Как работают руткиты и можно ли им противодействовать на примере Singularity

Всем привет. Экспрементируя со способами закрепления на Linux системах в рамках разработки своей системы мониторига безопасности, я наткнулся на руткит с открытым исходным кодом Singularity . Он показался мне очень интересным, так как использует большое количество методов для сокрытия себя от обнаружения, а открытый исходный исходный код позволяет досконально изучить эти методы. В данной статье я подробно расскажу вам, с помощью каких подходов руткиты закрепляются на Linux системах на примере Singularity.

https://habr.com/ru/articles/996568/

#rootkit #rootkits #руткиты #руткит #ядро_linux #мониторинг #ebpf #обнаружение_атак #информационная_безопасность #защита_сервера

Как работают руткиты и можно ли им противодействовать на примере Singularity

Всем привет. Экспрементируя со способами закрепления на Linux системах в рамках разработки своей системы мониторига безопасности , я наткнулся на руткит с открытым исходным кодом Singularity . Он...

Хабр

@emilyyoung @ShadSterling nodds in agreement

From experience the most problematic are early #Windows games from 1995-2005 with like very old DirectX versions or cursed setups where the game is #32bit but the #Installer is #16bit. (i.e. #PizzaSyndicate).

  • Granted those games won't even install on #64bit - Windows machines anyway so they ain't smooth at all.

And whilst dedicated folks like @fuchsiii work on fixing these issues, we can all agree that people who play #Games that old may already have some dedicaded, legacy hardware at their disposal and wouldn't mind stuff like virtualization with passthrough to old PCI(e)-GPUs for their singleplayer games.

  • Obviously I'd prefer more #native #Linux #games but unless they want to statically compile the game with all dependencies into one AppImage that's more daunting as #ProtonGE / #DXVK support.

Still, #LinuxGaming has come a long way since the days when I had to manually shove DirectX, .net Runtime, ms-corefonts and Gecko (as Internet Explorer replacement) into Wine and manually force Windows-#Steam to launch...

@emilyyoung precisely that because #Linux will win longterm just by not #Enshittifying and just treating users better

  • This isn't even like a hypothetical…

Also #LinuxGaming these days is easier, faster, less stressful and just overall better not just because #Valve actually cares, but because #developers and #maintainers of distros and the Linux community do.

  • The only painpoints are some quirky games released ca. 1995-2005 that didn't see widespread popularity and need tweaks in #Wine & #DXVK to run at all (as @fuchsiii is dabbling with those) and #malware-laced crap under false pretenses like "#ClientSideAnticheat" that is specifically designed to not work on #Linux with #rootkits not dissimilar from #StarFORCE!

https://www.youtube.com/watch?v=p-wyIalhdPU video via #MVG

StarForce - The PC CD-ROM DRM that broke your Computer | MVG

YouTube

"#Hackers Deploy #Linux #Rootkits via #Cisco #SNMP Flaw in 'Zero Disco' Attacks"

https://thehackernews.com/2025/10/hackers-deploy-linux-rootkits-via-cisco.html

In all my years in cybersecurity, I've always felt SNMP was not a good idea & should be turned off.
I know many network admins will dislike me saying that but I always turn it off.
Even the version with tacked on security #SNMPv3 has had #Vulnerabilities & many places run older SNMP & not v3.
I feel maybe it's time for something new.

#CyberSecurityNews #CyberSecurity #TechNews #Networking

Operation Zero Disco: Threat actors targets Cisco SNMP flaw to drop Linux rootkits - Security Affairs

Hackers exploit Cisco SNMP flaw CVE-2025-20352 in “Zero Disco” attacks to deploy Linux rootkits on outdated systems, researchers report.

Security Affairs
Operation Zero Disco: Threat actors targets Cisco SNMP flaw to drop Linux rootkits - Security Affairs

Hackers exploit Cisco SNMP flaw CVE-2025-20352 in “Zero Disco” attacks to deploy Linux rootkits on outdated systems, researchers report.

Security Affairs
#ghostscan
A modern, Rust-powered
#Linux #scanner that unmasks hidden #rootkits, stealthy #eBPF tricks, and ghost processes in one fast sweep (45+ scanners)
https://github.com/h2337/ghostscan
GitHub - h2337/ghostscan: A modern, Rust-powered Linux scanner that unmasks hidden rootkits, stealthy eBPF tricks, and ghost processes in one fast sweep (45+ scanners)

A modern, Rust-powered Linux scanner that unmasks hidden rootkits, stealthy eBPF tricks, and ghost processes in one fast sweep (45+ scanners) - h2337/ghostscan

GitHub

@technadu After #CrowdStroke it should be clear that #CrowdStrike isn't a "trustworthy brand"...

  • Granted everyone who thinks 3rd party #rootkits like CrowdStrike in a #CCSS #Govware masquerading as an #OS (#windows) is a valid security strategy should not be trusted even with a light switch or plastic fork.

also #npm sucks!

¡No parpadees si no te lo quieres perder! Stephan Berger nos habla de "In-Depth Study Of Linux Rootkits: Evolution, Detection, And Defense" #Rootkits  #InfoSec @malmoeb