Author Login Editor-in-Chief Peer Review Editor Work Office Work

Computer Engineering ›› 2010, Vol. 36 ›› Issue (8): 161-162. doi: 10.3969/j.issn.1000-3428.2010.08.056

• Security Technology • Previous Articles     Next Articles

Research on VFS Layer Rootkit Technique in Linux

DING Yan, FU Hong-yi, LI Yu-zhuo   

  1. (School of Computer, National University of Defence Technology, Changsha 410073)
  • Received:1900-01-01 Revised:1900-01-01 Online:2010-04-20 Published:2010-04-20

Linux下VFS层Rootkit技术研究

丁 滟,富弘毅,李宇卓   

  1. (国防科技大学计算机学院,长沙 410073)

Abstract: The kernel rootkit at VFS layer hides deeply in Linux, and it is hard to be detected and killed. adore-ng is a typical rootkit application, but it can not survive some of the real-time monitoring programs, such as the Kaspersky Internet security. Aiming at this problem, the paper proposes two different solutions. One is by the modification of relevant system calls, the other is by filtering the content written by the VFS write call. Both these two approaches are easy to be implemented. Experimental results show the approaches are effective.

Key words: Linux kernel, information security, rootkit technique, VFS layer

摘要: Linux下VFS层rootkit隐藏层次深,查杀难度大。其典型应用adore-ng在实际使用时无法屏蔽卡巴斯基等实时监控软件,破坏隐蔽效果。针对该问题,运用系统调用修改和VFS写函数内容过滤2种方法,设计并实现了相应的改进方案。仿真实验结果表明,该方案易于实现、效果良好,可以有效提高adore-ng的隐蔽性能。

关键词: Linux内核, 信息安全, rootkit技术, VFS层

CLC Number: