#rootkits — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #rootkits, aggregated by home.social.
-
A friendly reminder: Don't be afraid of #Linux #rootkits.
I have just released version 0.3.0 of rk-expose, a modern self-contained #rootkit detection tool that uses several techniques to detect signs of process hiding, file hiding, file content tampering from kernel or user space and can be used for hunting in large, diverse environments. rk-expose is written in #Rust.
Notable changes include:
- Clearer output format
- Generic improvements to process hiding detection to avoid false positives
- Improvements to cgroupfs process hiding detections
- A Velociraptor artifact
- An "auto" subcommand that runs checks using sensible defaults and interprets results
-
A friendly reminder: Don't be afraid of #Linux #rootkits.
I have just released version 0.3.0 of rk-expose, a modern self-contained #rootkit detection tool that uses several techniques to detect signs of process hiding, file hiding, file content tampering from kernel or user space and can be used for hunting in large, diverse environments. rk-expose is written in #Rust.
Notable changes include:
- Clearer output format
- Generic improvements to process hiding detection to avoid false positives
- Improvements to cgroupfs process hiding detections
- A Velociraptor artifact
- An "auto" subcommand that runs checks using sensible defaults and interprets results
-
Don't be afraid of the #rootkit bit of the malicious bonus material that shipped with some #ArchLinux #AUR packages recently , it is not really hard to detect in a generic way.
In the past few months I had been doing some research on #Linux #rootkits and figured out some techniques I hadn't seen implemented before. Since existing tools seemed inadequate for hunting for rootkits in large, diverse environments, I wrote rk-expose which compiles to a smallish (<1MB) static binary. It comes with lots of well-known and some novel rootkit detection techniques – and detects the malware distributed with the "atomic arch" campaign using its "ps-diff" command out of the box.
-
Don't be afraid of the #rootkit bit of the malicious bonus material that shipped with some #ArchLinux #AUR packages recently , it is not really hard to detect in a generic way.
In the past few months I had been doing some research on #Linux #rootkits and figured out some techniques I hadn't seen implemented before. Since existing tools seemed inadequate for hunting for rootkits in large, diverse environments, I wrote rk-expose which compiles to a smallish (<1MB) static binary. It comes with lots of well-known and some novel rootkit detection techniques – and detects the malware distributed with the "atomic arch" campaign using its "ps-diff" command out of the box.
-
Как работают руткиты и можно ли им противодействовать на примере Singularity
Всем привет. Экспрементируя со способами закрепления на Linux системах в рамках разработки своей системы мониторига безопасности, я наткнулся на руткит с открытым исходным кодом Singularity . Он показался мне очень интересным, так как использует большое количество методов для сокрытия себя от обнаружения, а открытый исходный исходный код позволяет досконально изучить эти методы. В данной статье я подробно расскажу вам, с помощью каких подходов руткиты закрепляются на Linux системах на примере Singularity.
https://habr.com/ru/articles/996568/
#rootkit #rootkits #руткиты #руткит #ядро_linux #мониторинг #ebpf #обнаружение_атак #информационная_безопасность #защита_сервера
-
"#Hackers Deploy #Linux #Rootkits via #Cisco #SNMP Flaw in 'Zero Disco' Attacks"
https://thehackernews.com/2025/10/hackers-deploy-linux-rootkits-via-cisco.html
In all my years in cybersecurity, I've always felt SNMP was not a good idea & should be turned off.
I know many network admins will dislike me saying that but I always turn it off.
Even the version with tacked on security #SNMPv3 has had #Vulnerabilities & many places run older SNMP & not v3.
I feel maybe it's time for something new. -
Hackers used Cisco zero-day to plant rootkits on network switches (CVE-2025-20352) https://www.helpnetsecurity.com/2025/10/17/hackers-used-cisco-zero-day-to-plant-rootkits-on-network-devices-cve-2025-20352/ #TrendMicro #Don'tmiss #Hotstuff #rootkits #exploit #0-day #Cisco #News
-
Hackers used Cisco zero-day to plant rootkits on network switches (CVE-2025-20352) https://www.helpnetsecurity.com/2025/10/17/hackers-used-cisco-zero-day-to-plant-rootkits-on-network-devices-cve-2025-20352/ #TrendMicro #Don'tmiss #Hotstuff #rootkits #exploit #0-day #Cisco #News
-
#ghostscan
A modern, Rust-powered #Linux #scanner that unmasks hidden #rootkits, stealthy #eBPF tricks, and ghost processes in one fast sweep (45+ scanners)
https://github.com/h2337/ghostscan -
SonicWall adds rootkit removal capabilities to the SMA 100 series https://www.helpnetsecurity.com/2025/09/23/sonicwall-adds-rootkit-removal-capabilities-to-the-sma-100-series/ #securityupdate #ransomware #Don'tmiss #SonicWall #Hotstuff #firmware #Mandiant #rootkits #Google #News
-
SonicWall adds rootkit removal capabilities to the SMA 100 series https://www.helpnetsecurity.com/2025/09/23/sonicwall-adds-rootkit-removal-capabilities-to-the-sma-100-series/ #securityupdate #ransomware #Don'tmiss #SonicWall #Hotstuff #firmware #Mandiant #rootkits #Google #News
-
Unsichtbare #Rootkits:
"Blinder Fleck" bei #Kernel-Interface bedroht #Linux-Systeme.
