4

I've heard of rootkits that infect computers by first having a simple virus infect the computer, make a call to the "command" computer containing the target computer's specs.
With the specs, the command computer starts compiling a rootkit to infect the target computer with, or it delivers a pre-compiled version of it.
This seems like an effective way to get around the nuance of Linux machines supporting a wide variety of platforms.

However, what if something such as the system call numbers on the target machine were different from the standard system call numbers, maybe even randomized on install?

Would this prevent the command computer from being able to send a functional rootkit/virus?

Can system call numbers be specified/assigned? (I am assuming this is possible by modifying and compiling your own kernel, or is it?)

2
  • 1
    The Playstation 4 operating system (based on FreeBSD) did this. It was quickly reversed engineered.
    – forest
    May 28, 2019 at 2:26
  • your comment is equivalent to sending WIndows kernel malware to Linux, as both have different syscall number assigned. THe malware will not run, and so is any other Windows binaries.
    – Peter Teoh
    Oct 31, 2020 at 4:06

2 Answers 2

3

While this may deter some automated attacks aimed at system call hooking, anyone with access to install a rootkit could disassemble a common binary on the system to determine your "randomized" syscalls, or use your own customized environment to compile their code. There's also a variety of techniques to determine where functions are located in kernel memory without System.map and so on.

Additionally, not all rootkits rely on syscall table/SSDT hooking. So basically, no. This is not an effective mitigation, and would likely be more of a hindrance to you having to make the modifications.

2
  • "anyone with access to install a rootkit" - what if it's a phishing attack or an exploit with code execution?
    – ndrix
    Jan 17, 2017 at 17:57
  • 2
    If it was a targeted phishing attack, the payload could be a shell script, perl, or anything else that takes advantage of the randomized syscall binaries already on the system to gain access.
    – movsx
    Jan 17, 2017 at 18:18
5

That'd be a very disruptive thing to do; you wouldn't be able to run any binary on your system, and would have to compile everything from scratch; including the compiler.

Security by obscurity hardly works.

2
  • Yes, but would it prevent an attack such as the one I mentioned?
    – tzengia
    Jan 13, 2017 at 0:37
  • Rootkits are most often distributed as binaries, so that'd be challenging.
    – ndrix
    Jan 13, 2017 at 0:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .