LINUX KERNEL RUST MODULE FOR ROOTKIT DETECTION

Summary from the TLDR InfoSec newsletter

Linux rootkits commonly share a set of capabilities such as hiding itself, hiding data, offering a reverse root shell, and establishing boot persistence. The author of this blog post discusses how to use kprobe to detect LKM rootkit registration and inline hooking. They also reflect on the process of writing an LKM in Rust during their internship, noting the lack of abstractions but also appreciating the safety guarantees of Rust as well as the typing and linting systems.