[ingleswapnil]

Hello All!!!
we are doing a project for protecting any host on the network from kernel level rootkits.
here we have putforth our project idea in brief..
please do reply...


Kernel rootkits are attacking the host by following ways:

1)Redirecting standard system calls such as fork,execve,open,read, kill to their own malicious system call routines, using Linux Kernel Module (LKM).example of this kind of rootkits is Knark.

2)Redirecting Proc and Virtual File System routines to their own malicious Proc and VFS routines, using linux kernel modules(LKM).example of this kind of rootkits is Adore-NG

3)Inserting their own IDT (Interrupt Descriptor Table) and system call table and redirecting original system pointers to their own IDT (hacked IDT) using /dev/kmem file which is character device file represents Kernel virtual memory.example of this rootkit is suckIT.

4)Replacing original kernel Binary image (vmlinuz file in /boot directory) with its own malicious Binary image.

5)Modifying path of Binary Image (vmlinuz file) in grub.conf file.

Solution:

1)X-KernRootkit is Preventing Kernel level rootkits from modifying kernel on the remote Host.

2)We are making changes in init_module system call. our project is nullifying rootkit’s effect by redirecting pointers of system calls ,proc and VFS routines back to their original position at the end of init_module routines, so that system will refer to original system call routines.

3)we are redirecting IDT and system call pointer back to their original position at the end of write system call routine as writing to /dev/kmem file executes write system call routine in kernel space. due to this system will always refer to original IDT and system call table.

4)Solution is not allowing rootkits to replace original vmlinuz file. we are making changes in unlink system call so that rootkit can not delete original vmlinuz file inturn can not replace it.

5)To modify path of Binary image, fseek function is called. fseek function executes lseek system call from user space. In lseek system call we are checking the offset given by rootkits code if that offset is path of vmlinuz file we are not allowing rootkits to overrite that path.

area of application : system security