An Ld_preload Toy Rootkit

If you are not interested in malware development for Linux and have not read some of my previous blog posts, this blog post may be too technical for you. You could rather start here In this blog post, I want to present a toy LD_PRELOAD rootkit. It works by hijacking the dynamic linker and thus hiding itself from the system. Later, we will talk about how to detect it. Preliminaries Usually, when an…