{"id":154848,"date":"2026-01-23T23:11:55","date_gmt":"2026-01-23T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf"},"modified":"2026-01-23T23:11:55","modified_gmt":"2026-01-23T21:11:55","slug":"proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","title":{"rendered":"A Singularity projekt egy ny\u00edlt rootkitet fejleszt, amely megker\u00fcli a SELinux-t, a Netfilter-t, az LKRG-t \u00e9s az eBPF-t","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Matheus Alves, a security researcher specializing in malware, has published an update for the Singularity project, which develops an open rootkit for the Linux kernel and is distributed under the MIT license. The project's aim is to demonstrate methods to conceal one\u2019s presence after gaining root access and to maintain the ability to execute privileged operations covertly. Singularity is expected to be useful for security researchers in testing and developing detection and blocking utilities for rootkits. <\/p>\n
The rootkit is implemented as a module for Linux kernels 6.x and utilizes the ftrace mechanism to intercept system calls discreetly without altering system call entry points or modifying kernel functions. Singularity supports concealing its presence in the system, as well as hiding specified processes and associated files and network activity from attackers. For researchers' convenience, the functionality of the rootkit is divided into modules. <\/p>\n
In addition to typical methods of hiding presence in the system, such as concealing necessary processes, files, directories, and kernel modules, Singularity incorporates several advanced techniques to bypass protection mechanisms and complicate detection by specialized rootkit scanners like Falco, ghostscan, tracee, unhide, chkrootkit, and rkhunter. Among other features, Singularity can hide its activity from tools using eBPF, remove eBPF locks, prevent kernel module loading, counter input\/output analysis via the io_uring subsystem, as well as bypass integrity checks performed by the LKRG (Linux Kernel Runtime Guard) module. <\/p>\n
A Singularity-ban tal\u00e1lhat\u00f3 egy visszafejlesztett shell, amely lehet\u0151v\u00e9 teszi a rendszerhez val\u00f3 privilegiz\u00e1lt t\u00e1voli hozz\u00e1f\u00e9r\u00e9st ICMP-csomagok k\u00fcld\u00e9s\u00e9vel, valamint olyan kezel\u0151k, amelyek seg\u00edts\u00e9g\u00e9vel el\u00e9rhet\u0151 a folyamatok elrejt\u00e9se vagy a privil\u00e9giumok emel\u00e9se a rendszerben bizonyos jelek \u00e9s k\u00f6rnyezeti v\u00e1ltoz\u00f3k manipul\u00e1l\u00e1s\u00e1val. P\u00e9ld\u00e1ul a folyamat elrejt\u00e9s\u00e9hez a \\\/proc-b\u00f3l \u00e9s a ps-szer\u0171 seg\u00e9dprogramok kimenet\u00e9b\u0151l v\u00e9grehajthat\u00f3 a «kill -59 PID_folyamat», a privil\u00e9giumok emel\u00e9s\u00e9hez pedig a k\u00f6rnyezeti v\u00e1ltoz\u00f3 «MAGIC=mtz» be\u00e1ll\u00edt\u00e1sa javasolt. <\/p>\n
A rootkit elrejti a reverse shell forgalm\u00e1t a h\u00e1l\u00f3zati elemz\u0151k el\u0151l, \u00e9s lehet\u0151v\u00e9 teszi a SELinux ICMP-re reag\u00e1l\u00f3 kezel\u0151k megker\u00fcl\u00e9s\u00e9t. A Singularity emellett lehet\u0151s\u00e9geket k\u00edn\u00e1l bizonyos h\u00e1l\u00f3zati kapcsolatok elt\u00fcntet\u00e9s\u00e9re a \/proc\/net\/nf_conntrack, a netlink-kezel\u0151k SOCK_DIAG\/NETFILTER \u00e9s olyan eszk\u00f6z\u00f6k, mint a netstat, ss, lsof, tcpdump \u00e9s wireshark t\u00e1bl\u00e1ib\u00f3l. El\u00e9rhet\u0151k kezel\u0151k az audit \u00fczenetek tiszt\u00edt\u00e1s\u00e1ra \u00e9s a napl\u00f3z\u00e1sra (klogctl, syslog, systemd-journal, \/sys\/kernel\/debug\/tracing\/, dmesg). L\u00e9teznek sz\u0171r\u0151k a mem\u00f3riabojt\u00f3k, mint p\u00e9ld\u00e1ul a Volatility ellen, amelyek a \/proc\/kcore, \/proc\/kallsyms \u00e9s \/proc\/vmallocinfo f\u00e1jlokat haszn\u00e1lj\u00e1k, valamint a k\u00f6zvetlen blokkberendez\u00e9sekhez val\u00f3 hozz\u00e1f\u00e9r\u00e9s sz\u0171r\u00e9s\u00e9nek lehet\u0151s\u00e9ge a f\u00e1jlrendszer tartalm\u00e1nak alacsony szint\u0171 elemz\u00e9s\u00e9nek megakad\u00e1lyoz\u00e1s\u00e1ra.
![\"Vide\u00f3](\"https:\/\/img.youtube.com\/vi\/ByEp137w3Ks\/hqdefault.jpg\")
\r\n