Rootkits

How malware hids

• Block commands like ps, netstat, etc $\rightarrow$ writing your own to override system calls.
• Subvert ls so it doesn't show up on disk.
• Used after malware has penetrated the system.