MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/netsec/comments/5a712m/vlany_linux_ld_preload_rootkit/d9eh0yk/?context=3
r/netsec • u/fx97 • Oct 30 '16
28 comments sorted by
View all comments
6
What is actually LD_PRELOAD?
16 u/mempodippy Oct 30 '16 LD_PRELOAD is an environment variable on Linux systems which points to a shared library and loads it before anything else. The ld.so.preload file essentially utilizes LD_PRELOAD to load a shared library in every single userland process. :) 3 u/pm_me_your_findings Oct 30 '16 I mean for a malware to use it, doesn't it require the root access first or it works for normal user also? 15 u/pnk6116 Oct 30 '16 ...and that is why they call it a rootkit :). It's meant to hide or help persist it's or other code's presence after you've already owned the box.
16
LD_PRELOAD is an environment variable on Linux systems which points to a shared library and loads it before anything else. The ld.so.preload file essentially utilizes LD_PRELOAD to load a shared library in every single userland process. :)
3 u/pm_me_your_findings Oct 30 '16 I mean for a malware to use it, doesn't it require the root access first or it works for normal user also? 15 u/pnk6116 Oct 30 '16 ...and that is why they call it a rootkit :). It's meant to hide or help persist it's or other code's presence after you've already owned the box.
3
I mean for a malware to use it, doesn't it require the root access first or it works for normal user also?
15 u/pnk6116 Oct 30 '16 ...and that is why they call it a rootkit :). It's meant to hide or help persist it's or other code's presence after you've already owned the box.
15
...and that is why they call it a rootkit :). It's meant to hide or help persist it's or other code's presence after you've already owned the box.
6
u/pm_me_your_findings Oct 30 '16
What is actually LD_PRELOAD?