RSSAmplifier

TheXcellerator · Oct 1, 2020

Linux Rootkits Part 7: Hiding Processes

0
Sign in to vote or save

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

Now that we know how to hide directories (see last time), we can also hide processes! This is because nearly all userspace tools that give us information about processes just read the contents of the /proc/ filesystem. We can check this by looking at the output of strace -e openat ps or strace -e openat top. So, if we hide directories with the name of the PID we want to keep secret, then these…

Read on /posts/linux_rootkits_07/

Comments

Nothing yet. Say the first thing.

    Sign in to join the conversation.