4 ms·
I wouldn't really call this a rootkit, it seems more like a function instrumenter. To me it looks like the hooks are not persistent and require the LD_PRELOAD e
by Avery3R 7y ago
I wouldn't really call this a rootkit, it seems more like a function instrumenter. To me it looks like the hooks are not persistent and require the LD_PRELOAD environment variable to be set to function, which is very easily detectable. The only cool thing here is storing the log data in GPU memory instead of the system RAM. The actual hook logic is also still running on the CPU.
- hnspirit 7y agoEven with the actual hook logic running on the CPU, this prevents a large amount of possible detection from various filesystem/workingmem vectors...
- badrabbit 7y agoAnd forensic analysis too. I think lack of existing tools that analyze and protect GPU based anomalies is what this project highlights.
- theamk 7y agoBut the hook's .so file still has to be loaded from filesystem, so it should be still detectable? And even if "hook logic" runs on the GPU, the actual function calls still have plenty of CPU parts. Check out rootkit/kit.c -- it is just plain old LD_PRELOAD rootkit, with a ton of calls running on CPU. Workingmem detector should have no problems matching this code.
- saagarjha 7y agoI also don’t think it would work as-is on macOS due to two-level namespacing…
- badrabbit 7y agoThey also made another small project to hide executables in GPU memory on Windows: https://github.com/nwork/WIN_JELLY https://github.com/nwork/WIN_JELLY
- tinus_hn 7y agoIt’s like the ‘you can store a virus in a jpeg and running it just requires this decoder’ “scare” from a decade back.
- baroffoos 7y agoDon't joke. I have had security people report my stuff is insecure because there is a document upload feature and a user could upload a virus and name it virus.png and then a user could download it and rename it to virus.exe and run it.
- fulafel 7y agoChange the scenario to "download it and double click it, exploiting vuln in file format handler" and it's correct.
- baroffoos 7y agoAt that point you may as well ban all user generated content since one user might have an insecure OS
- fulafel 7y agoWell, security engineering is about tradeoffs and managing risk, you won't get far outlawing all sources of risk. The smart way to handle attachments is to scrub them somehow (re-encode, pdf2pdf etc).
- badrabbit 7y agoThat is actually a serious issue especially if you allow unicode and RTL override in the file name. Always validate input file type.
- gruez 7y agoMS07-052: Code execution results in code execution https://devblogs.microsoft.com/oldnewthing/?p=25683 https://devblogs.microsoft.com/oldnewthing/?p=25683
- snagglegaggle 7y agoRight -- I was excited that someone had figured out how to exploit the GPU to load unsigned code.