4 ms·
I read this: • (TS//SI//REL) SODAPRESSED - Linux application persistence. Given a running installation of Linux, install some application or inject something i
by zxcvcxz 11y ago
I read this:
• (TS//SI//REL) SODAPRESSED - Linux application persistence. Given a
running installation of Linux, install some application or inject
something into memory which will. This currently works on certain
versions of Linux without SELinux enabled. [1]
Does anyone know what exploit this refers to?
[1] https://search.edwardsnowden.com/docs/S3285InternProjects20150117 https://search.edwardsnowden.com/docs/S3285InternProjects201...
- therein 11y ago> Title: S3285/Intern Projects That sounds like a great internship. I thought I had cool projects when I was interning at Silicon Valley.
- vezzy-fnord 11y agoThey seem to define "persistence" variously, though I think they're talking about a rootkit in general (as opposed to checkpoint/restore). Emphasis on hypervisors, HDD and SSD firmware and, of course, the SMM. Given that they talk about "Linux application persistence", I'd assume it's some kernel module rootkit. In which case, it's not that cool. The in-kernel ABI changes a lot and basic techniques like hooking the IDT vary.