So I'm asking about Linux or Windows type of rootkit/malware

  1. is this possible? can a rootkit use the slack space in the pages of the memory instead of disk to hide data?

  2. if so, has this ever been used in a malware? and how is it done?

  • How would the slack space be addressed in order to write/read? – schroeder May 7 '19 at 9:35
  • @schroeder that is what i am wondering as well, i was attending a security class in malware detection and the professor said its possible but wouldnt say how – Max May 7 '19 at 9:36
  • Then the specific application (rootkit) doesn't matter. First, figure out how slack space can be used. Then worry about potential applications. – schroeder May 7 '19 at 9:36
  • @schroeder i assume if the rookit has access to page tables then it can basically select one page and just hide its data by writing to the last part of that page, considering it has access to kernel, but i might be wrong – Max May 7 '19 at 9:39
  • Well, sure, if you can re-write how the filesystem operates then you can do whatever you want, and you don't even need to be fancy about it. – schroeder May 7 '19 at 9:41

Of course it can, the question is why would it do that. A rootkit is a a piece of software that injects code into the kernel, it might as well use that to disguise itself.

There are several issues with RAM slack:

  1. The first is, of course, RAM is volatile, reboot and it's gone.
  2. On modern systems, obfuscation techniques used in memory and DEP make this harder, but still not impossible.

You basically have to find the address of something that you know will have slack and write after the end of it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.