Horse Pill: A New Type of Linux Rootkit

Black Hat USA 2016

Presented by: Michael Leibowitz
Date: Thursday August 04, 2016
Time: 12:10 - 13:00
Location: South Seas CDF

What if we took the underlying technical elements of Linux containers and used them for evil? The result a new kind rootkit, which is even able to infect and persist in systems with UEFI secure boot enabled, thanks to the way almost every Linux system boots. This works without a malicious kernel module and therefore works when kernel module signing is used to prevent loading of unsigned kernel modules. The infected system has a nearly invisible backdoor that can be remote controlled via a covert network channel.

Hope is not lost, however! Come to the talk and see how the risk can be eliminated/mitigated. While this may poke a stick in the eye of the current state of boot security, we can fix it!

Michael Leibowitz

Michael Leibowitz (@r00tkillah) has done hard-time in real-time. An old-schoolcomputer engineer by education, he spends his days championing productsecurity for a large semiconductor company. Previously, he developed andtested embedded hardware and software, dicked around with strap-on boot roms,mobile apps, office suites, and written some secure software. On nights andweekends he hacks on electronics, writes Blackhat CFPs, and contributes to theNSA Playset.


KhanFu - Mobile schedules for INFOSEC conferences.
Mobile interface | Alternate Formats