Lurking in the shadows: Identifying systemic threats to kernel data (short paper)

Arati Baliga, Pandurang Kamat, Liviu Iftode

Research output: Chapter in Book/Report/Conference proceedingConference contribution

57 Scopus citations


The integrity of kernel code and data is fundamental to the integrity of the computer system. Tampering with the kernel data is an attractive venue for rootkit writers since malicious modifications in the kernel are harder to identify compared to their user-level counterparts. So far however, the pattern followed for tampering is limited to hiding malicious objects in user-space. This involves manipulating a subset of kernel data structures that are related to intercepting user requests or affecting the user's view of the system. Hence, defense techniques are built around detecting such hiding behavior. The contribution of this paper is to demonstrate a new class of stealthy attacks that only exist in kernel space and do not employ any hiding techniques traditionally used by rootkits. These attacks are stealthy because the damage done to the system is not apparent to the user or intrusion detection systems installed on the system and are symbolic of a more systemic problem present throughout the kernel. Our goal in building these attack prototypes was to show that such attacks are not only realistic, but worse; they cannot be detected by the current generation of kernel integrity monitors, without prior knowledge of the attack signature.

Original languageEnglish (US)
Title of host publicationProceedings - S and P 2007
Subtitle of host publication2007 IEEE Symposium on Security and Privacy, SP'07
Number of pages6
StatePublished - 2007
EventS and P 2007: 2007 IEEE Symposium on Security and Privacy, SP'07 - Berkeley, CA, United States
Duration: May 20 2007May 23 2007

Publication series

NameProceedings - IEEE Symposium on Security and Privacy
ISSN (Print)1081-6011


OtherS and P 2007: 2007 IEEE Symposium on Security and Privacy, SP'07
Country/TerritoryUnited States
CityBerkeley, CA

All Science Journal Classification (ASJC) codes

  • Engineering(all)


Dive into the research topics of 'Lurking in the shadows: Identifying systemic threats to kernel data (short paper)'. Together they form a unique fingerprint.

Cite this