{"id":154848,"date":"2026-01-23T23:11:55","date_gmt":"2026-01-23T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf"},"modified":"2026-01-23T23:11:55","modified_gmt":"2026-01-23T21:11:55","slug":"proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","title":{"rendered":"Projekt Singularity rozv\u00edj\u00ed otev\u0159en\u00fd rootkit, kter\u00fd obch\u00e1z\u00ed SELinux, Netfilter, LKRG a eBPF","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Matheus Alves, bezpe\u010dnostn\u00ed v\u00fdzkumn\u00edk specializuj\u00edc\u00ed se na malware, zve\u0159ejnil aktualizaci projektu Singularity, kter\u00fd vyv\u00edj\u00ed otev\u0159en\u00fd rootkit pro j\u00e1dro Linux \u0161\u00ed\u0159en\u00fd pod licenc\u00ed MIT. C\u00edlem projektu je demonstrovat metody, kter\u00e9 umo\u017e\u0148uj\u00ed skr\u00fdt svou p\u0159\u00edtomnost po z\u00edsk\u00e1n\u00ed root p\u0159\u00edstupu a udr\u017eet mo\u017enost skryt\u00e9ho prov\u00e1d\u011bn\u00ed privilegovan\u00fdch operac\u00ed. P\u0159edpokl\u00e1d\u00e1 se, \u017ee Singularity m\u016f\u017ee b\u00fdt u\u017eite\u010dn\u00fd bezpe\u010dnostn\u00edm v\u00fdzkumn\u00edk\u016fm pro testov\u00e1n\u00ed a v\u00fdvoj n\u00e1stroj\u016f pro detekci a blokaci rootkit\u016f. <\/p>\n

Rootkit je vytvo\u0159en jako modul pro j\u00e1dra Linux 6.x a pou\u017e\u00edv\u00e1 mechanismus ftrace k neviditeln\u00e9mu zachycov\u00e1n\u00ed syst\u00e9mov\u00fdch vol\u00e1n\u00ed bez zm\u011bny vstupn\u00edch bod\u016f do syst\u00e9mov\u00fdch vol\u00e1n\u00ed a bez modifikace funkc\u00ed j\u00e1dra. Singularity podporuje skr\u00fdv\u00e1n\u00ed sv\u00e9 p\u0159\u00edtomnosti v syst\u00e9mu, stejn\u011b jako skr\u00fdv\u00e1n\u00ed ur\u010den\u00fdch \u00fato\u010dnick\u00fdch proces\u016f a souvisej\u00edc\u00edch soubor\u016f a s\u00ed\u0165ov\u00e9 aktivity. Pro pohodl\u00ed v\u00fdzkumn\u00edk\u016f je funk\u010dnost rootkitu rozd\u011blena na moduly. <\/p>\n

Krom\u011b standardn\u00edch metod skr\u00fdv\u00e1n\u00ed p\u0159\u00edtomnosti v syst\u00e9mu, jako je skr\u00fdv\u00e1n\u00ed nezbytn\u00fdch proces\u016f, soubor\u016f, adres\u00e1\u0159\u016f a modul\u016f j\u00e1dra, obsahuje Singularity n\u011bkolik pokro\u010dil\u00fdch metod obch\u00e1zen\u00ed ochrann\u00fdch mechanism\u016f a zt\u011b\u017eov\u00e1n\u00ed detekce specializovan\u00fdmi skenery rootkit\u016f, jako jsou Falco, ghostscan, tracee, unhide, chkrootkit a rkhunter. Mezi dal\u0161\u00edmi funkcemi m\u016f\u017ee Singularity skr\u00fdvat svou aktivitu p\u0159ed n\u00e1stroji pou\u017e\u00edvaj\u00edc\u00edmi eBPF, odstra\u0148ovat blokace eBPF, br\u00e1nit na\u010d\u00edt\u00e1n\u00ed modul\u016f j\u00e1dra, odol\u00e1vat anal\u00fdze vstupu\/v\u00fdstupu p\u0159es subsyst\u00e9m io_uring a tak\u00e9 obch\u00e1zet kontroly integrity prov\u00e1d\u011bn\u00e9 modulem LKRG (Linux Kernel Runtime Guard). <\/p>\n

