A recent article spiked my curiosity; please bare with me, I'm no security expert but just a Linux admin.

This states that the rootkit runs from userspace, but modifies /etc/so.preload and creates files under /usr/share. By which mechanism is this possible? That the article didn't mention as far as I'm aware.


Are you just asking how a user-mode program can write files? User-mode (ring 3) does not mean unprivileged, although kernel-mode (ring 0, the opposite of user-mode) does imply privileged. Every time you sudo a command, you're running ring 3 code that can modify arbitrary files. The "root" user's programs run in ring 3 just the same as anybody else's.

A rootkit like this obviously requires privileges (i.e. root) in order to install. It does things like create a user, which can be done with userspace code (there are some calls into the kernel, but you don't have to install a kernel module to do it) but cannot be done by an unprivileged user.

As a side note, user-mode rootkits are weaker than kernel-mode ones. As a practical matter, third-party code will essentially never make a system call directly, because system calls are not like "normal" functions and the details are platform- and implementation-specific, and might change between major kernel revisions. Making syscalls directly from your code will likely make it non-portable, and is easy to screw up. However, it is possible, and if you do that, you will bypass the shim that the user-mode rootkit has set up to tamper with your syscalls.

  • Thanks for that, and right, that differentiation makes sense. I guess what I was hoping to find out is how the privilege escalation takes place. And how the thing ends up ones machine in the first place. So my question is incomplete. Should I reword it? – tink Sep 7 '16 at 17:26
  • 1
    @tink That's a pretty different question than you've asked here, but I bet it's been asked before. The malware itself has no privilege escalation, although it may be used as the payload of a privilege escalation bug. It gets on the system the same way as any other malware: either an exploit payload dropped on a vulnerable system (with or without needing a separate privilege escalation step, depending on the vector), or a Trojan Horse installer (which is probably already running as root), or social engineering the user to do something stupid (like curl <untrusted URL> piped to sudo sh). – CBHacking Sep 7 '16 at 17:41
  • Cheers, that's all I could ask for w/o weeks of reading ;} – tink Sep 7 '16 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.