Preventing Linux rootkit threats through secure boot design
The Linux OS is likely to become even more popular as 32bit computing becomes a commodity and projects like Yocto make it easier to create, develop and maintain Linux based systems for embedded applications.
One of the advantages of Linux is that it enables OEMs to become more like startups, where agile hardware development teams speed time to market by using an OS to abstract the underlying hardware details. However, despite its benefits, a Linux system can be vulnerable to rootkits unless its embedded processor is booted properly.
In general, rootkits try to access privileged (root) modes while hiding from system malware detection tools. The malware may also try to install itself into a persistent state by modifying the system's boot process. If successful, the infection is permanent or persists through power cycles. From there, the malware will do whatever its author wants; everything from logging key strokes to enabling unauthorised services. And if a system is infected, a complete OS reinstall may be required.
