modhide

Module Hiding

A malicious LKM may wish to hide it's presence by tampering with fields exposed via the struct module. Specifically the malicious LKM may remove itself from the list of running modules to hide from /proc/modules (and any tool based on reading that file) and remove mkobj.kobj kobject to remove itself from sysfs.

This technique is well detected if LKRG is present when the module performs these actions.

Examples

sysfs:

kobject_del(&THIS_MODULE->mkobj.kobj);

proc:

list_del_init(&THIS_MODULE.list);    

Detection

Iterate through all modules checking integrity.

e.g:

if(foundmod->list.next == foundmod->list.prev)
{
    // warn
}

if((foundmod->list.next == LIST_POISON1) || (foundmod->list.prev == LIST_POISON2)) 
{
    // warn    
}