KEROKID: the KErnel ROotKIt Detector

Quick Start Guide

make linux-x86_64           // or linux-x86 for 32bit environments
sudo insmod kerokid.ko

Results can be accessed via dmesg (available on all kernel versions) or /proc/kerokid (requires Kernel 3.10 or newer)

The system is rescanned whenever a new kernel module is loaded.

Alternatively, you can initialize a rescan by writing to /proc/kerokid/rescan as root. (requires Kernel 3.10 or newer)

echo '1' > /proc/kerokid/rescan

This can be used for periodic automated rescans via cron jobs.

The idea of KEROKID

Kernel Level Rootkits use different techniques to hide themselves, e.g.:

remove themselves from the kernel module list
unregister their /sys/module entry
overwrite their module structures
extract their code to the kernel heap (the space allocated with kmalloc or vmalloc)

Nevertheless, these rootkits need space in memory. Therefore KEROKID uses memory forensics to detect rootkits in the kernel's heap or module space. In addition, rootkits must react to user or system activity and therefore use hooks or subscribe themselves to notifiers. KEROKID detects such suspicious calls originating from:

system call hooks
inline hooks
notifier subscriptions

Proc output (requires Kernel 3.10 or newer)

results and further information can be accessed through /proc/kerokid

/proc/kerokid/results contains the results for each area
/proc/kerokid/memory lists the addresses of modules, syscalls and allocated memory
the folder /proc/kerokid/notifiers contains the results for each notifier chain
the folder /proc/kerokid/modules contains information on each module

Dmesg output (available on all kernel versions)

This is a sample output showing a hidden module that manipulated five syscall table entries. The addresses are the destinations of the manipulated syscalls.

[  421.296881] KEROKID: Started
[  421.302176] KEROKID: Check for syscall table hooks...
[  421.302176] KEROKID: ALERT: Jump to hidden module: ffffffffa0002010 
[  421.302176] KEROKID: ALERT: Jump to hidden module: ffffffffa0002050 
[  421.302176] KEROKID: ALERT: Jump to hidden module: ffffffffa0002020 
[  421.302176] KEROKID: ALERT: Jump to hidden module: ffffffffa0002040 
[  421.302176] KEROKID: ALERT: Jump to hidden module: ffffffffa0002000 
[  421.302176] KEROKID: Check for inline hooks...
[  421.304729] KEROKID: Check notifier_subscriptions...
[  421.304729] KEROKID: -> Check keyboard notifier chain... 
[  421.308363] KEROKID: -> Check module notifier chain... 
[  421.308363] KEROKID: -> Check netdevice notifier chain... 
[  421.308363] KEROKID: -> Check netevent notifier chain...

What we can detect...

syscall table entries directing to module space or kernel heap: determines if module is present at destination or not
inline hooking of syscall functions: determines if module is present at destination or not
notifier entries to module space or kernel heap: determines if module is present at destination or not
module structure of hidden modules in memory [in progress]

What we cannot detect at the moment...

notifiers registered with highest priority
Debugging Hooks as described in: http://phrack.org/issues/65/8.html
Interrupt Descriptor Table (IDT) manipulation
Inline hook detection covers only ONE way. Significant improvement required. (see inline hook detection paragraph)

Successfully tested with

x86

Debian-7.7.0-i386 3.2.0-4-486
Fedora-Desktop-i686-20-1 3.11.10-301.fc20.i686
Ubuntu 14.04 i686 3.13.0-32-generic

x86_64

recent vanilla kernels
Debian 7.7.0 3.2.0-4-amd64, 3.16-0.bpo.2-amd64
Fedora Desktop 3.11.10.301-fc20.x86_64
Gentoo Linux 3.17.7-gentoo (genkernel)
Kali Linux 1.0.9a x86_64 3.14.5-1kali1
Mageia-4.1 3.12.21-desktop-2.mga4
OpenSUSE 13.2 3.16.6-2-2-desktop
Ubuntu 14.10 3.16.0-23-generic
Ubuntu 14.04 3.13.0-generic
Ubuntu 12.04.5 LTS x86_64 3.2.0-33-generic, 3.2.64, 3.13.0-32-generic

Implementation details and development related stuff

Debugging

Debug features can be enabled by:

make linux-x86_64 DEBUG=y

Dumping loaded module

At the moment you can only dump unhidden modules. As root use the following command to get a list of loaded modules:

cat /proc/kerokid/modules_list

Pick the NUMBER of the corresponding Module and type:

echo "NUMBER" > /proc/kerokid/dump_module

The module binary can now be copied from /proc/kerokid/MODULNAME to wherever you want.

Inline hook detection

checks all functions referenced in the System Call Table by comparing the first bytes of the function with a list of known hooks
looks for suspicious jumps (especially jumps to modules and dynamically allocated memory)
hooks are specified in inlineHooks.c (currently only the hooks used by Suterusu)
the hook definitions consist of the (hexadecimal) code, it's size and the (address) offset
works with 32- and 64-bit architecture hooks

CodeAndData / kerokid

readme