Linux Rootkits Part 5: Hiding Kernel Modules from Userspace

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

So far, we’ve seen how hooking both syscalls and regular functions can be put to good use. But, seeing as how this is a series on rootkits, we should really be making some considerations on stealth. If you’ve been following along, then once you’d loaded any of the previous rootkits, it’s presence would have been revealed by simply examining the output of lsmod. $ lsmod |…

Read on /posts/linux_rootkits_05/ ↗