Linux Rootkits Part 4: Backdooring PRNGs by Interfering with Char Devices

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

We saw in Part 3 how easy it is to add some extra functionality to a syscall. This time we’re going to target a pair of kernel functions that are not syscalls, and can’t be called directly. To understand what these are, it’s worth discussing char devices a little first. Char Devices in Linux Although you might not recognise the name, you’re probably already pretty familiar…

Read on /posts/linux_rootkits_04/ ↗