Combating Kernel Rootkits on Linux Version 2.6 (Analysis of Rootkit Prevention, Detection and Correction)

Abstract

Rootkits are a major security concern for smartphones today. They have always been around, though largely operational on desktops and PCs. On the mobile platform, their presence was not very popular until the advent of smartphones and advanced mobile devices. The rapid developments and trends recorded on smartphones today make them highly vulnerable to rootkit attacks. Smartphone operating systems now come highly sophisticated and packaged with advanced functionality to keep record of users’ diary, sensitive personal and security details, among others. These features make them a prime choice for attacks from rootkit authors, who explore all available avenues to exploit and extract this information for malicious purposes. Cases of rootkit attacks have continued to increase with more of such attacks targeted at popular smartphone operating systems like Android. In this research, we discuss rootkits, illustrating their operational architecture and operation with a design of a kernel rootkit for the Linux kernel 2.6. We explore possible measures to combat rootkits on the mobile platform, using Android as a case study