In-Depth Study Of Linux Rootkits: Evolution, Detection, And Defense

The talk starts from an incident responder's concern: whether standard live-forensics tools can be trusted on a Linux host that may already be compromised. The speaker argues that rootkit techniques dating back more than twenty years are still in use, and that recent threat reports keep describing both user-space and kernel-space tampering.

The middle section walks through the main approaches. It covers user-space hooking through the dynamic loader, including LD_PRELOAD and loader tampering, with a demonstration in which a preloaded library alters the output of a simple text-printing command. It then moves to kernel-level methods such as loadable kernel modules, ftrace and kprobe hooks, system call table modification and eBPF programs. For each, the speaker points to artifacts worth checking, including preload configuration files, process environment variables, differences between /proc enumeration and direct lookups, lists of hooked kernel functions and kernel taint messages.

The closing part makes the case for layered checks. Statically linked binaries and alternate tools can expose discrepancies, memory snapshots analysed with Volatility can reveal kernel-level hooks, and a runtime kernel guard module was reported to detect most of the tested kernel rootkits when loaded before them. The main takeaway is that responders should compare results across independent tools and learn what a normal system looks like before trusting any single output.