V Singularity je p\u0159\u00edtomen reverse shell, kter\u00fd poskytuje privilegovan\u00fd vzd\u00e1len\u00fd p\u0159\u00edstup k syst\u00e9mu prost\u0159ednictv\u00edm odes\u00edl\u00e1n\u00ed ICMP paket\u016f, a tak\u00e9 zpracovatele, kter\u00e9 umo\u017e\u0148uj\u00ed skr\u00fdt procesy nebo zv\u00fd\u0161it privilegium v syst\u00e9mu prost\u0159ednictv\u00edm ur\u010dit\u00fdch manipulac\u00ed se sign\u00e1ly a prom\u011bnn\u00fdmi prost\u0159ed\u00ed. Nap\u0159\u00edklad k skryt\u00ed procesu z \/proc a v\u00fdstupu utilit, jako je ps, lze prov\u00e9st \u201ekill -59 PID_procesu\u201c, a pro zv\u00fd\u0161en\u00ed privilegium nastavit prom\u011bnnou prost\u0159ed\u00ed \u201eMAGIC=mtz\u201c. <\/p>\n

Rootkit skr\u00fdv\u00e1 provoz reverse shell p\u0159ed s\u00ed\u0165ov\u00fdmi analyz\u00e1tory a umo\u017e\u0148uje obch\u00e1zet zpracovatele SELinux, kter\u00e9 reaguj\u00ed na ICMP. Singularity tak\u00e9 zahrnuje mo\u017enosti pro skr\u00fdv\u00e1n\u00ed ur\u010dit\u00fdch s\u00ed\u0165ov\u00fdch p\u0159ipojen\u00ed z tabulek \/proc\/net\/nf_conntrack, netlink-zpracovatel\u016f SOCK_DIAG\/NETFILTER a n\u00e1stroj\u016f jako netstat, ss, lsof, tcpdump a wireshark. Jsou k dispozici zpracovatel\u00e9 pro \u010di\u0161t\u011bn\u00ed auditorsk\u00fdch zpr\u00e1v a v\u00fdstupu do log\u016f (klogctl, syslog, systemd-journal, \/sys\/kernel\/debug\/tracing\/, dmesg). Existuj\u00ed filtry pro odol\u00e1v\u00e1n\u00ed analyz\u00e1tor\u016fm pam\u011bti, jako je Volatility, kter\u00e9 pou\u017e\u00edvaj\u00ed \/proc\/kcore, \/proc\/kallsyms a \/proc\/vmallocinfo, stejn\u011b jako mo\u017enosti filtrov\u00e1n\u00ed p\u0159\u00edm\u00e9ho p\u0159\u00edstupu k blokov\u00fdm za\u0159\u00edzen\u00edm pro prevenci n\u00edzko\u00farov\u0148ov\u00e9 anal\u00fdzy obsahu FS.

\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0430\u0442\u0435\u0443\u0441 \u0410\u043b\u0432\u0435\u0441 (Matheus Alves), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u041f\u041e, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Singularity, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MIT. \u0426\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u043c\u0435\u0442\u043e\u0434\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0441\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0451 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Singularity \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-154848","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Projekt Singularity vyv\u00edj\u00ed otev\u0159en\u00fd rootkit, kter\u00fd obch\u00e1z\u00ed SELinux, Netfilter, LKRG a eBPF | ProHoster","description":"Matheus Alves, bezpe\u010dnostn\u00ed v\u00fdzkumn\u00edk specializuj\u00edc\u00ed se na malware, publikoval aktualizaci projektu Singularity, kter\u00fd vyv\u00edj\u00ed otev\u0159en\u00fd rootkit pro j\u00e1dro Linuxu, distribuovan\u00fd pod licenc\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 Singularity \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442, \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0438\u0439 SELinux, Netfilter, LKRG \u0438 eBPF | ProHoster","og:description":"\u041c\u0430\u0442\u0435\u0443\u0441 \u0410\u043b\u0432\u0435\u0441 (Matheus Alves), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u041f\u041e, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Singularity, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-23T21:11:55+00:00","article:modified_time":"2026-01-23T21:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"154848","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 21:13:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 21:11:56","updated":"2026-01-23 21:13:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/154848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=154848"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/154848\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=154848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=154848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=154848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}