Quick and dirty detection script for recent versions of the KoviD LKM rootkit

pcrtest.py

"""
PCRtest.py - bah / November 2024

A quick / dirty test for recent versions of the Kovid LKM rootkit.

If you write to /proc/sys/kernel/tainted, kovid unset a few bits.
You can use resetting behaviour to detect it.

Run this script as root.
"""
import time


with open('/proc/sys/kernel/tainted', 'r') as f:
    first = f.read()


with open('/proc/sys/kernel/tainted', 'wb') as f:
    f.write(b'64')

time.sleep(6)

with open('/proc/sys/kernel/tainted', 'r') as f:
    second = f.read()

if first == second:
    print('you have kovid')
else:
    print('clean')

I saw some people talking about zeroing out tainted_mask at intervals. i.e KoviD doing it every 5 seconds in carloslack/KoviD@1bc30ba

The problem with this is that you can just write to /proc/sys/kernel/tainted from userland, and see if the bit you set got unset after the interval. In fact, you can just set TAINT_USER at boot, and if it ever gets unset you know the box got kited.

The correct design is just to unset the flags you accidentally set while the LKM was loaded (should just be the bit for loading an unsigned module, out of tree can be avoided by MODULE_INFO(intree, "true");) and don't do anything dumb like cause a page fault.

https://matheuzsecurity.github.io/hacking/a-simple-way-to-detect-and-remove-kovid-lkm-rootkit/ is also another nice way to detect it, by disabling ftrace temporarily.