Researchers from ARMO demonstrated the ability to create rootkits that do not use specific system calls to perform typical operations such as reading/writing files and receiving commands from an external server. Instead of system calls for network and file operations, it is proposed to use the asynchronous I/O interface io_uring, supported since Linux kernel 5.1.
The essence of the method is that instead of separate system calls for accessing files and performing network operations (read/write, recv/send/connect/bind/listen), one can use common system calls io_uring (io_uring_enter, io_uring_setup, io_uring_register, etc.), which are not analyzed by typical tools for detecting malicious activity. The io_uring interface supports about 60 different operations. A feature is under development that allows launching new processes through io_uring.
To demonstrate the method, a prototype rootkit called Curing was prepared, performing actions such as receiving commands from an external server and transmitting/modifying files. The demonstration involved sending a request to TCP port 8888 of an external host and sending the content of the file "/etc/shadow". It is implied that after successfully compromising the system and gaining root privileges, the attacker installs the rootkit to maintain their presence on the compromised system.
In the conducted experiment, the activity of the rootkit Curing went unnoticed by the monitoring tools Falco and Tetragon, which are used to identify security-related anomalies on hosts and in containers (integration with Kubernetes-based infrastructure is supported). These tools rely on intercepting system calls to analyze events such as process launches, network activity, and file operations, but do not account for the possibility of using the io_uring subsystem for such operations. Most commercially available Linux security incident detection and response systems also rely on intercepting system calls.
To prevent bypassing network and file activity tracking tools, it is recommended to use the KRSI (Kernel Runtime Security Instrumentation) mechanism instead of intercepting system calls. This mechanism, introduced in Linux kernel 5.7, allows attaching BPF programs to any LSM hooks. For example, KRSI at the LSM hook level enables tracking file operations, network access, and process launches, regardless of whether these operations are initiated through specific system calls or via io_uring.
Previously, the io_uring subsystem was criticized due to serious vulnerabilities that regularly emerged. In response to user requests for a straightforward way to disable io_uring without recompiling the kernel, the io_uring_disabled sysctl was added in Linux kernel 6.6. Google has disabled io_uring by default in ChromeOS, Android, and its other platforms, servers, explaining that the unfortunate security situation with io_uring outweighs the benefits of using it to enhance performance.
Source: opennet.ru
