Hiding Linux Processes with Bind Mounts

Stephan Berger recently blogged about hiding Linux processes with bind mounts, using a different directory to overlay the /proc/PID directory to hide an evil process effectively. The method involves using spontaneous processes with low PIDs and names in square brackets from the Linux ps output to disguise the evil process. Refining the approach further, by analyzing all /proc/*/mount entries to program unmounting bind mounted directories efficiently, can help reveal any hidden processes.