EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Lobsters·Jul 28·5 min read
Detection primitives for eBPF rootkits
TL;DR
eBPF rootkits are increasingly used by Linux malware to evade detection by traditional security tools. This article explores specific techniques used by malware families like VoidLink to hide active connections.
✦ Why It Matters
Security teams should enhance monitoring for eBPF rootkit behaviors to improve detection of hidden malware.
Key Takeaways
- Monitor for unusual eBPF helper calls in kernel space.
- Implement checks against known eBPF program IDs to detect hidden rootkits.
- Utilize tools like bpftool to verify program visibility.
- Analyze kernel trace outputs for anomalies related to eBPF operations.
How It Works
VoidLink uses bpf_probe_write_user() to manipulate the length of socket messages, effectively hiding specific TCP connections from the ss utility. LinkPro employs bpf_override_return() to alter the return values of kernel functions, preventing enumeration of its eBPF programs.
Both techniques rely on kprobes and tracepoints to intercept system calls, allowing the rootkits to operate stealthily.