Viele #Sicherheitstools überwachen System-Calls, um #Malware zu erkennen. Unter #Linux gibt es jedoch eine Alternative, die oft völlig missachtet wird.
#Forscher von #Armo haben ein #Sicherheitsproblem in Verbindung mit einer io_uring genannten Schnittstelle des #Linux-Kernels aufgedeckt.
-
Unsichtbare #Rootkits:
"Blinder Fleck" bei #Kernel-Interface bedroht #Linux-Systeme.
Viele #Sicherheitstools überwachen System-Calls, um #Malware zu erkennen. Unter #Linux gibt es jedoch eine Alternative, die oft völlig missachtet wird.
#Forscher von #Armo haben ein #Sicherheitsproblem in Verbindung mit einer io_uring genannten Schnittstelle des #Linux-Kernels aufgedeckt.
-
New Linux Rootkit – Source: www.schneier.com https://ciso2ciso.com/new-linux-rootkit-source-www-schneier-com/ #rssfeedpostgeneratorecho #SchneierOnSecurity #SchneieronSecurity #CyberSecurityNews #Uncategorized #Rootkits #LINUX
-
New Linux Rootkit – Source: www.schneier.com https://ciso2ciso.com/new-linux-rootkit-source-www-schneier-com/ #rssfeedpostgeneratorecho #SchneierOnSecurity #SchneieronSecurity #CyberSecurityNews #Uncategorized #Rootkits #LINUX
-
New Linux Rootkit
Interesting:
The company has released a working rootkit called “Curing” that uses io_uring, a feature built into t... https://www.schneier.com/blog/archives/2025/04/new-linux-rootkit.html -
New Linux Rootkit
Interesting:
The company has released a working rootkit called “Curing” that uses io_uring, a feature built into t... https://www.schneier.com/blog/archives/2025/04/new-linux-rootkit.html -
Windows Kernel Rootkit en Rust (shadow-rs) https://www.hackplayers.com/2024/08/windows-kernel-rootkit-en-rust-shadow-rs.html #herramientas #rootkits #malware #Windows #maldev #rust
-
Windows Kernel Rootkit en Rust (shadow-rs) https://www.hackplayers.com/2024/08/windows-kernel-rootkit-en-rust-shadow-rs.html #herramientas #rootkits #malware #Windows #maldev #rust
-
Linux systems targeted with stealthy “Perfctl” cryptomining malware https://www.helpnetsecurity.com/2024/10/07/perfctl-perfcc-cryptomining-linux/ #misconfiguration #cryptojacking #vulnerability #AquaSecurity #Don'tmiss #Hotstuff #rootkits #malware #Linux #News
-
Linux systems targeted with stealthy “Perfctl” cryptomining malware https://www.helpnetsecurity.com/2024/10/07/perfctl-perfcc-cryptomining-linux/ #misconfiguration #cryptojacking #vulnerability #AquaSecurity #Don'tmiss #Hotstuff #rootkits #malware #Linux #News
-
Secure Boot-neutering PKfail debacle is more prevalent than anyone knew - Enlarge (credit: Getty Images)
A supply chain failure that com... - https://arstechnica.com/?p=2050182 #platformkeys #secureboot #security #rootkits #biz #pkfail #uefi
-
Secure Boot-neutering PKfail debacle is more prevalent than anyone knew - Enlarge (credit: Getty Images)
A supply chain failure that com... - https://arstechnica.com/?p=2050182 #platformkeys #secureboot #security #rootkits #biz #pkfail #uefi
-
0-day in Windows driver exploited by North Korean hackers to deliver rootkit (CVE-2024-38193) https://www.helpnetsecurity.com/2024/08/20/0-day-in-windows-driver-exploited-by-north-korean-hackers-to-deliver-rootkit-cve-2024-38193/ #vulnerability #NorthKorea #Don'tmiss #Hotstuff #rootkits #drivers #0-day #News #APT
-
0-day in Windows driver exploited by North Korean hackers to deliver rootkit (CVE-2024-38193) https://www.helpnetsecurity.com/2024/08/20/0-day-in-windows-driver-exploited-by-north-korean-hackers-to-deliver-rootkit-cve-2024-38193/ #vulnerability #NorthKorea #Don'tmiss #Hotstuff #rootkits #drivers #0-day #News #APT
-
Secure Boot is completely broken on 200+ models from 5 big device makers - Enlarge (credit: sasha85ru | Getty Imates)
In 2012, an industr... - https://arstechnica.com/?p=2039140 #unifiedextensiblefirmwareinterface #keycompromise #cryptography #supplychain #secureboot #features #security #rootkits #biz #uefi
