4 ms·

This is the same company that wasn't aware that LD_PRELOAD has been in use since the 90's in their last post. Here is that unique method of hijacking execution

This is the same company that wasn't aware that LD_PRELOAD has been in use since the 90's in their last post. Here is that unique method of hijacking execution flow using /etc/ld.so.preload, 20 years ago: https://seclists.org/incidents/2002/Jan/86 https://seclists.org/incidents/2002/Jan/86. None of this is unique or novel, including replacing the loader. LD_PRELOAD rootkits have severe drawbacks (which are not an issue for eBPF rootkits).

rhexs 4y ago
It’s weird how there’s been a massive uptick in security “threat researchers” blogging about hello world style malware in the past few years. On the plus side, malware reverse engineering is a tough job that traditionally didn’t pay that well, so hopefully they’re doing better now with the rise of all these startups doing blog posts about LD_PRELOAD.
- ewuhic 4y ago
  To me all of the sec research still seems like some kind of secret wisdom bound only to the best hackers out there, am I wrong here?
  - rhexs 4y ago
    That's just the culture of defcon/blackhat/"if you get any certs you're dumb". If you can program, you can learn almost any concept in security with self study and a handful of good books. Marketing posts, such as these, often aren't very useful but sure look neat with all the basic blocks...
- TechBro8615 4y ago
  There’s a wide gap between the majority of infosec bloggers and the top echelon of experts. I don’t see a problem with that, personally, and it’s not much different than the distribution of expertise in most other software domains. Surely the more the merrier, since at least some of those new entrants will grow into experts. Also, there’s a reason the “hello world” malware posts are popular - the techniques they’re describing might have been known for years, but they’re practical and they work. Often their longevity is only due to their unfixable nature in exploiting a design flaw. So they’re useful not only from a practical standpoint but also an academic one of demonstrating a class of attack so pernicious that it can only be eliminated with a ground up redesign.
AlexSW 4y ago
It seems to me hard sometimes to know what all of the 'state-of-the-art' and historic techniques are; in practice there'll likely be far too many to enumerate on a variety of platforms. But I do wonder if there are good lists or compilations anywhere that would include these.
- netsec_burn 4y ago
  That is the purpose of resources like MITRE's ATT&CK. Here is the ATT&CK page on the technique which is portrayed to be novel in this post: https://attack.mitre.org/techniques/T1574/006/ https://attack.mitre.org/techniques/T1574/006/
_8j50 4y ago
That was my first thought as well similar thing. They are right that it isn't being detected but malware detection for Linux has always been lagging.

rhexs 4y ago

It’s weird how there’s been a massive uptick in security “threat researchers” blogging about hello world style malware in the past few years. On the plus side, malware reverse engineering is a tough job that traditionally didn’t pay that well, so hopefully they’re doing better now with the rise of all these startups doing blog posts about LD_PRELOAD.

ewuhic 4y ago
To me all of the sec research still seems like some kind of secret wisdom bound only to the best hackers out there, am I wrong here?
- rhexs 4y ago
  That's just the culture of defcon/blackhat/"if you get any certs you're dumb". If you can program, you can learn almost any concept in security with self study and a handful of good books. Marketing posts, such as these, often aren't very useful but sure look neat with all the basic blocks...
TechBro8615 4y ago
There’s a wide gap between the majority of infosec bloggers and the top echelon of experts. I don’t see a problem with that, personally, and it’s not much different than the distribution of expertise in most other software domains. Surely the more the merrier, since at least some of those new entrants will grow into experts. Also, there’s a reason the “hello world” malware posts are popular - the techniques they’re describing might have been known for years, but they’re practical and they work. Often their longevity is only due to their unfixable nature in exploiting a design flaw. So they’re useful not only from a practical standpoint but also an academic one of demonstrating a class of attack so pernicious that it can only be eliminated with a ground up redesign.

AlexSW 4y ago

It seems to me hard sometimes to know what all of the 'state-of-the-art' and historic techniques are; in practice there'll likely be far too many to enumerate on a variety of platforms. But I do wonder if there are good lists or compilations anywhere that would include these.

netsec_burn 4y ago
That is the purpose of resources like MITRE's ATT&CK. Here is the ATT&CK page on the technique which is portrayed to be novel in this post: https://attack.mitre.org/techniques/T1574/006/ https://attack.mitre.org/techniques/T1574/006/

_8j50 4y ago

That was my first thought as well similar thing. They are right that it isn't being detected but malware detection for Linux has always been lagging.