Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A free and open-source rootkit for Linux

lwn.net

Post reply on HN
Print view View original

31–40 of 44 posts

Re: A free and open-source rootkit for Linux

#31

Post by fc417fc802 »

thwarted wrote: post #29
fc417fc802 wrote: post #14

Earlier quoted context omitted.

> use LD_PRELOAD to wrap fopen/open/openat (I'm pretty sure, ready made solutions for this already exist) I think I would literally recompile libc to patch fopen/open/openat long before I would even begin to consider writing a kernel module to mess with filesystem paths on a per-process basis. I feel like if you find yourself seriously considering writing a kernel module then you are either contributing to kernel dev…

LD_PRELOAD has nothing to do with the kernel, it's entirely resolved in user space; in this context, it would be used to replace libc functions. > I think I would literally recompile libc to patch fopen/open/openat That's literally the functionality that LD_PRELOAD provides without having to recompile libc.

Yes, I am aware. I was suggesting that even going to the ridiculous length of patching and replacing libc system wide would likely make more sense than authoring a custom kernel module to accomplish most tasks for which such options are applicable.

Re: A free and open-source rootkit for Linux

#32

Post by matheuzsec »

fc417fc802 wrote: post #31
thwarted wrote: post #29

Earlier quoted context omitted.

LD_PRELOAD has nothing to do with the kernel, it's entirely resolved in user space; in this context, it would be used to replace libc functions. > I think I would literally recompile libc to patch fopen/open/openat That's literally the functionality that LD_PRELOAD provides without having to recompile libc.

Yes, I am aware. I was suggesting that even going to the ridiculous length of patching and replacing libc system wide would likely make more sense than authoring a custom kernel module to accomplish most tasks for which such options are applicable.

[dead]

Re: A free and open-source rootkit for Linux

#33

Post by [deleted] »

jraph wrote: post #2

> If one did wish to use Singularity for nefarious purposes, however, the code is MIT licensed and freely available — using it in that way would only be a crime, not an instance of copyright infringement. Too bad the author picked the MIT license. Had they picked (A)GPL, it would have forced the criminals to distribute a copy of LICENSE.TXT alongside their improved copy of the source code on systems they compromise.…

[deleted]

Re: A free and open-source rootkit for Linux

#35

Post by XorNot »

fc417fc802 wrote: post #31
thwarted wrote: post #29

Earlier quoted context omitted.

LD_PRELOAD has nothing to do with the kernel, it's entirely resolved in user space; in this context, it would be used to replace libc functions. > I think I would literally recompile libc to patch fopen/open/openat That's literally the functionality that LD_PRELOAD provides without having to recompile libc.

Yes, I am aware. I was suggesting that even going to the ridiculous length of patching and replacing libc system wide would likely make more sense than authoring a custom kernel module to accomplish most tasks for which such options are applicable.

Statically compiled binaries don't use libc. Golang is one, anything with Rust and MUSL is another, and reliably injecting an environment variables into Nix is well..not reliable. It also links its own hashed libc paths which you can't predict and which shouldn't be different to any process which isn't trying to establish TLS connections.

It's not like I didn't try this stuff.

Re: A free and open-source rootkit for Linux

#36

Post by rascul »

Onavo wrote: post #28
jraph wrote: post #2

> If one did wish to use Singularity for nefarious purposes, however, the code is MIT licensed and freely available — using it in that way would only be a crime, not an instance of copyright infringement. Too bad the author picked the MIT license. Had they picked (A)GPL, it would have forced the criminals to distribute a copy of LICENSE.TXT alongside their improved copy of the source code on systems they compromise.…

It's nice until you get spammed with emails from angry users. I think it happened to the sqlite and other popular open source project authors. Non technical users think they are polluting their computer. https://news.ycombinator.com/item?id=42358470

It happened to thttpd

https://www.acme.com/software/thttpd/repo.html

Re: A free and open-source rootkit for Linux

#38

Post by Alive-in-2025 »

rascul wrote: post #36
Onavo wrote: post #28

Earlier quoted context omitted.

It's nice until you get spammed with emails from angry users. I think it happened to the sqlite and other popular open source project authors. Non technical users think they are polluting their computer. https://news.ycombinator.com/item?id=42358470

It happened to thttpd https://www.acme.com/software/thttpd/repo.html

The person in that thread could explain the situation a lot more better to the non technical users. You could do this:

"I don't know what happened to your computer but you seem to be saying someone hacked your computer and installed some software and you found acme.com mentioned on it. This was not done by me. acme.com is open source software that is freely available to anyone. This is the same as if someone installed software on your computer that mentions the google chrome web browser - that would not indicate google had anything to do with that action, since google chrome is freely available too."

Re: A free and open-source rootkit for Linux

#39

Post by never_inline »

XorNot wrote: post #5

Man I just discovered this as a good guide on how to exceed the normal limits on Linux kernel modules. Been working on a derviative which hooks the VFS to allow dynamically remapping file paths on a per process basis so I can force badly behaved apps to load custom TLS certificates (looking at you Bazil builds in nixpkgs). (If anyone knows something which already does this it would save me a lot of yak shaving)

+1 for userns, there's also proot (userspace chroot) and fakechroot (using LD_PRELOAD).

Re: A free and open-source rootkit for Linux

#40

Post by rurban »

siliconunit wrote: post #22

as much as I'm all for the freedom of knownledge, given the sorry state of the world, releasing these tools to imbecils is not peak foresight.. mcafee for linux next ha../s

Most such rootkits source code is online and easy to find. So that rootkit finders get better.
Post reply on HN