检索
E-mail
RSS
作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2010, Vol. 36 ›› Issue (8): 161-162.doi: 10.3969/j.issn.1000-3428.2010.08.056

• 安全技术 • 上一篇    下一篇

Linux下VFS层Rootkit技术研究

丁 滟，富弘毅，李宇卓   

  1. (国防科技大学计算机学院，长沙 410073)
  • 收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2010-04-20 发布日期:2010-04-20

Research on VFS Layer Rootkit Technique in Linux

DING Yan, FU Hong-yi, LI Yu-zhuo   

  1. (School of Computer, National University of Defence Technology, Changsha 410073)
  • Received:1900-01-01 Revised:1900-01-01 Online:2010-04-20 Published:2010-04-20

PDF

2308

被引次数

10 | 1

摘要： Linux下VFS层rootkit隐藏层次深，查杀难度大。其典型应用adore-ng在实际使用时无法屏蔽卡巴斯基等实时监控软件，破坏隐蔽效果。针对该问题，运用系统调用修改和VFS写函数内容过滤2种方法，设计并实现了相应的改进方案。仿真实验结果表明，该方案易于实现、效果良好，可以有效提高adore-ng的隐蔽性能。

关键词: Linux内核, 信息安全, rootkit技术, VFS层

Abstract: The kernel rootkit at VFS layer hides deeply in Linux, and it is hard to be detected and killed. adore-ng is a typical rootkit application, but it can not survive some of the real-time monitoring programs, such as the Kaspersky Internet security. Aiming at this problem, the paper proposes two different solutions. One is by the modification of relevant system calls, the other is by filtering the content written by the VFS write call. Both these two approaches are easy to be implemented. Experimental results show the approaches are effective.

Key words: Linux kernel, information security, rootkit technique, VFS layer

中图分类号: