3 ms·
If you're relying on such superficial disguising, just put your process name in brackets directly, no mount privileges required. As a general rule, if malware
by o11c 2y ago
If you're relying on such superficial disguising, just put your process name in brackets directly, no mount privileges required.
As a general rule, if malware gets root privilege, no other process on the same system (container, at least) should be expected to be able to detect it.
- breakingcups 2y agoIt rather involved being on the other side of this airtight hatchway: https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283 https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...
- tanelpoder 2y agoThis would help against basic ps commands but if your security tool reads the task's PF_ flags (from /proc/PID/stat or kernel memory), you'd still see that your [task] is not an actual kernel task... (the PF_KTHREAD flag is 0x200000): $ ln -s /bin/sleep '[kernelstuff]' $ ./\[kernelstuff\] 999 & [2] 29499 $ awk '{ printf("%x\n", $9) }' /proc/29499/stat 40400000 $ pgrep kthreadd 2 $ awk '{ printf("%x\n", $9) }' /proc/2/stat 208040 Edit: as you said, it's superficial disguising (that may even work in some cases)