Security researchers identify new malware targeting Linux

Re:Security researchers identify new malware targeting Linux by usr1106 on Friday November 22, 2024 @03:47AM (#42212174)

Didn't check the code, but lsof seems a good approach.

How does that work with the various namespaces? From root namespace you should see everything. But in a mount namespace you could bind mount under a different name. How would that confuse things? With a SELinux module even root cannot do everything. If /proc is mounted privately does it change anything?

Not sure, just starting to think. Linux has become incredibly complex since the old days...

Edit: orc routinely loads executable sections not belonging to any package.

[ Parent | on HN ]

Re:Security researchers identify new malware targeting Linux by holowoodman on Friday November 22, 2024 @05:31AM (#42212642)

Besides namespaces, if one were malicious, one could also hide loaded libraries from lsof another way: open the library file, memcpy() the contents into RAM somewhere, mprotect(...,PROT_EXEC) that contents and then close the library file. You'll have to do your own linking, but then no open file will appear except for a very brief moment.

[ Parent | on HN ]