New ultra-stealthy Linux backdoor isn’t your everyday malware discovery

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by shaded-enmity on Friday June 10, 2022 @11:47AM (#31695780)

Turns out (1) works:

  #include <stdio.h>
  #include <stdlib.h>

  static void begin() __attribute__((constructor));

  void begin() {
    unsetenv("LD_PRELOAD");
  }

Build with:

  gcc -shared -fpie -o library.so library.c

Test:

  LD_PRELOAD=~/library.so env | grep LD_PRELOAD

[ Parent | on HN ]

Re:New ultra-stealthy Linux backdoor isn’t your everyday mal... by rurban on Sunday June 12, 2022 @12:26AM (#31711428)

Usually guarded with an #ifndef DEBUG. Disallow LD_PRELOAD in Release builds

[ Parent | on HN ]