-
Secure Boot is completely broken on 200+ models from 5 big device makers - Enlarge (credit: sasha85ru | Getty Imates)
In 2012, an industr... - https://arstechnica.com/?p=2039140 #unifiedextensiblefirmwareinterface #keycompromise #cryptography #supplychain #secureboot #features #security #rootkits #biz #uefi
-
Good riddance to #LeagueofLegends ig. Why are #rootkits so accepted, and for what, just to play a game?
-
Good riddance to #LeagueofLegends ig. Why are #rootkits so accepted, and for what, just to play a game?
-
#CyberSecurity #Microsoft #Windows #Rootkits #NorthKorea: "Hackers backed by the North Korean government gained a major win when Microsoft left a Windows zero-day unpatched for six months after learning it was under active exploitation.
Even after Microsoft patched the vulnerability last month, the company made no mention that the North Korean threat group Lazarus had been using the vulnerability since at least August to install a stealthy rootkit on vulnerable computers. The vulnerability provided an easy and stealthy means for malware that had already gained administrative system rights to interact with the Windows kernel. Lazarus used the vulnerability for just that. Even so, Microsoft has long said that such admin-to-kernel elevations don’t represent the crossing of a security boundary, a possible explanation for the time Microsoft took to fix the vulnerability."
-
#CyberSecurity #Microsoft #Windows #Rootkits #NorthKorea: "Hackers backed by the North Korean government gained a major win when Microsoft left a Windows zero-day unpatched for six months after learning it was under active exploitation.
Even after Microsoft patched the vulnerability last month, the company made no mention that the North Korean threat group Lazarus had been using the vulnerability since at least August to install a stealthy rootkit on vulnerable computers. The vulnerability provided an easy and stealthy means for malware that had already gained administrative system rights to interact with the Windows kernel. Lazarus used the vulnerability for just that. Even so, Microsoft has long said that such admin-to-kernel elevations don’t represent the crossing of a security boundary, a possible explanation for the time Microsoft took to fix the vulnerability."
-
Finding Linux root kits can be hard.
Even if the malware does not touch syscalls directly, it can modify some kernel functions which are activated by one of the system calls. The problem lies in the fact, that these modified functions do not have to be executed during every system call. For example if we modify only some pointer to reading functions in procfs, then the attacker’s code will be executed only when read() is called in order to read some specific file, like /proc/net/I've found from a file system level detection, you could monitor execution time, but I am curious what other people think.
-
Ars Technica: Stealthy Linux rootkit found in the wild after going undetected for 2 years https://arstechnica.com/?p=1989775 #Tech #arstechnica #IT #Technology #Security #backdoor #rootkits #malware #Biz&IT #Linux
-
5 Tools to Scan a #Linux Server for #Malware and #Rootkits 🐧
https://www.tecmint.com/scan-linux-for-malware-and-rootkits/
-
5 Tools to Scan a #Linux Server for #Malware and #Rootkits 🐧
https://www.tecmint.com/scan-linux-for-malware-and-rootkits/
-
This weekend I was nerdsniped into adding detection for #eBPF #rootkits to the sunlight project:
https://github.com/tstromberg/sunlight
Probably the most difficult part was just getting any eBPF-based rootkit to function. Most open-source PoC's fail miserably in recent Ubuntu LTS builds. Almost none of them build properly on arm64, either.
As an added bonus, the latest release also does a better job detecting signals-based rootkits, like #Diamorphine.
