Viewing profile — grugq

Bulk reply to all the people replying. bink is correct. The people who buy exploits are governments. There is very little interest in Wordpress or indeed any target that isn't a br…

this is the most accurate summary.

There has been some research done on this particular anonymous newsgroup. “Deanonymising alt anonymous messages” https://www.youtube.com/watch?v=l5JBMyxvuH8 The accompanying blog p…

> Even minutiae should have a place in our collection, for things of a seemingly trifling nature, when enjoined with others of a more serious cast, may lead to valuable conclusion.…

In retrospect I really should have included the title with the link.

And you can detect when you are being ptrace()d because a process cannot be ptrace()d twice. Unless they changed Linux again. There are also timing issues that show up, and you can…

Author here. The context of this post is somewhat important. It is a direct response to a post titled: Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Thre…

Bringing your own static linked busybox will still evade that rootkit. If the attacker has modified the environment to present a specific view of system state, bringing your own en…

"Prabhakar Raghavan is killing Google" "Google's Death from Within: Prabhakar Raghavan" "Blame Prabhakar Raghavan for Google's Crappy Search" "Google Sucks. Because of Prabhakar Ra…

Oh, it’s far far worse than that. Just the core operation would be: open() — network round trip fstat() — network round trip brk() — network round trip read() — network round trip …

Merry OPSEC, and a happy OPSEC Year!

Yup, probably the more robust approach.

Syscall proxying was very old even when I wrote that article. The problem with syscall proxying is that it is slow. Take any process and imagine adding network latency to every sin…

Ah, so, in 2005 I wrote about that when I implemented rexec() — remote exec() — which takes a binary and then copies it over an arbitrary text only link (like ssh) and executes it …

The history actually goes back quite a bit further. Exactly 20 years ago I wrote and released userland exec(). https://seclists.org/bugtraq/2004/Jan/2 Good to see that the techniqu…

he was more specific, but I (a) don't remember the name off the top of my head, and (b) don't think it is beneficial to put them on blast. It isn't their fault they got hacked 20 y…

What is there to say about the hack? Like everything back then it was probably accomplished by exploiting trust relationships. I can ask him, but it is not at interesting 20 years …

the hacker. I interviewed the sysadmins about it.

Am I missing something? That seems to link to a Linux backdoor, not a backdoor in Linux.

I have the full story on that incident. It is actually really funny. If the guy who did it wants to come forward, that is his decision. [edit: I won't name names.] He did provided …

It didn’t exist when I wrote this.

The original date for this is actually 2004. Maybe 2003, but I can’t find an archival link. I wrote the code because someone asked how to do this and it was easier to implement it …

It is actually from 2004. :)