matheuzsec

5 ms·

1. 1.▲
   by matheuzsec 8mo ago

   HAHAHAHAHAH I genuinely laughed a lot, thank you
2. 2.▲
   by matheuzsec 8mo ago

   I tested the Singularity Linux kernel rootkit on VirusTotal using only basic obfuscation. At the time of submission, none of the engines detected the sample. This seems to highlight ongoing gaps in static detection for Linux kernel-level ma
3. 3.▲
   by matheuzsec 9mo ago

   This is not permanent; if the system is rebooted, it will be undone :)
4. 4.▲
   Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)(github.com)

   117 points by matheuzsec 9mo ago|55 comments
5. 5.▲
   by matheuzsec 9mo ago

   The rootkit now disables SELinux enforcing mode on-demand when the ICMP reverse shell is triggered, leaving zero audit logs. How it works: SELinux maintains a global kernel structure called selinux_state that contains the enforcement flag.
6. 6.▲
   A new stealthy Linux kernel rootkit makes detection nearly impossible(github.com)

   6 points by matheuzsec 9mo ago|1 comments
7. 7.▲
   by matheuzsec 9mo ago

   This rootkit doesn't just hide from detection tools, it blinds them at the kernel level. When security tools try to enable ftrace (the standard syscall tracing method), the rootkit intercepts writes to /proc/sys/kernel&#
8. 8.▲
   by matheuzsec 9mo ago

   Nowadays, there's only one rootkit that can hide itself so perfectly: the Singularity rootkit. It also hides from auditd by using netlink_unicast hooking and other evasive functionalities. Analyzing a machine compromised with Singulari