-
This weekend I was nerdsniped into adding detection for #eBPF #rootkits to the sunlight project:
https://github.com/tstromberg/sunlight
Probably the most difficult part was just getting any eBPF-based rootkit to function. Most open-source PoC's fail miserably in recent Ubuntu LTS builds. Almost none of them build properly on arm64, either.
As an added bonus, the latest release also does a better job detecting signals-based rootkits, like #Diamorphine.
-
I got to take apart a fantastic bit of #Linux #malware this week and have published the results: https://unfinished.bike/qubitstrike-and-diamorphine-linux-kernel-rootkits-go-mainstream - #QubitStrike has a bit of everything:
- Two #Linux #rootkits (kernel and user-mode)
- Process hiding
- Credential theft
- SSH backdoor
- A viral component
- A cryptocurrency miner
- Telegram integrationI had a lot of fun with this one. Now to convert these learnings into #detection rule updates!
-
I got to take apart a fantastic bit of #Linux #malware this week and have published the results: https://unfinished.bike/qubitstrike-and-diamorphine-linux-kernel-rootkits-go-mainstream - #QubitStrike has a bit of everything:
- Two #Linux #rootkits (kernel and user-mode)
- Process hiding
- Credential theft
- SSH backdoor
- A viral component
- A cryptocurrency miner
- Telegram integrationI had a lot of fun with this one. Now to convert these learnings into #detection rule updates!
-
#Vulnerabilities in #Supermicro #BMC s could allow for unkillable #server #rootkits https://arstechnica.com/?p=1973415
-
#Vulnerabilities in #Supermicro #BMC s could allow for unkillable #server #rootkits https://arstechnica.com/?p=1973415
-
Vulnerabilities in Supermicro BMCs could allow for unkillable server rootkits - Enlarge (credit: Getty Images)
If your organization uses serve... - https://arstechnica.com/?p=1973415 #baseboardmanagementcontrollers #vulnerabilities #security #firmware #rootkits #biz #bmcs
-
Vulnerabilities in Supermicro BMCs could allow for unkillable server rootkits - Enlarge (credit: Getty Images)
If your organization uses serve... - https://arstechnica.com/?p=1973415 #baseboardmanagementcontrollers #vulnerabilities #security #firmware #rootkits #biz #bmcs
-
Ars Technica: Vulnerabilities in Supermicro BMCs could allow for unkillable server rootkits https://arstechnica.com/?p=1973415 #Tech #arstechnica #IT #Technology #baseboardmanagementcontrollers #vulnerabilities #Security #firmware #rootkits #Biz&IT #bmcs
-
Ars Technica: Microsoft signing keys keep getting hijacked, to the delight of Chinese threat actors https://arstechnica.com/?p=1963184 #Tech #arstechnica #IT #Technology #digigalcertificate #microsoft #Security #rootkits #drivers #Windows #Biz&IT
-
Microsoft signing keys keep getting hijacked, to the delight of Chinese threat actors - Enlarge (credit: Getty Images)
In July, security researchers r... - https://arstechnica.com/?p=1963184 #digigalcertificate #microsoft #security #rootkits #drivers #windows #biz&it
-
Microsoft signing keys keep getting hijacked, to the delight of Chinese threat actors - Enlarge (credit: Getty Images)
In July, security researchers r... - https://arstechnica.com/?p=1963184 #digigalcertificate #microsoft #security #rootkits #drivers #windows #biz&it
-
Our latest post is a must-read for all #infosec enthusiasts! "
Fantastic Rootkits - Part 3" explores the challenges of SSDT hooking and global SYSCALL hook techniques in ARM64 architecture. Learn about the difficulties of finding code caves, disabling kernel write protection, and direct kernel object manipulation (DKOM).
Plus, don't miss out on our new tool, Windows On ARM Rootkit Detector (WOARKD), designed to detect rootkits on ARM64 systems.
Check it out now on our blog! 🕵️♀️🔍💻
#cybersecurity #malware #ARM64 #rootkits #WOARKD #research #tech
-
Millions of PC motherboards were sold with a firmware backdoor - Enlarge (credit: BeeBright/Getty Images)
Hiding malicious prog... - https://arstechnica.com/?p=1943487 #motherboards #security #firmware #gigabyte #rootkits #biz #tech
-
Ars Technica: Millions of PC motherboards were sold with a firmware backdoor https://arstechnica.com/?p=1943487 #Tech #arstechnica #IT #Technology #Motherboards #Security #firmware #Gigabyte #rootkits #Biz&IT #Tech