DR rootkit

[voron]

http://lists.immunitysec.com/pipermail/ ... 05323.html
how to prevent this except

Code: Select all

echo 1 > /proc/sys/kernel/grsecurity/disable_modules

Just intresting. Maybe debug register protection in DR7 GD-bit and so on(from http://www.phrack.com/issues.html?issue=65&id=8#article) ?

[spender]

There are many ways grsec can be used to prevent insertion of this rootkit, even if the injection method is altered (MODSTOP, RBAC system, /dev/mem restrictions).

Also, due to a bug in the rootkit, the presence of KERNEXEC will cause it to crash the system instead of being able to hook do_debug() successfully. They assume kernel code to be writable, and don't wrap their writes with cr0 modifications to clear/set WP.

-Brad