{"id":154848,"date":"2026-01-23T23:11:55","date_gmt":"2026-01-23T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf"},"modified":"2026-01-23T23:11:55","modified_gmt":"2026-01-23T21:11:55","slug":"proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","title":{"rendered":"Proiectul Singularity dezvolt\u0103 un rootkit open-source, care ocole\u0219te SELinux, Netfilter, LKRG \u0219i eBPF","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Matheus Alves, cercet\u0103tor \u00een domeniul securit\u0103\u021bii, specializat \u00een software-ul malware, a publicat o actualizare a proiectului Singularity, care dezvolt\u0103 un rootkit deschis pentru kernelul Linux, distribuit sub licen\u021ba MIT. Scopul proiectului este de a demonstra metode care permit ascunderea prezen\u021bei dup\u0103 ob\u021binerea accesului de root \u0219i men\u021binerea capabilit\u0103\u021bii de executare ascuns\u0103 a opera\u021biunilor privilegiate. Se consider\u0103 c\u0103 Singularity poate fi util pentru cercet\u0103torii \u00een securitate \u00een testarea \u0219i dezvoltarea utilitarelor de detectare \u0219i blocare a rootkit-urilor. <\/p>\n

Rootkit-ul este realizat sub form\u0103 de modul pentru kernelurile Linux 6.x \u0219i folose\u0219te mecanismul ftrace pentru interceptarea discret\u0103 a apelurilor de sistem f\u0103r\u0103 a modifica punctele de intrare \u00een apelurile de sistem \u0219i f\u0103r\u0103 a altera func\u021biile kernelului. Singularity suport\u0103 ascunderea prezen\u021bei sale \u00een sistem, precum \u0219i ascunderea proceselor designate de atacatori, a fi\u0219ierelor asociate \u0219i a activit\u0103\u021bii de re\u021bea. Pentru comoditatea cercet\u0103torilor, func\u021bionalitatea rootkit-ului este \u00eemp\u0103r\u021bit\u0103 pe module. <\/p>\n

Pe l\u00e2ng\u0103 metodele tipice de mascare a prezen\u021bei \u00een sistem, cum ar fi ascunderea proceselor, fi\u0219ierelor, directoarelor \u0219i modulelor kernelului, Singularity implementeaz\u0103 c\u00e2teva metode avansate de ocolire a mecanismelor de protec\u021bie \u0219i de dificultate \u00een detectarea de c\u0103tre scanerele de rootkit specializate, cum ar fi Falco, ghostscan, tracee, unhide, chkrootkit \u0219i rkhunter. Printre altele, Singularity poate ascunde activitatea sa de la instrumentele care folosesc eBPF, elimina restric\u021biile eBPF, \u00eempiedica \u00eenc\u0103rcarea modulelor kernelului, rezista analizei input\/output prin subsistemul io_uring \u0219i ocoli verific\u0103rile de integritate efectuate de modulul LKRG (Linux Kernel Runtime Guard). <\/p>\n

\u00cen Singularity exist\u0103 un reverse shell, care ofer\u0103 acces privilegiat la sistem prin trimiterea de pachete ICMP, precum \u0219i manipulatoare care permit ascunderea proceselor sau cre\u0219terea privilegiilor \u00een sistem prin anumite manipul\u0103ri cu semnale \u0219i variabile de mediu. De exemplu, pentru a ascunde un proces din \/proc \u0219i a produce ie\u0219iri ale utilitarelor, cum ar fi ps, se poate executa \"kill -59 PID_procesului\", iar pentru a spori privilegiile se poate seta variabila de mediu \"MAGIC=mtz\". <\/p>\n

Rootkit-ul ascunde traficul reverse shell de analizele de re\u021bea \u0219i permite ocolirea proceselor SELinux care se activeaz\u0103 la ICMP. Singularity include de asemenea func\u021bionalit\u0103\u021bi pentru a ascunde anumite conexiuni de re\u021bea din tabelele \/proc\/net\/nf_conntrack, gestionarii netlink SOCK_DIAG\/NETFILTER \u0219i utilit\u0103\u021bi precum netstat, ss, lsof, tcpdump \u0219i wireshark. Exist\u0103 gestionari pentru cur\u0103\u021barea mesajelor de audit \u0219i raportarea \u00een jurnale (klogctl, syslog, systemd-journal, \/sys\/kernel\/debug\/tracing\/, dmesg). Dispunem de filtre pentru a contracara analizoarele de memorie, cum ar fi Volatility, care utilizeaz\u0103 \/proc\/kcore, \/proc\/kallsyms \u0219i \/proc\/vmallocinfo, precum \u0219i func\u021bionalit\u0103\u021bi de filtrare a accesului direct la dispozitivele de bloc pentru a preveni analiza la nivel sc\u0103zut a con\u021binutului sistemului de fi\u0219iere.

\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0430\u0442\u0435\u0443\u0441 \u0410\u043b\u0432\u0435\u0441 (Matheus Alves), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u041f\u041e, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Singularity, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439 MIT. \u0426\u0435\u043b\u044c\u044e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u044f \u043c\u0435\u0442\u043e\u0434\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0445 \u0441\u043a\u0440\u044b\u0442\u044c \u0441\u0432\u043e\u0451 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e Singularity \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u043b\u0435\u0437\u0435\u043d \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-154848","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Proiectul Singularity dezvolt\u0103 un rootkit open-source care ocole\u0219te SELinux, Netfilter, LKRG \u0219i eBPF | ProHoster","description":"Matheus Alves, cercet\u0103tor \u00een securitate specializat \u00een malware, a publicat o actualizare a proiectului Singularity, care dezvolt\u0103 un rootkit open-source pentru nucleul Linux, distribuit sub licen\u021b\u0103.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u043e\u0435\u043a\u0442 Singularity \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u0442 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442, \u043e\u0431\u0445\u043e\u0434\u044f\u0449\u0438\u0439 SELinux, Netfilter, LKRG \u0438 eBPF | ProHoster","og:description":"\u041c\u0430\u0442\u0435\u0443\u0441 \u0410\u043b\u0432\u0435\u0441 (Matheus Alves), \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439\u0441\u044f \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c \u041f\u041e, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Singularity, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0440\u0443\u0442\u043a\u0438\u0442 \u0434\u043b\u044f \u044f\u0434\u0440\u0430 Linux, \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0435\u0439.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-01-23T21:11:55+00:00","article:modified_time":"2026-01-23T21:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"154848","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 21:13:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 21:11:56","updated":"2026-01-23 21:13:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/154848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=154848"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/154848\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=154848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=154848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=154848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}