Linux: Is Keyboard Rootkitted

I created a keyboard rootkitted detector that consist of a Linux Loadable Kernel Module (LKM), a /proc/is-kbd-rkt file and a simple app that outputs the result. The app looks something like this:

In order to try it out you first need:

git clone https://github.com/sith-ikjetil/is-kbd-rkt.git

Then you need to build the LKM (lkm subdirectory):

make

The install the LKM (.ko file) into the kernel:

sudo insmod ./is-kbd-rkt.ko

You might need to disable secure boot or sign the LKM first.

Then build the app (app subdirectory):

./build-debug.sh

Now all you have to do is run the application (app subdirectory):

./iskbdrkt

or see the contents of the /proc/is-kbd-rkt file:

cat /proc/is-kbd-rkt

Good luck 🙂