Matheus Alves, a security researcher specializing in malware, has published an update on the Singularity project, which develops an open-source rootkit for the Linux kernel, distributed under the MIT license. The project's aim is to demonstrate methods for hiding one's presence after gaining root access while maintaining the ability to execute privileged operations covertly. It is believed that Singularity could be useful for security researchers in testing and developing detection and blocking utilities for rootkits.
The rootkit is designed as a module for Linux kernels 6.x and uses the ftrace mechanism to unobtrusively intercept system calls without altering system call entry points or modifying kernel functions. Singularity supports the concealment of its presence in the system, as well as hiding processes specified by an attacker and related files and network activity. For researchers' convenience, the rootkit's functionality is divided into modules.
In addition to typical methods of hiding presence in the system, such as concealing necessary processes, files, directories, and kernel modules, Singularity implements several advanced methods to bypass protection mechanisms and complicate detection by specialized rootkit scanners such as Falco, ghostscan, tracee, unhide, chkrootkit, and rkhunter. Among other things, Singularity can hide its activity from tools utilizing eBPF, remove eBPF locks, prevent kernel module loading, resist input/output analysis via the io_uring subsystem, and circumvent integrity checks conducted by the LKRG (Linux Kernel Runtime Guard) module.
Singularity includes a reverse shell that provides privileged remote access to the system by sending ICMP packets, as well as handlers that allow for the concealment of processes or the elevation of privileges in the system through specific manipulations with signals and environment variables. For instance, to hide a process from /proc and the output of utilities such as ps, one might execute "kill -59 PID_process", and to escalate privileges, set the environment variable "MAGIC=mtz".
The rootkit hides reverse shell traffic from network analyzers and allows bypassing SELinux handlers that trigger on ICMP. Singularity also includes capabilities to hide certain network connections from the tables /proc/net/nf_conntrack, netlink handlers SOCK_DIAG/NETFILTER, and utilities like netstat, ss, lsof, tcpdump, and wireshark. Handlers are available for cleaning audit messages and logging outputs (klogctl, syslog, systemd-journal, /sys/kernel/debug/tracing/, dmesg). There are filters to counter memory analyzers such as Volatility, which use /proc/kcore, /proc/kallsyms, and /proc/vmallocinfo, as well as capabilities for filtering direct access to block devices to prevent low-level content analysis of the filesystem.
Source: opennet.ru
