TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

NSA and FBI warn that new Linux malware threatens national security

40 点作者 aw1621107将近 5 年前

4 条评论

Cactus2018将近 5 年前
&gt; Also included are rules that network administrators can plug in to the <i>Yara</i> and <i>Snort</i> intrusion detection systems to catch and halt network traffic passing to or from control servers or to flag obfuscated Drovorub files or processes already running on a server.<p>Page 35 <a href="https:&#x2F;&#x2F;media.defense.gov&#x2F;2020&#x2F;Aug&#x2F;13&#x2F;2002476465&#x2F;-1&#x2F;-1&#x2F;0&#x2F;CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF" rel="nofollow">https:&#x2F;&#x2F;media.defense.gov&#x2F;2020&#x2F;Aug&#x2F;13&#x2F;2002476465&#x2F;-1&#x2F;-1&#x2F;0&#x2F;CSA...</a>
sevensor将近 5 年前
Today I learned about Volatility. I&#x27;ve never really looked into forensics before; it&#x27;s interesting that there&#x27;s an entirely separate set of tools for determining the state a system was in when the memory was dumped, defined by analogy with tools like pstree that you&#x27;d ordinarily use to examine a running system. Seems like a bit of cat-and-mouse though; as an attacker with a code running in the kernel, you&#x27;d want to politely excuse yourself from memory images. Admittedly I don&#x27;t understand malware very well; there may be techincal reasons why this is not possible.
rurban将近 5 年前
Cannot imagine any security aware kernel being left with modules and eBPF support on. Nobody should do that. We disabled kernel modules in the early 90ies already.<p>The OracleLinux kernel with dTrace looks fine though. But Oracle
nix23将近 5 年前
&gt;Government officials said Drovorub gets its name from strings unintentionally left behind in the code.<p>Imagine being a highly trained topnotch agency and being that stupid ;) ...really happy that something like that never happens at the NSA