simple-rootkit
Security and privacy
rootkit demo
SHOW HN2014
94points
13comments
#293of 2,272 in 2014
Top 13%of 2014 by points
How HN took it
RoastedHalf or more of the comments are critical
1 positive, 2 neutral or asking, 0 mixed, 3 critical, out of 6 comments about the project. Thread score -0.22.
Idea: 0 for, 2 againstDocs: 1 for, 0 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Nice hack and good for learners
From 3 comments
Nice! The name is clearly a nod to the classic "Reflections on Trusting Trust" by Ken Thompson (http://cm.bell-labs.com/who/ken/trust.html). I feel the presentation in the video…
unwind on HNThere is a high chance that it will crash your system. - Unlocked access to ->comm - What if buf is less than 6 bytes or not NULL terminated? - Only searching for sys_close() is…
Lai0chee on HNThis is OK for learners. But, it's not even middle grade.
m00dy on HN
Objections
Not a true Trusting Trust attack; only a trivial kernel module
From 1 comment
This doesn't attack gcc or python, it's just a trivial kernel module that interposes SYS_read. There's no germline persistence a la trusting trust. e.g. if I compile gcc, compile…
cplease on HN
Could crash the system due to unsafe code
From 1 comment
There is a high chance that it will crash your system. - Unlocked access to ->comm - What if buf is less than 6 bytes or not NULL terminated? - Only searching for sys_close() is…
Lai0chee on HN
Too basic to be useful beyond learners
From 1 comment
This is OK for learners. But, it's not even middle grade.
m00dy on HN
Requests
Cat source files on screen in the demo video
From 1 comment
Nice! The name is clearly a nod to the classic "Reflections on Trusting Trust" by Ken Thompson (http://cm.bell-labs.com/who/ken/trust.html). I feel the presentation in the video…
unwind on HN
Questions
How was the gif generated?
From 1 comment
As a side note, how did you generate that gif?
junto on HN
Alternatives named
Suterusu rootkit and an IDT-based syscall hooking write-up
From 1 comment
This module appears to use a simple brute force method for uncovering the address of the system call table, as opposed to hardcoding from System.map. There's another more elegant…
vezzy-fnord on HN
Designing BSD Rootkits book
From 1 comment
This module appears to use a simple brute force method for uncovering the address of the system call table, as opposed to hardcoding from System.map. There's another more elegant…
vezzy-fnord on HN