Current State of Linux Rootkits

Rootkit Fundamentals

Optiv consultant Philip Haas defines Linux rootkits as post-exploitation tools for persistent, privileged, stealthy access after root compromise. He contrasts ring-zero kernel modules or drivers with ring-three user-mode designs that are generally easier to develop and less crash-prone.

Historical Evolution

Early persistence backdoored binaries like ps, top, lsof, and netstat—leaving disk artifacts and missing unknown admin tools. Silvio Cesare’s /dev/mem approach allowed direct kernel memory patching until modern distributions removed it.

LD_PRELOAD Hooking

Haas explains dynamic linking precedence via ldd and /etc/ld.so.preload. Attackers preload shared libraries to override weak libc syscall wrappers before legitimate ones load. He demonstrates hooking write() and extending the idea to hide malicious PIDs and network connections by filtering /proc and netstat-related syscalls during directory iteration.