<?xml version="1.0" encoding="ISO-8859-1"?>
<rss version="2.0">
<channel>
<title><![CDATA[Security docs about LKM, Rootkits and Backdoors]]></title>
<description><![CDATA[This RSS feed lists the latest security papers, articles and tutorials about Rootkits, LKM, Backdoors and Kernel Patching techniques that have been added on BugHunter Security Docs - http://doc.bughunter.net/]]></description>
<link><![CDATA[http://doc.bughunter.net/rootkit-backdoor/]]></link>
<lastBuildDate>Thu, 15 May 2008 18:02:14 +0200</lastBuildDate>
<generator>http://doc.bughunter.net/</generator>
<language>en-US</language>
<copyright>http://doc.bughunter.net/</copyright>
<ttl>60</ttl>
<item>
<title><![CDATA[Kernel Modification Using LKMs]]></title>
<link><![CDATA[http://doc.bughunter.net/rootkit-backdoor/kernel-mod.html]]></link>
<guid isPermaLink="true"><![CDATA[http://doc.bughunter.net/rootkit-backdoor/kernel-mod.html]]></guid>
<description><![CDATA[This paper written by dalai explores the mysterious virtue of kernel modification, with particular regard toward LKMs and their use in the subject. Kernel hacking is no easy task, but well worth the trouble of learning it. The author assumes that the reader is an experienced Unix user, is fairly familiar with kernel principles and semantics, and is a C programmer.]]></description>
<pubdate>Tue, 27 Dec 2005 22:50:32 +0100</pubdate>
</item>
<item>
<title><![CDATA[Execution path analysis: finding kernel based rootkits]]></title>
<link><![CDATA[http://doc.bughunter.net/rootkit-backdoor/execution-path.html]]></link>
<guid isPermaLink="true"><![CDATA[http://doc.bughunter.net/rootkit-backdoor/execution-path.html]]></guid>
<description><![CDATA[This article written by Jan K. Rutkowski presents a technique based on counting executed instructions in some system calls, which can be used to detect various kernel rootkits. This includes programs like SucKIT or prrf which do not modify syscall table. It focuses on Linux kernel 2.4, running on Intel 32-bit Family processor.]]></description>
<pubdate>Tue, 27 Dec 2005 22:49:50 +0100</pubdate>
</item>
<item>
<title><![CDATA[Infecting loadable kernel modules]]></title>
<link><![CDATA[http://doc.bughunter.net/rootkit-backdoor/infecting-lkm.html]]></link>
<guid isPermaLink="true"><![CDATA[http://doc.bughunter.net/rootkit-backdoor/infecting-lkm.html]]></guid>
<description><![CDATA[The goal of this paper written by truff is to describe a new technique used to hide lkm's and to ensure us that they will be reloaded after a reboot. The article explains how to infect a kernel module used by the system. It focuses on Linux kernel x86 2.4.x series but this technique can be applied to other operating systems that use the ELF format.]]></description>
<pubdate>Tue, 27 Dec 2005 22:48:27 +0100</pubdate>
</item>
<item>
<title><![CDATA[Linux on-the-fly kernel patching without LKM]]></title>
<link><![CDATA[http://doc.bughunter.net/rootkit-backdoor/kernel-patching.html]]></link>
<guid isPermaLink="true"><![CDATA[http://doc.bughunter.net/rootkit-backdoor/kernel-patching.html]]></guid>
<description><![CDATA[In this paper, sd explains a method that can be used in order to abuse the Linux kernel (syscalls mostly), without help of module support or System.map. This article assumes that the reader already has a basic knowledge about what a LKM is, how a LKM is loaded into kernel...]]></description>
<pubdate>Tue, 27 Dec 2005 22:47:29 +0100</pubdate>
</item>
<item>
<title><![CDATA[Runtime Kernel kmem Patching]]></title>
<link><![CDATA[http://doc.bughunter.net/rootkit-backdoor/kmem-patching.html]]></link>
<guid isPermaLink="true"><![CDATA[http://doc.bughunter.net/rootkit-backdoor/kmem-patching.html]]></guid>
<description><![CDATA[This paper documents "on the fly" kernel patching on a running system under Linux, using direct access to kernel memory. The article provides examples of kernel patching, shows how to remove a lkm's visibility to lsmod, and explains how to add ernel code ala loadable kernel modules (lkm) to a running system without native lkm support.]]></description>
<pubdate>Tue, 27 Dec 2005 22:45:27 +0100</pubdate>
</item>
</channel>
</rss>
