{"id":154848,"date":"2026-01-23T23:11:55","date_gmt":"2026-01-23T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf"},"modified":"2026-01-23T23:11:55","modified_gmt":"2026-01-23T21:11:55","slug":"proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","title":{"rendered":"Singularity projekt arendab avatud ruttkit'i, mis m\u00f6\u00f6dub SELinux'ist, Netfilter'ist, LKRG-st ja eBPF-st.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Matheus Alves, k\u00fcberturbe uurija, kes spetsialiseerub pahavarale, avaldas Singularity projekti v\u00e4rskenduse, mis arendab avatud l\u00e4htekoodiga Linuxi kernelile m\u00f5eldud rootkit'i, mida levitatakse MIT litsentsi alusel. Projekti eesm\u00e4rk on demonstreerida meetodeid, mis v\u00f5imaldavad peita oma kohalolekut p\u00e4rast root-juurdep\u00e4\u00e4su saavutamist ning s\u00e4ilitada v\u00f5imaluse varjatud privileege tegevusi sooritada. Singularity v\u00f5ib olla kasulik k\u00fcberturbe uurijatele ridade ja blokivahendite testimise ja arendamise jaoks. <\/p>\n

Rootkit on vormistatud moodulina Linuxi 6.x kernelitele ja kasutab ftrace mehhanismi s\u00fcsteemik\u00f5nede m\u00e4rkamatuks juhtimiseks ilma s\u00fcsteemik\u00f5nede sisenemise punktide muutmiseta v\u00f5i kernelifunktsioonide modifitseerimiseta. Singularity toetab oma kohaloleku peitmist s\u00fcsteemis, samuti r\u00fcndaja m\u00e4\u00e4ratud protsesside ja nendega seotud failide ning v\u00f5rgutegevuse peitmist. Mugavuse huvides on rootkit'i funktsionaalsus jagatud mooduliteks. <\/p>\n

Lisaks tavap\u00e4rastele s\u00fcsteemis varjumise meetoditele, nagu vajalike protsesside, failide, kataloogide ja yadi moodulite peitmine, sisaldab Singularity mitmeid arenenud meetodeid kaitsemehhanismide \u00fcmbersuunamiseks ja spetsialiseeritud rootkit-skannerite, nagu Falco, ghostscan, tracee, unhide, chkrootkit ja rkhunter, avastamise raskendamiseks. Muuhulgas suudab Singularity varjata oma tegevust eBPF-i kasutavate t\u00f6\u00f6riistade eest, eemaldada eBPF-i blokeeringud, takistada yadi moodulite laadimist, vastanduda io_uring'i allj\u00e4rgse I\/O anal\u00fc\u00fcsile ning k\u00f5rvale hiilida LKRG (Linux Kernel Runtime Guard) mooduli teostatud terviklikkuse kontrollidest. <\/p>\n

Singularity sisaldab tagauksena sebivat shell'i, mis v\u00f5imaldab privileegitud kaugjuurdep\u00e4\u00e4su s\u00fcsteemile ICMP-pakettide saatmise kaudu, samuti k\u00e4sitlejaid, mis pakuvad v\u00f5imalust protsesside varjamiseks v\u00f5i privileegide t\u00f5stmiseks s\u00fcsteemis teatud signaalide ja keskkonnamuutujatega manipuleerimise kaudu. N\u00e4iteks protsessi varjamiseks \/proc-st ja selliste utiliitide, nagu ps, v\u00e4ljundist eemaldamiseks v\u00f5ib kasutada k\u00e4sku \"kill -59 PID_protsessi\", ning privileegide t\u00f5stmiseks seadistada keskkonnamuutuja \"MAGIC=mtz\". <\/p>\n

Ruutkit varjab reverse shell'i liiklust v\u00f5rguanal\u00fcsaatorite eest ja v\u00f5imaldab v\u00e4ltida SELinux'i t\u00f6\u00f6tlusi, mis aktiveeruvad ICMP korral. Singularity sisaldab ka v\u00f5imalusi teatud v\u00f5rgusidemeid \"\/proc\/net\/nf_conntrack\" tabelitest, netlink t\u00f6\u00f6tlijatelt SOCK_DIAG \/ NETFILTER ja sarnastelt utiliitidelt nagu netstat, ss, lsof, tcpdump ja wireshark varjata. Saadaval on t\u00f6\u00f6tlijad audititeate puhastamiseks ja logide v\u00e4ljundiks (klogctl, syslog, systemd-journal, \"\/sys\/kernel\/debug\/tracing\/\", dmesg). On olemas filtrid m\u00e4luanal\u00fcsaatorite, nagu Volatility, mis kasutavad \"\/proc\/kcore\", \"\/proc\/kallsyms\" ja \"\/proc\/vmallocinfo\" vastu ning v\u00f5imalused otsese juurdep\u00e4\u00e4su blokeerimiseks plokkseadmetele, et v\u00e4ltida madala taseme failis\u00fcsteemi sisu anal\u00fc\u00fcsi.

\r\n \"Vaata\r\n
<\/div>\r\n <\/div><\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0430\u0442\u0435\u0443\u0441 \u0410\u043b\u0432\u0435\u0441 (Matheus Alves), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u041f\u041e, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Singularity, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MIT. \u0426\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u043c\u0435\u0442\u043e\u0434\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0441\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0451 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Singularity \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-154848","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Singularity projekt arendab avatud allikaga juurkomplekti, mis \u00fcletab SELinuxi, Netfilterit, LKRG ja eBPF | ProHoster","description":"Matheus Alves, turvateadur, kes spetsialiseerub pahavarale, on avaldanud uuenduse Singularity projekti kohta, mis arendab avatud allikaga Linuxi kerneli juurkomplekti, millel on MIT-litsents. Projekti eesm\u00e4rk on demonstreerida meetodeid, mille abil on v\u00f5imalik peita oma kohalolek p\u00e4rast juuraccessi omandamist ning s\u00e4ilitada varjate privileegide teostamise v\u00f5imalus. Eeldatakse, et Singularity v\u00f5ib olla kasulik turvaekspertidele testimiseks ja arendamiseks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 Singularity \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442, \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0438\u0439 SELinux, Netfilter, LKRG \u0438 eBPF | ProHoster","og:description":"\u041c\u0430\u0442\u0435\u0443\u0441 \u0410\u043b\u0432\u0435\u0441 (Matheus Alves), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u041f\u041e, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Singularity, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MIT. \u0426\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u043c\u0435\u0442\u043e\u0434\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0441\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0451 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Singularity \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-23T21:11:55+00:00","article:modified_time":"2026-01-23T21:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"154848","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 21:13:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 21:11:56","updated":"2026-01-23 21:13:06"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/154848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=154848"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/154848\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=154848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=154848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=154848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}