3

According to my understanding so far:

  • a kernel-space rootkits runs in ring0 and use techniques such as syscalls

  • a user-space rootkits runs in ring3 and uses techniques such as library injections

  • rootkits are all executed with administrative privileges. Hence, an attacker would have obtain the necessary information available to run the rootkit

However, I am confused at when would one would prefer to use a kernel-space rootkit or a user-space rootkit. As a kernel-space rootkit has higher privileges why not just run a kernel-space rootkit every time?

5

You might not have high privileges on the system you're targeting. If you don't have ring 0 or equivalent privileges that allows you to modify the kernel (e.g. by loading custom unsigned kernel modules when supported), you might have to limit yourself to a userspace rootkit. Just because you have root doesn't mean you can get ring 0, and many secure configurations prevent root from modifying the kernel.

Another reason you might prefer a userspace rootkit is because it is less likely to crash or malfunction. A kernel rootkit will typically only work with one specific kernel version, and any update to the kernel requires adjusting the rootkit. Furthermore, a kernel rootkit is more likely to cause instability and bring the entire system down. If you don't need the powerful features a kernel rootkit can give you like syscall hooking, you might choose the option which is more stable and works on a wider variety of systems.

A well-designed userspace rootkit might work equally well on Debian Linux as on Solaris (a UNIX which has no code in common with Linux systems), but a kernel rootkit designed for Debian with kernel 4.18.6 might not even load if you try to run on CentOS, even if the kernel version is the exact same.

  • 2
    Greetings, Thank you very much for the reply! It's clear and concise, doubts have been clarified! :) – meoware May 22 at 2:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.