{"id":120109,"date":"2024-10-08T19:09:47","date_gmt":"2024-10-08T17:09:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux"},"modified":"2024-10-08T19:09:47","modified_gmt":"2024-10-08T17:09:47","slug":"snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","title":{"rendered":"Snapekit: uus rootkit, mis sihib Arch Linuxi s\u00fcsteeme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Snapekit: <\/p>\n

Gen Threat Labs'i teadlased avastasid uue keerulise Snapekit rootkiti, mis on suunatud Arch Linuxi s\u00fcsteemile versioonis 6.10.2-arch1-1 x86_64 arhitektuuril. Snapekit v\u00f5imaldab kurjategijatel saada volitamata juurdep\u00e4\u00e4su s\u00fcsteemile ja seda juhendada, j\u00e4\u00e4des samal ajal m\u00e4rkamatuks.<\/p>\n

Rootkit integreerub operatsioonis\u00fcsteemi toimimisse, haarates ja muutes 21 s\u00fcsteemikutsungit \u2014 kommunikatsioonimehhanismi rakenduste ja operatsioonis\u00fcsteemi tuuma vahel. Snapekit kasutab spetsiaalset droppimist. Rootkit suudab tuvastada ja v\u00e4ltida populaarseid anal\u00fc\u00fcsi- ja silumist\u00f6\u00f6riistu, nagu Cuckoo Sandbox, JoeSandbox, Hybrid-Analysis, Frida, Ghidra ja IDA Pro. \u00dchegi t\u00f6\u00f6riista tuvastamisel muudab Snapekit oma k\u00e4itumist, et v\u00e4ltida avastamist.<\/p>\n

Snapekiti peamine \u00fclesanne on varjata pahavara, j\u00e4\u00e4des kasutajaruumi, mitte tuuma rangemasse keskkonda. Selline l\u00e4henemine oluliselt keerustab k\u00e4sitlemise ja anal\u00fc\u00fcsi. Lisaks rakendab rootkit PTrace kaitsere\u017eiime silumisettev\u00f5tmiste tuvastamiseks, mis lisab keerukust anal\u00fc\u00fctikute ja k\u00fcberturbe spetsialistide jaoks.<\/p>\n

Snapekit'il on mitmekihilised \u00fcmbers\u00f5idumeetodid, mis v\u00f5imaldavad v\u00e4ltida mitte ainult automatiseeritud anal\u00fc\u00fcsivahendeid (liivakastide ja virtuaalmasinad<\/a>), vaid raskendavad ka k\u00e4sitsi anal\u00fc\u00fcsi. Rootkiti looja, kes tuntud nime all Humzak711, kavatseb peagi avaldada Snapekiti avatud l\u00e4htekoodiga projekti GitHubis.<\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Gen Threat Labs \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 Snapekit, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Arch Linux \u0432\u0435\u0440\u0441\u0438\u0438 6.10.2-arch1-1 \u043d\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 x86_64. Snapekit \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0435\u044e, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0439. \u0420\u0443\u0442\u043a\u0438\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044f \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u044f 21 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432 \u2014 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u044f\u0434\u0440\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120110,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120109","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snapekit: uus rootkit, mis on suunatud Arch Linuxi s\u00fcsteemidele | ProHoster","description":"Gen Threat Labs'i teadlased avastasid uue keerulise Snapekit rootkiti, mis on suunatud Arch Linuxi s\u00fcsteemile versioonis 6.10.2-arch1-1 x86_64 arhitektuuril. Snapekit v\u00f5imaldab kurjategijatel saada volitamata juurdep\u00e4\u00e4su s\u00fcsteemile ja seda juhendada, j\u00e4\u00e4des samal ajal m\u00e4rkamatuks. Rootkit integreerub operatsioonis\u00fcsteemi toimimisse, haarates ja muutes 21 s\u00fcsteemikutsungit \u2014 kommunikatsioonimehhanismi rakenduste ja operatsioonis\u00fcsteemi tuuma vahel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snapekit: \u043d\u043e\u0432\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Arch Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Gen Threat Labs \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 Snapekit, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Arch Linux \u0432\u0435\u0440\u0441\u0438\u0438 6.10.2-arch1-1 \u043d\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 x86_64. Snapekit \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0435\u044e, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0439. \u0420\u0443\u0442\u043a\u0438\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044f \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u044f 21 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432 \u2014 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u044f\u0434\u0440\u043e\u043c","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-08T17:09:47+00:00","article:modified_time":"2024-10-08T17:09:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:33:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:10:22","updated":"2026-02-09 17:33:24"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=120109"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120109\/revisions"}],"predecessor-version":[{"id":159420,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/120109\/revisions\/159420"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/120110"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=120109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=120109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=120109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}