Anthony Lineberry is a security researcher from Los Angeles who has been active in the security community for many years, specializing in reverse engineering code, researching vulnerabilities, and advanced exploitation development. He helped with the first iPhone jailbreak, has written an open source kernel from scratch, and feels uncomfortable speaking in the 3rd person. Professionally his experience includes working as a security researcher for McAfee, NeuralIQ, and currently with Flexilis.

Lineberry presented a talk at SCALE titled: Undermining the Linux Kernel: Malicious Code Injection Via /dev/mem.
The talk was about how to hack the Linux Kernel and gain privileged accessing using the Kernel device /dev/mem.
The talk started off with examples of some common methods for exploiting the Linux Kernel including rootkits, trojans and how to prevent against them.

The talk later into the special procedure of injecting code into /dev/mem. /dev/mem is a driver interface to physically addressable memory which can be read and written like a regular Linux character device. Some examples of fun things a user can done once they have this privileged access such as hiding files, processes, and controlling network activity were demonstrated. The last part of the talk gave examples of how to patch this specific method of gaining privileged access to the Linux kernel.

When asked what he would want to convey to his audience for his talk, he offered these insights on the /dev/mem interface:

I suppose the info I’d like to communicate is that there is no reason for the /dev/mem interface to be as wide open as it is, but at the
same time I’m not gonna start waving my arms screaming “fire” as though I realistically think everyone will be taking advantage of this problem. Its not a new problem, and people have been aware of this for quite a long time now. But I don’t think administrators are aware that if they disable module support in the Kernel to prevent Kernel based rootkits, that there are still ways to get code into the Kernel (aside from an overflow in the Kernel).

Anothy maintains a website with information about computer security at http://www.dtors.org

Coverage on the talk is available at http://dtors.org/index/code-injection-via-dev-mem