Professional Documents
Culture Documents
Kernel-Land Rootkits
Kernel-Land Rootkits
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
Kernel-Land Rootkits
For Linux 2.6 over x86
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
Agenda
Rootkits In Brief
Why This Presentation? (or How It All Started...)
Hooking System Calls In Linux 2.6
Meeting Our Enemy/Friend (whose side are you on,
anyway?)
Meeting Our Friend/Enemy
<Insert Surprise Here>
References
Kudos
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
Captain Hook
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
Surprise!
3j33t t3qn33kq5
Raising The Bar For
Rootkit Detection
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
Suprise! (2)
No source code will be available
Exposing the concepts is disclosure enough
We have 1 case study
Counter-measures will be proposed for discussion
when possible
On to the show...
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
References
[1] Sony Rootkit:
http://blogs.technet.com/markrussinovich/archive/2005/10/31/sony-rootkitsand-digital-rights-management-gone-too-far.aspx
www.blackhat.com/presentations/bh-usa-06/BH-US-06-
Rutkowska.pdf
http://www.ngssoftware.com/research/papers/Implementing_And_Detecting_
A_PCI_Rootkit.pdf
http://packetstormsecurity.org/docs/hack/LKM_HACKING.html
http://packetstormsecurity.org/UNIX/penetration/rootkits/
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
References (2)
[7] SIDT trick (SuckIT article):
http://www.phrack.org/archives/58/p58-0x07
[11] libdisasm:
www.rfdslabs.com.br
http://bastard.sourceforge.net/libdisasm.html
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
Kudos
To H2HC III organization staff (special thx for flying me here
)
To my friends @ rfdslabs and gotfault
To BSDaemon, for some ideas, insights and his Defcon
presentation
To the co-founder of the Golden Monkey Gods Appreciation
And Praise Church, for co-founding the Golden Monkey Gods
Appreciation And Praise Church
fr33(vUg0);
53gm3nt4t1on f4ul7
To sandimas, for discussing hacking with me uncountable
times
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
Questions?
www.rfdslabs.com.br
rfdslabs
110100101001110111101010010011011101001001001010
100101101001001000100101001001000010010010000100
001101111000111010011101110110010010010001001101
111101001110000110100101100110110010011101011010
111101001101100100100010011100101101001110101010
110100110010010011100100100100011101001110111011
001101111000111010011101110110010010010001001101
Kernel-Land Rootkits
For Linux 2.6 over x86
www.rfdslabs.com.br