How Linux Rootkits Abuse LD_PRELOAD to Hide Malicious Activity
Summary
A tutorial explains how Linux rootkits use LD_PRELOAD to intercept functions and hide activity, demonstrates hiding a file by hooking readdir, and outlines methods to detect preload abuse.
Key points
- LD_PRELOAD lets shared libraries load before other libraries, allowing a rootkit to intercept functions used by dynamically linked programs.
- A demonstration hooks readdir to make ls omit a file named malicious_file.
- The article cites Winnti for Linux, TeamTNT, Symbiote, and OrBit as examples associated with dynamic linker hijacking.
- Attackers can use the technique to conceal files, processes, and network connections, and—in some examples—harvest credentials or enable remote access.
- Recommended checks include inspecting /etc/ld.so.preload, reviewing process environments under /proc/{pid}/environ, comparing runtime filesystems with image snapshots, and detecting concealed processes.
Article Details
- Topic
- Linux rootkits using dynamic linker hijacking (LD_PRELOAD), their use in the wild, and detection methods
MITRE ATT&CK
T1014 · RootkitRootkits hide processes, files, directories, and network connections on compromised systems.T1556 · Modify Authentication ProcessSymbiote hooks Linux PAM functions and bypasses authentication with a hardcoded password match.T1574.006 · Dynamic Linker HijackingLD_PRELOAD is used to hijack the dynamic linker and load a malicious shared object before other libraries.
Threat Actors
Malware
AzazelLD_PRELOAD rootkit and a main backdoor. The user-mode rootkit is heavily based on the open-source Azazel rootkit. Azazel is used to hide processes, network connections, files, and directories, and also containsOrBitOrBit – OrBit is a dynamic linker hijacking rootkit, consisting of a dropper and a malicious shared object.SymbioteSymbiote – Unlike previous examples where the rootkit was an open-source-based side artifact responsible for hiding other malicious campaign activity, Symbiote is both a backdoor and a rootkit written from scratch.Winnti for LinuxWinnti for Linux – This Chinese-attributed threat is composed of a user-mode LD_PRELOAD rootkit and a main backdoor. The user-mode rootkit is heavily based on the open-source Azazel rootkit. Azazel is used to hide