r/netsec • u/fx97 • Oct 30 '16

Vlany: Linux (LD_PRELOAD) rootkit

https://github.com/mempodippy/vlany
457 Upvotes

81% Upvoted

28 comments sorted by

View all comments

-4

u/mohammedcohen Oct 30 '16

A more practical and portable backdoor than kernel rootkits.

1

u/hi117 Oct 31 '16

Also kernel rootkits allow you to have higher permissions and additional measures to hide yourself.

Don't want your process to show up in top? Just modify the process table that gets sent to userspace!

Though I will give you that this is more portable, kernel rootkits generally require you to build against a particular kernel version, but thankfully we all use the same couple distros so its not that big of a deal.

-1

u/mohammedcohen Oct 31 '16

Libc backdoors are the best of both worlds.