5

A recent article spiked my curiosity; please bare with me, I'm no security expert but just a Linux admin.

This states that the rootkit runs from userspace, but modifies /etc/so.preload and creates files under /usr/share. By which mechanism is this possible? That the article didn't mention as far as I'm aware.

1 Answer 1

2

Are you just asking how a user-mode program can write files? User-mode (ring 3) does not mean unprivileged, although kernel-mode (ring 0, the opposite of user-mode) does imply privileged. Every time you sudo a command, you're running ring 3 code that can modify arbitrary files. The "root" user's programs run in ring 3 just the same as anybody else's.

A rootkit like this obviously requires privileges (i.e. root) in order to install. It does things like create a user, which can be done with userspace code (there are some calls into the kernel, but you don't have to install a kernel module to do it) but cannot be done by an unprivileged user.

As a side note, user-mode rootkits are weaker than kernel-mode ones. As a practical matter, third-party code will essentially never make a system call directly, because system calls are not like "normal" functions and the details are platform- and implementation-specific, and might change between major kernel revisions. Making syscalls directly from your code will likely make it non-portable, and is easy to screw up. However, it is possible, and if you do that, you will bypass the shim that the user-mode rootkit has set up to tamper with your syscalls.

3
  • Thanks for that, and right, that differentiation makes sense. I guess what I was hoping to find out is how the privilege escalation takes place. And how the thing ends up ones machine in the first place. So my question is incomplete. Should I reword it?
    – tink
    Sep 7, 2016 at 17:26
  • 1
    @tink That's a pretty different question than you've asked here, but I bet it's been asked before. The malware itself has no privilege escalation, although it may be used as the payload of a privilege escalation bug. It gets on the system the same way as any other malware: either an exploit payload dropped on a vulnerable system (with or without needing a separate privilege escalation step, depending on the vector), or a Trojan Horse installer (which is probably already running as root), or social engineering the user to do something stupid (like curl <untrusted URL> piped to sudo sh).
    – CBHacking
    Sep 7, 2016 at 17:41
  • Cheers, that's all I could ask for w/o weeks of reading ;}
    – tink
    Sep 7, 2016 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .