New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by nixcraft on Friday June 10, 2022 @07:14AM (#31692477)

Direct link to the blog post with all details https://www.intezer.com/blog/research/new-linux-threat-symbi...

[ Parent | on HN ]

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by prvit on Friday June 10, 2022 @08:08AM (#31692902)

>Analysis of a New, Nearly-Impossible-to-Detect Linux Threat

Yeah, that's a straight up lie. LD_PRELOAD kits are by definition very easy to detect.

[ Parent | on HN ]

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by throw10920 on Friday June 10, 2022 @11:06AM (#31695217)

...unless that LD_PRELOAD rootkit has had a large amount of elbow grease put into patching all of the usual detection methods. Which appears to be the case here.

[ Parent | on HN ]

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by prvit on Friday June 10, 2022 @11:41AM (#31695707)

What exactly do you mean? The usual detection methods are essentially unpatchable while using this technique.

[ Parent | on HN ]

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by bbarnett on Friday June 10, 2022 @07:32AM (#31692618)

Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat

And disclosed in a blog post, with Nearly-Impossible-to-Read text.

[ Parent | on HN ]

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by lucas_ on Friday June 10, 2022 @07:39AM (#31692668)

Do you mean text font/colour or the content itself?

[ Parent | on HN ]

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by UmYeahNo on Friday June 10, 2022 @08:03AM (#31692853)

Not sure about GP, but the Font / Color combo is darn near impossible for me to read.

[ Parent | on HN ]