Matheus Alves, a security researcher specializing in malware, has published an update for the Singularity project, which develops an open rootkit for the Linux kernel and is distributed under the MIT license. The project's aim is to demonstrate methods to conceal one’s presence after gaining root access and to maintain the ability to execute privileged operations covertly. Singularity is expected to be useful for security researchers in testing and developing detection and blocking utilities for rootkits.
The rootkit is implemented as a module for Linux kernels 6.x and utilizes the ftrace mechanism to intercept system calls discreetly without altering system call entry points or modifying kernel functions. Singularity supports concealing its presence in the system, as well as hiding specified processes and associated files and network activity from attackers. For researchers' convenience, the functionality of the rootkit is divided into modules.
In addition to typical methods of hiding presence in the system, such as concealing necessary processes, files, directories, and kernel modules, Singularity incorporates several advanced techniques to bypass protection mechanisms and complicate detection by specialized rootkit scanners like Falco, ghostscan, tracee, unhide, chkrootkit, and rkhunter. Among other features, Singularity can hide its activity from tools using eBPF, remove eBPF locks, prevent kernel module loading, counter input/output analysis via the io_uring subsystem, as well as bypass integrity checks performed by the LKRG (Linux Kernel Runtime Guard) module.
Singularity includes a reverse shell that provides privileged remote access to the system through the sending of ICMP packets, as well as handlers that allow for process hiding or privilege escalation in the system via specific signal and environment variable manipulations. For example, to hide a process from /proc and the output of utilities such as ps, one can execute "kill -59 PID_процесса", and to escalate privileges, set the environment variable "MAGIC=mtz".
A rootkit elrejti a reverse shell forgalmát a hálózati elemzők elől, és lehetővé teszi a SELinux ICMP-re reagáló kezelők megkerülését. A Singularity emellett lehetőségeket kínál bizonyos hálózati kapcsolatok eltüntetésére a /proc/net/nf_conntrack, a netlink-kezelők SOCK_DIAG/NETFILTER és olyan eszközök, mint a netstat, ss, lsof, tcpdump és wireshark tábláiból. Elérhetők kezelők az audit üzenetek tisztítására és a naplózásra (klogctl, syslog, systemd-journal, /sys/kernel/debug/tracing/, dmesg). Léteznek szűrők a memóriabojtók, mint például a Volatility ellen, amelyek a /proc/kcore, /proc/kallsyms és /proc/vmallocinfo fájlokat használják, valamint a közvetlen blokkberendezésekhez való hozzáférés szűrésének lehetősége a fájlrendszer tartalmának alacsony szintű elemzésének megakadályozására.
Forrás: opennet.ru
