Collaborate Disseminate
I am testing this VMBR concept in my environment (for research purposes).
Since I am very new to this concept, want to understand how this VMBR or Subvirt and Bluepill can be implemented; is it possible?
and
To start, I am working with CoV… Continue reading Want to know about Virtual Machine Based Rootkit (Subvirt & Blue Pill rootkits) [closed]
From my understanding:
I can emulate many different architectures and systems with qemu as a user(mode) process.
There is separate user address space per process.
If a malicious process were to escape emulation it could compromise the use… Continue reading Does emulation/software virtualization provide more isolation/security vs hardware virtualization?
I recently learned about the feature in Windows 10 called Windows Secure Mode (https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm). I’m trying to understand what exactly it is trying to achieve by sandboxing itsel… Continue reading What is Virtual Secure Mode trying to achieve?
It used to be that building the Linux kernel was not easy. Testing and debugging were even worse. Nowadays, it is reasonably easy to build a custom kernel and test …read more Continue reading Linux Fu: Easy Kernel Debugging
In a Unix-like system, the concept of privileged and non-privileged users is used for security, preventing numerous attacks. When a non-privileged user executes malicious code at a normal level, the kernel can reject its execution by recog… Continue reading Kernel level attack?
I am looking into how DMA works at the device driver and kernel level in the Linux kernel.
I observed that access control to DMA buffers from IO devices is performed by the IOMMU and IOMMU driver in the kernel.
I will provide an example to… Continue reading How does IOMMU and/or Linux kernel handle DMA that span a page boundary?
How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates?
On older PCs and laptops where some components are no longer recognized by Windows Device Ma… Continue reading Is having no driver installed better than having old driver?
What to learn the internals of the Linux kernel? Version 6.5-rc5 has about 36 million lines of code in it, so good luck! [Seiya] has a different approach. Go back …read more Continue reading Linux Kernel from First Principles
I want to make it so that syscalls from a particular process are controlled by another process (admin or same user, doesn’t really matter to me.) I realize this gives some rootkit trojan vibes, but I’m not actually making malware; I just n… Continue reading Hooking system calls for a specific process on Linux
A new Linux kernel vulnerability tracked as StackRot and CVE-2023-3269 shows the exploitability of use-after-free-by-RCU (UAFBR) bugs.
The post StackRot Linux Kernel Vulnerability Shows Exploitability of UAFBR Bugs appeared first on SecurityWeek.
Continue reading StackRot Linux Kernel Vulnerability Shows Exploitability of UAFBR Bugs