Short bio: Computer Scientist, FOSS supporter (read more)
Tux Machines (TM)-specific
A new paper was presented in late March about using /dev/mem to inject and hide a rootkit (PDF), and the method has been getting some press, leading to a little concern. The first thing that you should understand is that this class of attack has been used before. We know how to protect against it.
If you read the paper, you'll find out two things:
1. We need a way to write to /dev/mem as a regular user, and
2. There's a kernel config which protects against this mechanism.