SecurityFocus: Detecting Kernel-level Compromises With gdb

“This article is intended to outline useful ways of detecting
hidden modifications to a Linux kernel. Often known as a rootkit,
this stealthy type of malware gets installed in the kernel of an
operating system and requires special techniques by Incident
handlers and Linux system administrators to be detected.

“In this article we will make use of just one tool, gdb, the GNU
debugger, to detect whether a Linux operating system has been
compromised…”

Complete
Story