Lesson 5.40: User-space rootkits and package verification

A rootkit doesn't need the kernel. A library listed in /etc/ld.so.preload is loaded into every dynamically linked program, and it can make ps, top, ls and lsof skip a process; a replaced ss can skip a connection. The defence is to look from a place the rootkit doesn't reach (a static binary, /proc read directly) and to ask the package manager which files no longer match what was installed. In the lab a Northwind web server is busy but shows nothing busy. You find the hidden miner by comparing two views, show how the library gets loaded, verify every package, remove the hook and restore the replaced tool.

19 min

You will learn to

Explain how /etc/ld.so.preload hides processes
Compare a dynamic view with a static one (busybox)
Show the preload with strace
Verify installed packages with dpkg -V and find owners with dpkg -S
Restore replaced files with --reinstall

Key terms

/etc/ld.so.preload: A file listing libraries the dynamic loader loads into every dynamically linked program first.
Static binary: A program with its libraries built in; preload hooks don't affect it.
Cross-view detection: Comparing two ways of listing the same thing; differences reveal hiding.
dpkg -V: Compares installed files with the checksums recorded when their package was installed.
dpkg -S: Shows which package owns a file; files owned by no package deserve a closer look.
Conffile: A configuration file the admin is expected to edit; dpkg keeps local changes.

← Restarts and reboots after updates · All lessons · Capstone 2: proving the rebuilt server is better →