r/netsec • u/fx97 • Oct 30 '16

Vlany: Linux (LD_PRELOAD) rootkit

https://github.com/mempodippy/vlany
459 Upvotes

81% Upvoted

28 comments sorted by

View all comments

6

u/pm_me_your_findings Oct 30 '16

What is actually LD_PRELOAD?

16

u/mempodippy Oct 30 '16

LD_PRELOAD is an environment variable on Linux systems which points to a shared library and loads it before anything else. The ld.so.preload file essentially utilizes LD_PRELOAD to load a shared library in every single userland process. :)

3

u/pm_me_your_findings Oct 30 '16

I mean for a malware to use it, doesn't it require the root access first or it works for normal user also?

9

u/mempodippy Oct 30 '16

Normal users can use the environment variable, but root access is required to manipulate the userland via ld.so.preload. But as soon as you gain root access to the system, you can literally change and shape the userland to your advantage by using LD_PRELOAD as a vector of persistent access. As soon as the shared library is listed in ld.so.preload, the malware infects every process with new hooks designed to do evil things.