well you could build a monilithic kernel with module loading turned off
> entirely, but that doesn't prevent replacing libc which most programs
> use to make those system calls.

As pointed out elsewhere, modules is not the only way to load kernel
code live. Modules is just a cleaner interface for it. Rootkits capable
of loading their kernel code without involving the module system has
existed for ages.

> Could make the filesystem readonly,
> that would prevent writing a module to load into the kernel, and
> replacing libc as long as you make it imposible to remount the
> filesystem at all.

Don't hold your breath - code can be inserted without involving actual
files. It just makes things less persistent.

--
Cheers,
André Tomt