Horse Pill: A New Type of Linux Rootkit
summary
A new Linux rootkit called Horse Pill uses namespace/cgroup container tricks to implant a backdoor into the initramfs so systems with UEFI Secure Boot can be infected without a malicious kernel module. It hijacks the update-initramfs/DRACUT assembly step (wins a scheduling race by using real‑time priority) to achieve initramfs persistence, creates fake kernel threads and a PID/mount namespace to hide processes and files, and runs a covert DNS tunnel via dnscat2 to deliver a remote root shell; the demo successfully boots an infected VM and yields persistent root access.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:34Rootkit overview
- 4:35Historical Linux rootkits
- 7:03LD preload rootkits
- 10:20Kernel-level rootkits
- 13:31Container technology
- 20:15Linux boot process
- 26:09The Horsepill rootkit
- 32:09Network and persistence
- 38:01Demo and execution
- 46:08Detection and mitigation
related talks
50mMalware Buried Deep Down the SPI Flash: Sednit's First UEFI Rootkit Found in the Wild
28mBOOTKITTY: Multi-OS Trust Chain compromise from Bootkit to Rootkit
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
17mBOOTKITTY: A Stealthy Bootkit-Rootkit Against Modern Operating Systems
25mPIkit: A New Kernel-Independent Processor-Interconnect Rootkit
27mBreaking the Chain of Trust
43m"A rootkits writer’s guide to defense"
01h 09mThe Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ...