io_uring based rootkit can bypass syscall-focused Linux security tools
1–10 of 16 posts
Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#2The title is somewhat misleading, as it suggests an io_uring issue when there is none - it's just that anti-virus solutions like Microsoft Defender try to monitor syscalls but don't monitor io_uring.
They're far from guaranteed to catch things they monitor anyway, and I feel they mostly just exist to let enterprise pretend they care about security by buying ineffective band aids and duct tape. I guess a legal defense is more important than a technical one.
Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#3Seems to go back to the old pick 2 of these for your system:
* fast
* secure
* easy
Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#4The title is somewhat misleading, as it suggests an io_uring issue when there is none - it's just that anti-virus solutions like Microsoft Defender try to monitor syscalls but don't monitor io_uring. They're far from guaranteed to catch things they monitor anyway, and I feel they mostly just exist to let enterprise pretend they care about security by buying ineffective band aids and duct tape. I guess a legal defense…
You are right that this is not an io_uring issue.
I think you under estimate the value of anti-virus. Anti virus software is a good second line of defense. It’s not perfect but it will stop a lot of known malware. This has value.Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#5The title is somewhat misleading, as it suggests an io_uring issue when there is none - it's just that anti-virus solutions like Microsoft Defender try to monitor syscalls but don't monitor io_uring. They're far from guaranteed to catch things they monitor anyway, and I feel they mostly just exist to let enterprise pretend they care about security by buying ineffective band aids and duct tape. I guess a legal defense…
You are right that this is not an io_uring issue. I think you under estimate the value of anti-virus. Anti virus software is a good second line of defense. It’s not perfect but it will stop a lot of known malware. This has value.
I wouldn't consider it a second line of defense - as a rule of thumb, it will only catch old and overused attack vectors, and rarely well.
Anything novel will fly right past it, and it will have false positives. Plastering ineffective or mildly effective security everywhere in the name of "defense in depth" can have negative value as it reduces diligence in applying more relevant security measures that aren't just a random package install.
Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#6These security tools need to block any system call they don't recognize (fail closed). Obviously this breaks some apps but the alternative is huge security holes.
Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#7Earlier quoted context omitted.
You are right that this is not an io_uring issue. I think you under estimate the value of anti-virus. Anti virus software is a good second line of defense. It’s not perfect but it will stop a lot of known malware. This has value.
I wouldn't consider it a second line of defense - as a rule of thumb, it will only catch old and overused attack vectors, and rarely well. Anything novel will fly right past it, and it will have false positives. Plastering ineffective or mildly effective security everywhere in the name of "defense in depth" can have negative value as it reduces diligence in applying more relevant security measures that aren't just a…
It like the last line of defence. If you are lucky, it helps.
Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#8The title is somewhat misleading, as it suggests an io_uring issue when there is none - it's just that anti-virus solutions like Microsoft Defender try to monitor syscalls but don't monitor io_uring. They're far from guaranteed to catch things they monitor anyway, and I feel they mostly just exist to let enterprise pretend they care about security by buying ineffective band aids and duct tape. I guess a legal defense…
You are right that this is not an io_uring issue. I think you under estimate the value of anti-virus. Anti virus software is a good second line of defense. It’s not perfect but it will stop a lot of known malware. This has value.
Security software can have negative value when it increases attack surface[0], shuts down infrastructure[1], impedes productivity or pushes users towards workarounds that make things overall less secure.
[0] page 11 https://services.google.com/fh/files/misc/m-trends-2025-en.p... [1] https://news.ycombinator.com/item?id=41002195
Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#9Earlier quoted context omitted.
You are right that this is not an io_uring issue. I think you under estimate the value of anti-virus. Anti virus software is a good second line of defense. It’s not perfect but it will stop a lot of known malware. This has value.
I wouldn't consider it a second line of defense - as a rule of thumb, it will only catch old and overused attack vectors, and rarely well. Anything novel will fly right past it, and it will have false positives. Plastering ineffective or mildly effective security everywhere in the name of "defense in depth" can have negative value as it reduces diligence in applying more relevant security measures that aren't just a…
I cannot upvote this hard enough.
I see this all the time with VPNs. By having everything behind the company VPN, application security isn't taken as seriously. As a result, lateral access becomes trivial at these companies.
Keeping everything public internet exposed from the start actually results in better security.
Re: io_uring based rootkit can bypass syscall-focused Linux security tools
#10These security tools need to block any system call they don't recognize (fail closed). Obviously this breaks some apps but the alternative is huge security holes.
Maybe not blocking, but the problem is that they rely on system calls for visability for system events and that's the problem because we have mechanisms like io_uring which can allow attackers to so certain actions without making any system calls.