Immunity Releases Open Source Linux Rootkit

[Ehtyar]

Immunity Inc. has released an open source Linux rootkit which uses Intel's debugging mechanisms to hide.

The art of burying invisible malware deep inside a Linux machine is about to go mainstream, thanks to a new open-source rootkit released Thursday by Immunity Inc., a firm that supplies tools for penetration testers.

When implemented, Immunity's DR, or Debug Register, makes backdoors and other types of malware extremely difficult to detect or eradicate. It's notable because it cloaks itself by burrowing deep inside a server's processor and availing itself of debugging mechanisms available in Intel's chip architecture. The rootkit, in other words, mimics a kernel debugger.

Personal note: Go do something useful and go fix that python-olly-frankenstein you're always raving about.

Full Story

Ehtyar.

[f0dder]

Cute stuff.

But it still needs to hook INT1 and possibly INT3, which would make it rather trivial to detect anyway.