Re: LKM rootkits in 2.6.x

[Dave Jones]

On Thu, Mar 11, 2004 at 11:26:23AM -0800, pg smith wrote:
 > Any thoughts on the future of LKM rootkits in the 2.6 kernel branch ? In
 > the last few years I've become quite interested in them (from a defensive
 > point of view), but with the 2.6 kernel no longer exporting the syscall
 > table, intercepting system calls would appear to be a non-starter now.

Don't bet on it.  They'll just start doing what binary-only driver vendors
have been doing for months.. If the table isn't exported, they find a symbol
that is exported, and grovel around in memory near there until they find
something that looks like it, and patch accordingly.

		Dave

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/