Do you need to worry about the new /dev/mem rootkit problem?

Filed under
Security

A new paper was presented in late March about using /dev/mem to inject and hide a rootkit (PDF), and the method has been getting some press, leading to a little concern. The first thing that you should understand is that this class of attack has been used before. We know how to protect against it.

If you read the paper, you'll find out two things:

1. We need a way to write to /dev/mem as a regular user, and
2. There's a kernel config which protects against this mechanism.

rest here