News for hackers. Stuff that matters.
Re:Snowden Document Search by vezzy-fnord on Friday June 12, 2015 @06:55AM (#9705080)
They seem to define "persistence" variously, though I think they're talking about a rootkit in general (as opposed to checkpoint/restore). Emphasis on hypervisors, HDD and SSD firmware and, of course, the SMM.

Given that they talk about "Linux application persistence", I'd assume it's some kernel module rootkit. In which case, it's not that cool. The in-kernel ABI changes a lot and basic techniques like hooking the IDT vary.

There are no comments on this comment yet.