<story><title>New ultra-stealthy Linux backdoor isn’t your everyday malware discovery</title><url>https://arstechnica.com/information-technology/2022/06/novel-techniques-in-never-before-seen-linux-backdoor-make-it-ultra-stealthy/</url></story><parent_chain><item><author>prvit</author><text>LD_PRELOAD rootkits are by definition not &amp;quot;ultra-stealthy&amp;quot;.&lt;p&gt;Nothing here looks special, there are a plenty of these:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;Jynx2&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;Jynx2&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;jynxkit&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;jynxkit&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;NexusBots&amp;#x2F;Umbreon-Rootkit&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;NexusBots&amp;#x2F;Umbreon-Rootkit&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;azazel&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;azazel&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;unix-thrust&amp;#x2F;beurk&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;unix-thrust&amp;#x2F;beurk&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mempodippy&amp;#x2F;vlany&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mempodippy&amp;#x2F;vlany&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;nopn0p&amp;#x2F;rkorova&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;nopn0p&amp;#x2F;rkorova&lt;/a&gt;&lt;p&gt;And presumably tens more I&amp;#x27;ve forgotten about. Highschoolers write stuff like this.</text></item></parent_chain><comment><author>farisjarrah</author><text>This seems to be different from previous LD_PRELOAD vulnerabilities in that it&amp;#x27;s using eBPF as part of the mechanism to obfuscate itself.</text></comment>
<story><title>New ultra-stealthy Linux backdoor isn’t your everyday malware discovery</title><url>https://arstechnica.com/information-technology/2022/06/novel-techniques-in-never-before-seen-linux-backdoor-make-it-ultra-stealthy/</url></story><parent_chain><item><author>prvit</author><text>LD_PRELOAD rootkits are by definition not &amp;quot;ultra-stealthy&amp;quot;.&lt;p&gt;Nothing here looks special, there are a plenty of these:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;Jynx2&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;Jynx2&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;jynxkit&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;jynxkit&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;NexusBots&amp;#x2F;Umbreon-Rootkit&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;NexusBots&amp;#x2F;Umbreon-Rootkit&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;azazel&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;chokepoint&amp;#x2F;azazel&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;unix-thrust&amp;#x2F;beurk&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;unix-thrust&amp;#x2F;beurk&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mempodippy&amp;#x2F;vlany&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;mempodippy&amp;#x2F;vlany&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;nopn0p&amp;#x2F;rkorova&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;nopn0p&amp;#x2F;rkorova&lt;/a&gt;&lt;p&gt;And presumably tens more I&amp;#x27;ve forgotten about. Highschoolers write stuff like this.</text></item></parent_chain><comment><author>VoidWhisperer</author><text>Side tangent: Why does github let these repos for Malware stay up? I understand some of them use the excuse &amp;#x27;this is for education, i&amp;#x27;m not responsible for what you do with it&amp;#x27;, but some don&amp;#x27;t even bother with that, and atleast my concern would be that some person could easily pull the code, modify it slightly, and off they go if the IOC&amp;#x2F;detections for the attack method aren&amp;#x27;t good yet</text></comment>