5 ms·
Why not? Most malware utilizes uname to either whitelist or blacklist infection on a system, so an APT may benefit from lying.
by codezero 2y ago
Why not? Most malware utilizes uname to either whitelist or blacklist infection on a system, so an APT may benefit from lying.
- saagarjha 2y agoIt would break a bunch of other legitimate stuff that also checks uname and expects stuff to be there.
- codezero 2y agoMaybe but only once in a while, I wonder how much legitimate software relies on the kernel name at runtime (vs compile time)? Also consider it may only trigger if five syscalls to uname come in sequence from the same process. I suspect without evidence this pattern is less common.