Difference between revisions of "OpenChaos/Malware Linux"

From C4 Wiki
Jump to: navigation, search
(added category)
Line 34: Line 34:

Revision as of 00:14, 5 November 2004

Folien unter http://www.mmweg.rwth-aachen.de/~thorsten.holz/summerschool/malware-unix.pdf

runtime kernel patching

  • /dev/kmem - raw i/o capability needed from kernel
  • kmalloc fuer rootkit code
  • suckit aendert pointer auf syscall in der IDT

hide modules by

  • delete module from module list (adore) by changing syscall table
  • modify vfs (adore-ng)
  • parasitic module infection (adore-ng optional), changes the module file
  • runtime-kernel patching (suckit) (copy der syscall table ...idt)
  • static kernel patching - im kernel image code ablegen


  • baut sk_buff struct und schickt sie an device


  • ELF header infection
  • RST.B Virus

rootkit hunter

  • chkrootkit
  • tiger


  • grsec, trusted path execution, benutzer koennen keine programme ausfuehren die sie schreiben koennen

Antivirus Virus Linux

  • f-prot
  • clamav
  • hb-antivir