Jellyfish GPU Rootkit

Re:Jellyfish GPU Rootkit by hnspirit on Monday November 11, 2019 @06:39PM (#21510116)

Even with the actual hook logic running on the CPU, this prevents a large amount of possible detection from various filesystem/workingmem vectors...

[ Parent | on HN ]

Re:Jellyfish GPU Rootkit by theamk on Monday November 11, 2019 @10:10PM (#21511221)

But the hook's .so file still has to be loaded from filesystem, so it should be still detectable?

And even if "hook logic" runs on the GPU, the actual function calls still have plenty of CPU parts. Check out rootkit/kit.c -- it is just plain old LD_PRELOAD rootkit, with a ton of calls running on CPU. Workingmem detector should have no problems matching this code.

[ Parent | on HN ]

Re:Jellyfish GPU Rootkit by badrabbit on Monday November 11, 2019 @07:30PM (#21510382)

And forensic analysis too. I think lack of existing tools that analyze and protect GPU based anomalies is what this project highlights.

[ Parent | on HN ]