Rootkits, the most pervasive of backdoors, are the final step in post-exploitation. This talk will tour the fundamentals of Linux kernel development and the anatomy of an LKM rootkits by building one from scratch. The talk will explore the blackhat techniques used to subvert the kernel, hook system calls, and hide from user space. We'll look at the effectiveness and strategies for rootkit detection and discuss the security implications that bridge user and kernel space.