{"id":120109,"date":"2024-10-08T19:09:47","date_gmt":"2024-10-08T17:09:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux"},"modified":"2024-10-08T19:09:47","modified_gmt":"2024-10-08T17:09:47","slug":"snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","title":{"rendered":"Snapekit: un nou rootkit destinat sistemelor Arch Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Snapekit: <\/p>\n

Cercet\u0103torii de la Gen Threat Labs au identificat un nou rootkit complex, Snapekit, care vizeaz\u0103 sistemul Arch Linux versiunea 6.10.2-arch1-1 pe arhitectura x86_64. Snapekit le permite atacatorilor s\u0103 ob\u021bin\u0103 acces neautorizat la sistem \u0219i s\u0103 \u00eel controleze, r\u0103m\u00e2n\u00e2nd \u00een acela\u0219i timp neobserva\u021bi.<\/p>\n

Rootkit-ul se integreaz\u0103 \u00een func\u021bionarea sistemului de operare, intercept\u00e2nd \u0219i modific\u00e2nd 21 de apeluri de sistem \u2014 un mecanism de comunicare \u00eentre aplica\u021bii \u0219i nucleul sistemului de operare. Snapekit utilizeaz\u0103 un dropper special pentru desf\u0103\u0219urare. Rootkit-ul este capabil s\u0103 recunoasc\u0103 \u0219i s\u0103 evite instrumentele populare de analiz\u0103 \u0219i depanare, cum ar fi Cuckoo Sandbox, JoeSandbox, Hybrid-Analysis, Frida, Ghidra \u0219i IDA Pro. La detectarea unuia dintre aceste instrumente, Snapekit \u00ee\u0219i schimb\u0103 comportamentul pentru a evita descoperirea.<\/p>\n

Principala sarcin\u0103 a Snapekit este de a ascunde codul mali\u021bios, r\u0103m\u00e2n\u00e2nd \u00een spa\u021biul utilizatorului \u0219i nu \u00een spa\u021biul mai controlat al nucleului. Aceast\u0103 abordare complic\u0103 semnificativ detectarea \u0219i analiza amenin\u021b\u0103rii. \u00cen plus, rootkit-ul aplic\u0103 mecanisme de protec\u021bie PTrace pentru a identifica tentativele de depanare, ceea ce adaug\u0103 dificult\u0103\u021bi pentru anali\u0219ti \u0219i speciali\u0219ti \u00een securitate.<\/p>\n

Snapekit dispune de mijloace de ocolire multilayer care permit evitarea nu doar a instrumentelor automate de analiz\u0103 (sandbox-uri \u0219i ma\u0219ini virtuale<\/a>), dar \u0219i dificult\u0103\u021be \u00een analiza manual\u0103. Creatorul rootkit-ului, cunoscut sub pseudonimul Humzak711, inten\u021bioneaz\u0103 s\u0103 publice \u00een cur\u00e2nd proiectul Snapekit cu cod surs\u0103 deschis pe GitHub.<\/p>\n

Sursa: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Gen Threat Labs \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u0441\u043b\u043e\u0436\u043d\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 Snapekit, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Arch Linux \u0432\u0435\u0440\u0441\u0438\u0438 6.10.2-arch1-1 \u043d\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0435 x86_64. Snapekit \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0435\u044e, \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u043e\u0439. \u0420\u0443\u0442\u043a\u0438\u0442 \u0432\u043d\u0435\u0434\u0440\u044f\u0435\u0442\u0441\u044f \u0432 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u044b\u0432\u0430\u044f \u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u044f 21 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0432\u044b\u0437\u043e\u0432 \u2014 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u0438 \u043c\u0435\u0436\u0434\u0443 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u044f\u0434\u0440\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":120110,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-120109","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Snapekit: noul rootkit destinat sistemelor Arch Linux | ProHoster","description":"Cercet\u0103torii de la Gen Threat Labs.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Snapekit: \u043d\u043e\u0432\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Arch Linux | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 Gen Threat Labs.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/snapekit-novyj-rutkit-naczelennyj-na-sistemy-arch-linux","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-10-08T17:09:47+00:00","article:modified_time":"2024-10-08T17:09:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"120109","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:33:24","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 07:10:22","updated":"2026-02-09 17:33:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120109","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=120109"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120109\/revisions"}],"predecessor-version":[{"id":159420,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/120109\/revisions\/159420"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/120110"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=120109"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=120109"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=120109"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}