{"id":154848,"date":"2026-01-23T23:11:55","date_gmt":"2026-01-23T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf"},"modified":"2026-01-23T23:11:55","modified_gmt":"2026-01-23T21:11:55","slug":"proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","title":{"rendered":"Singularity projekt arendab avatud rutit, mis \u00fcletab SELinux'i, Netfilter'i, LKRG ja eBPF","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Matheus Alves, turvauuringute spetsialist ja pahavara ekspert, avaldas projekti Singularity v\u00e4rskenduse, mis arendab avatud juurkomplekti Linuxi tuuma jaoks, mis on litsentseeritud MIT all. Projekti eesm\u00e4rk on demonstreerida meetodeid, mis v\u00f5imaldavad varjata oma kohalolekut p\u00e4rast root-juurdep\u00e4\u00e4su saamist ning s\u00e4ilitada v\u00f5imalus salajaste privileegitud toimingute teostamiseks. Eeldatakse, et Singularity v\u00f5ib olla kasulik turvauuringute spetsialistidele, et testida ja arendada r\u00f6tikute tuvastamise ja blokeerimise t\u00f6\u00f6riistu. <\/p>\n

R\u00f6tik on vormistatud mooduliks Linuxi 6.x tuumadele ja kasutab ftrace mehhanismi s\u00fcsteemikutsede m\u00e4rkamatuks \u00fcmberl\u00fclitamiseks ilma s\u00fcsteemikutsede sisendpunktide muutmiseta ja tuuma funktsioonide modifitseerimiseta. Singularity toetab oma kohaloleku varjamist s\u00fcsteemis, samuti r\u00fcndajate m\u00e4\u00e4ratud protsesside, failide ja v\u00f5rguaktiivsuse varjamist. Spetsialistide mugavuse huvides on r\u00f6tiku funktsionaalsus jagatud mooduliteks. <\/p>\n

Hoolimata t\u00fc\u00fcpilistest kohaloleku varjamise meetoditest, nagu vajalike protsesside, failide, kaustade ja tuumamoodulite varjamine, on Singularity-s rakendatud mitmeid t\u00e4iustatud meetodeid kaitsemehhanismide \u00fcletamiseks ja tuvastamise keerukuse suurendamiseks spetsialiseeritud r\u00f6tikute skannerite, nagu Falco, ghostscan, tracee, unhide, chkrootkit ja rkhunter suhtes. Muuhulgas suudab Singularity varjata oma tegevust eBPF-i kasutavate t\u00f6\u00f6riistade eest, eemaldada eBPF-i lukud, takistada tuumamoodulite laadimist, vastanduda sisse- ja v\u00e4ljas\u00f5idu anal\u00fc\u00fcsile io_uring alams\u00fcsteemi kaudu, samuti \u00fcletada integriteedi kontrolli, mida teostab LKRG (Linux Kernel Runtime Guard) moodul. <\/p>\n

Singularity sisaldab reverse shell'i, mis v\u00f5imaldab privileegitud kaugjuurdep\u00e4\u00e4su s\u00fcsteemile ICMP-pakettide saatmise kaudu, samuti k\u00e4itajaid, mis annavad v\u00f5imaluse varjata protsesse v\u00f5i t\u00f5sta privileege s\u00fcsteemis, tehes teatud signaalide ja keskkonnamuutujate manipulatsioone. N\u00e4iteks protsessi peitmiseks failist \/proc ja selliste utiliitide v\u00e4ljundist nagu ps v\u00f5ib k\u00e4ivitada 'kill -59 PID_protsess', ning privileegide t\u00f5stmiseks seadistada keskkonnamuutuja 'MAGIC=mtz'. <\/p>\n

Rootkit peidab reverse shell liikluse v\u00f5rguanal\u00fc\u00fcsijatelt ja v\u00f5imaldab \u00fcletada SELiNxi k\u00e4itlejat, mis aktiveerub ICMP-l. Singularity sisaldab ka v\u00f5imalusi teatud v\u00f5rgu\u00fchenduste peitmiseks tabelitest \/proc\/net\/nf_conntrack, netlink-k\u00e4itlustest SOCK_DIAG\/NETFILTER ja utiliitidest nagu netstat, ss, lsof, tcpdump ja wireshark. Saadaval on k\u00e4itlejad auditi s\u00f5numite puhastamiseks ja logidesse kirjutamiseks (klogctl, syslog, systemd-journal, \/sys\/kernel\/debug\/tracing\/, dmesg). On olemas filtrid m\u00e4luanal\u00fcsaatorite, nagu Volatility, vastu, mis kasutavad \/proc\/kcore, \/proc\/kallsyms ja \/proc\/vmallocinfo, samuti v\u00f5imalused blokeerimisseadmete otsese juurdep\u00e4\u00e4su filtreerimiseks madala taseme failis\u00fcsteemi sisu anal\u00fc\u00fcsi v\u00e4ltimiseks.

\r\n \"M\u00e4ngi\r\n
<\/div>\r\n <\/div><\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0430\u0442\u0435\u0443\u0441 \u0410\u043b\u0432\u0435\u0441 (Matheus Alves), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u041f\u041e, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Singularity, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MIT. \u0426\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u043c\u0435\u0442\u043e\u0434\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0441\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0451 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Singularity \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-154848","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Singularity projekt arendab avatud rootkit'i, mis \u00fcletab SELinuxi, Netfilteri, LKRG ja eBPF | ProHoster","description":"Matheus Alves, k\u00fcberturbe uurija, kes spetsialiseerub pahavara uurimisele, avaldas Singularity projekti uuenduse, mis arendab avatud rootkit'i Linuxi kerneli jaoks ja levitatakse litsentsi alusel.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 Singularity \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442, \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0438\u0439 SELinux, Netfilter, LKRG \u0438 eBPF | ProHoster","og:description":"\u041c\u0430\u0442\u0435\u0443\u0441 \u0410\u043b\u0432\u0435\u0441 (Matheus Alves), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u041f\u041e, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Singularity, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-23T21:11:55+00:00","article:modified_time":"2026-01-23T21:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"154848","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 21:13:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 21:11:56","updated":"2026-01-23 21:13:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/154848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=154848"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/154848\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=154848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=154848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=154848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}