Detection of Loadable Kernel Module Rootkit

摘要

Today a lot of vulnerabilities of computer systems and networks are discovered and published by the hackers, attackers, and intruders, which makes it easier for them to develop new hacking techniques. In this paper, we look into the backdoor technique called Loadable Kernel Module (LKM) used in the wild. We find that LKM backdoor is more sophisticated and powerful, while less detectable than traditional backdoors. By understanding more of Rootkit and figuring out what capabilities it has, we can obtain better means of countermeasures against it.