LINUX LKM PERSISTENCE

Summary from the TLDR InfoSec newsletter

This post discusses different methods to establish persistence with a Linux loadable kernel module type rootkit. Two simple methods that are briefly touched upon are to use a user space persistence mechanism that runs with root privileges to load the module or add the module to /etc/modules. Instead, this author explores using a systemd-modules-load file with the Diamorphine LKM rootkit which will hide any file that contains a given magic string from the kernel to hide the configuration file. The author then describes how timestamps or checking for a tainted kernel can be used to detect this attack.