Live data from Hacker News

A free and open-source rootkit for Linux

lwn.net

21–30 of 44 posts

Re: A free and open-source rootkit for Linux

#21
post #2

> If one did wish to use Singularity for nefarious purposes, however, the code is MIT licensed and freely available — using it in that way would only be a crime, not an instance of copyright infringement. Too bad the author picked the MIT license. Had they picked (A)GPL, it would have forced the criminals to distribute a copy of LICENSE.TXT alongside their improved copy of the source code on systems they compromise.…

HAHAHAHAHAH I genuinely laughed a lot, thank you

Re: A free and open-source rootkit for Linux

#23
post #4

Earlier quoted context omitted.

I don't know about you, but for ethical reasons, I only allow libre rootkits to run on my systems.

It's just like a gun free zone. You glue a prominent sign to your laptop that uses bright colors and an imposing font. "No proprietary software permitted!" Problem solved.

i think this comment is referring to the uniquely american controversy over "gun free zones", ie zones where... you aren't allowed to carry firearms by law, often marked with a sign

which i find very entertaining, saying "a sign can't stop a criminal!" as if that's not the case with any law enforced via threat of criminal prosecution

Re: A free and open-source rootkit for Linux

#24

> The Ftrace mechanism can be disabled at run time, of course — so Singularity helpfully enables it automatically and blocks any attempts to turn it off. Can a kernel be compiled with Ftrace forced off? If it can be disabled at runtime, I take it it's not mandatory for the kernel to work. And I don't just mean off: I mean striping the Ftrace code path (dead code elimination or whatever). I'm also interested in other…

Looks like yes

grep FTRACE /boot/config*

Re: A free and open-source rootkit for Linux

#25

as much as I'm all for the freedom of knownledge, given the sorry state of the world, releasing these tools to imbecils is not peak foresight.. mcafee for linux next ha../s

Public Linux rootkits have been around a very very long time. Nothing new here in that regard. Also Linux AV has been around almost as long…

This effort is more useful to up and coming defenders and security researchers than attackers by far.

Re: A free and open-source rootkit for Linux

#27
post #2

> If one did wish to use Singularity for nefarious purposes, however, the code is MIT licensed and freely available — using it in that way would only be a crime, not an instance of copyright infringement. Too bad the author picked the MIT license. Had they picked (A)GPL, it would have forced the criminals to distribute a copy of LICENSE.TXT alongside their improved copy of the source code on systems they compromise.…

> crime and an instance of copyright infringement.

Well-made distinction; +1.

Re: A free and open-source rootkit for Linux

#28
post #2

> If one did wish to use Singularity for nefarious purposes, however, the code is MIT licensed and freely available — using it in that way would only be a crime, not an instance of copyright infringement. Too bad the author picked the MIT license. Had they picked (A)GPL, it would have forced the criminals to distribute a copy of LICENSE.TXT alongside their improved copy of the source code on systems they compromise.…

It's nice until you get spammed with emails from angry users. I think it happened to the sqlite and other popular open source project authors. Non technical users think they are polluting their computer.

https://news.ycombinator.com/item?id=42358470

Re: A free and open-source rootkit for Linux

#29

Earlier quoted context omitted.

> how to exceed the normal limits on Linux kernel modules. Uh, what limits? I'm not aware of anything that would stop your module, once probed, from reaching around the back of the kernel and futzing around in the internals of another driver/device in a completely unrelated subsystem, or subsystem internals. SoC/SoM vendors love to pull that kind of crap in their BSPs. > hooks the VFS to allow dynamically remapping f…

> use LD_PRELOAD to wrap fopen/open/openat (I'm pretty sure, ready made solutions for this already exist) I think I would literally recompile libc to patch fopen/open/openat long before I would even begin to consider writing a kernel module to mess with filesystem paths on a per-process basis. I feel like if you find yourself seriously considering writing a kernel module then you are either contributing to kernel dev…

LD_PRELOAD has nothing to do with the kernel, it's entirely resolved in user space; in this context, it would be used to replace libc functions.

> I think I would literally recompile libc to patch fopen/open/openat

That's literally the functionality that LD_PRELOAD provides without having to recompile libc.

Re: A free and open-source rootkit for Linux

#30

Earlier quoted context omitted.

It's just like a gun free zone. You glue a prominent sign to your laptop that uses bright colors and an imposing font. "No proprietary software permitted!" Problem solved.

i think this comment is referring to the uniquely american controversy over "gun free zones", ie zones where... you aren't allowed to carry firearms by law, often marked with a sign which i find very entertaining, saying "a sign can't stop a criminal!" as if that's not the case with any law enforced via threat of criminal prosecution

I don't think I'd call it a controversy exactly. There are places where the signs make sense (ex court buildings) and then there are places where they are purely performative. When a school in the ghetto that suffers gang related violence prominently posts such signs they rightfully get made fun of. Meanwhile most schools (at least where I grew up) either don't bother to post such signs or only post a subdued "all weapons illegal" near the entrance (that includes even pocket knives BTW it's not just a gun thing).

Another great one is "drug free zone" seen plastered all over a seedy highschool. Drugs are blanket illegal everywhere here. The US has made an art form out of persecuting drug users. We've peddled our "war on drugs" globally. What could possibly be the point of posting such a sign?

Post reply on HN