An Introduction to Linux Kernel Backdoors
Today, most linux rootkits are implemented as kernel modules, and for good
reason. The kernel gives a programmer control over every aspect of the OS
and gives him/her control that makes it the logical target while developing
rootkits and backdoors.
In this article, I will briefly introduce some of the basic ideas in this
approach, mainly from the point of view of use in a honeypot.
The example has been tested with the 2.6.3 version of the linux kernel, and
may not work with the 2.4 series (as in, I haven't tested it with 2.4, so
you're on your own there). Please get back to me if you have any problems or
questions while using the example.
