top | item 31704251

Symbiote Deep-Dive: Analysis of a New, Nearly-Impossible-to-Detect Linux Threat

3 points| Rondom | 3 years ago |intezer.com

2 comments

order

bediger4000|3 years ago

Interesting rundown. More than 1 guy wrote this: there's a lot of functionality, also a couple of specialities represented. If I think about having to write this, I get a feeling of incredible fatigue. It would never work well, problems installing would happen on half the machines.

salawat|3 years ago

I can think of a few ways to detect this that haven't been explicitly mentioned.

I will say that this is exactly what I figured would end up being written once I learned of the existence of BPF. This is why we can't have nice things.