{"id":154848,"date":"2026-01-23T23:11:55","date_gmt":"2026-01-23T21:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf"},"modified":"2026-01-23T23:11:55","modified_gmt":"2026-01-23T21:11:55","slug":"proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/proekt-singularity-razvivaet-otkrytyj-rutkit-obhodyashhij-selinux-netfilter-lkrg-i-ebpf","title":{"rendered":"Projekti Singularity zhvillon nj\u00eb rootkit t\u00eb hapur q\u00eb kalon SELinux, Netfilter, LKRG dhe eBPF","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Matheus Alves, nj\u00eb hulumtues sigurie q\u00eb specializohet n\u00eb malware, publikoi nj\u00eb p\u00ebrdit\u00ebsim t\u00eb projektit Singularity, i cili zhvillon nj\u00eb rutit t\u00eb hapur p\u00ebr b\u00ebrtham\u00ebn Linux, i shp\u00ebrndar\u00eb n\u00ebn licenc\u00ebn MIT. Q\u00ebllimi i projektit \u00ebsht\u00eb t\u00eb demonstroj\u00eb metoda q\u00eb lejojn\u00eb fshehjen e pranish\u00ebm pas marrjes s\u00eb aksesit root dhe t\u00eb ruaj\u00eb mund\u00ebsin\u00eb e ekzekutimit t\u00eb fsheht\u00eb t\u00eb operacioneve privilegjuese. Suppozimi \u00ebsht\u00eb se Singularity mund t\u00eb jet\u00eb e dobishme p\u00ebr hulumtuesit e siguris\u00eb p\u00ebr testimin dhe zhvillimin e mjeteve p\u00ebr identifikimin dhe bllokimin e rutit\u00ebve. <\/p>\n
Rutiti \u00ebsht\u00eb formatuar si nj\u00eb modul p\u00ebr b\u00ebrthamat Linux 6.x dhe p\u00ebrdor mekanizmin ftrace p\u00ebr t\u00eb interceptuar thirrjet sistemore pa ndryshuar piketat e hyrjes s\u00eb thirrjeve sistemore dhe pa modifikuar funksionet e b\u00ebrtham\u00ebs. Singularity mb\u00ebshtet fshehjen e pranish\u00ebm n\u00eb sistem, si dhe fshehjen e proceseve t\u00eb caktuara nga sulmuesi dhe dosjeve t\u00eb lidhura me to dhe aktivitetit rrjetor. P\u00ebr sh\u00ebrbimin e hulumtuesve, funksionaliteti i rutitit \u00ebsht\u00eb ndar\u00eb n\u00eb module. <\/p>\n
P\u00ebrve\u00e7 metodave standarde t\u00eb fshehjes s\u00eb pranish\u00ebm n\u00eb sistem, t\u00eb tilla si fshehja e proceseve, dosjeve, katalog\u00ebve dhe moduleve t\u00eb b\u00ebrtham\u00ebs, n\u00eb Singularity jan\u00eb implementuar disa metoda t\u00eb p\u00ebrparuara p\u00ebr kap\u00ebrcimin e mekanizmave t\u00eb mbrojtjes dhe p\u00ebr t\u00eb v\u00ebshtir\u00ebsuar zbulimin nga skaner\u00ebt e specializuar t\u00eb rutit\u00ebve, si Falco, ghostscan, tracee, unhide, chkrootkit dhe rkhunter. Mes t\u00eb tjerash, Singularity mund t\u00eb fsheh\u00eb aktivitetet e tij nga mjetet q\u00eb p\u00ebrdorin eBPF, t\u00eb heq\u00eb bllokimet e eBPF, t\u00eb parandaloj\u00eb ngarkimin e moduleve t\u00eb b\u00ebrtham\u00ebs, t\u00eb kund\u00ebrshtoj\u00eb analiz\u00ebn e hyrje\/dalje p\u00ebrmes n\u00ebn-sistemit io_uring, si dhe t\u00eb kap\u00ebrcejn\u00eb kontrollet e integritetit q\u00eb kryhen nga moduli LKRG (Linux Kernel Runtime Guard). <\/p>\n
N\u00eb Singularity ka nj\u00eb reverse shell q\u00eb ofron akses t\u00eb privilegjuar n\u00eb distanc\u00eb n\u00eb sistem p\u00ebrmes d\u00ebrgimit t\u00eb paketave ICMP, si dhe trajtues q\u00eb lejojn\u00eb fshehjen e proceseve ose rritjen e privilegjeve n\u00eb sistem p\u00ebrmes manipulimeve t\u00eb caktuara me sinjalet dhe variablat e ambientit. P\u00ebr shembull, p\u00ebr t\u00eb fshehur nj\u00eb proces nga \/proc dhe printimet e mjeteve si ps, mund t\u00eb ekzekutohet \"kill -59 PID_procesit\", dhe p\u00ebr t\u00eb rritur privilegjet, duhet t\u00eb vendoset variabli i ambientit \"MAGIC=mtz\". <\/p>\n
Rootkiti fsheh trafikun e reverse shell nga analizator\u00ebt e rrjetit dhe lejon shmangien e p\u00ebrpunuesve SELinux, t\u00eb cil\u00ebt aktivizohen nga ICMP. Singularity gjithashtu p\u00ebrfshin mund\u00ebsi p\u00ebr t\u00eb fshehur lidhje t\u00eb caktuara rrjeti nga tabelat \/proc\/net\/nf_conntrack, p\u00ebrpunuesit netlink SOCK_DIAG\/NETFILTER dhe utilitetet si netstat, ss, lsof, tcpdump dhe wireshark. Jan\u00eb t\u00eb disponueshme p\u00ebrpunues p\u00ebr pastrimin e mesazheve t\u00eb auditit dhe regjistrimin n\u00eb log (klogctl, syslog, systemd-journal, \/sys\/kernel\/debug\/tracing\/, dmesg). Jan\u00eb t\u00eb pranish\u00ebm filtrat p\u00ebr t'u p\u00ebrballur me analizator\u00ebt e memories, si Volatility, q\u00eb p\u00ebrdorin \/proc\/kcore, \/proc\/kallsyms dhe \/proc\/vmallocinfo, si dhe mund\u00ebsi filtrimi p\u00ebr qasjen direkt n\u00eb pajisjet e bllokimit p\u00ebr t\u00eb parandaluar analiz\u00ebn n\u00eb nivel t\u00eb ul\u00ebt t\u00eb p\u00ebrmbajtjes s\u00eb FSh.
![\"Luaj](\"https:\/\/img.youtube.com\/vi\/ByEp137w3Ks\/hqdefault.jpg\")
\r\n