Implementing
Kernel-Level Rootkits
¨Easiest way to
modify kernel is to use the Loadable
Kernel Module capability of operating system
to extend the kernel
¨To install the Knark
RootKit on Linux, type “insmod
knark.o” ; no reboot required
¨Adore LKM RootKit
for Linux
¨Plasmoid LKM RootKit
for Solaris
¨Kernel-level RootKit
for WindowsNT
–A kernel patch not a
LKM