[{"data":1,"prerenderedAt":205},["ShallowReactive",2],{"project-8595533":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":15,"tier":18,"category":19,"subcategory":20,"format":21,"keywords":22,"reception":27,"sentiment":28,"stance_mix":29,"scored_comments":34,"aspects":35,"strip":39,"post_text":41,"what":42,"said":68,"maker_in_thread":124,"shape":133,"grid":137,"attempts":165,"same_week":166,"maker_shows":30,"maker_hidden":197,"reader_version":198,"card":199},"8595533","simple-rootkit","A simple, highly commented, rootkit which attacks GCC and Python","title","Show HN: A simple, highly commented, rootkit which attacks GCC and Python","https:\u002F\u002Fgithub.com\u002Fmrrrgn\u002Fsimple-rootkit","github.com","mrrrgn",1415802788,2014,94,13,293,2272,"notable","security_privacy","rootkit demo","other",[23,24,25,26],"rootkit","linux kernel module","trusting trust","syscall hooking","roasted",-0.222,{"positive":30,"neutral":31,"mixed":32,"critical":33},1,2,0,3,6,{"idea":36,"docs":37,"execution":38},{"positive":32,"critical":31},{"positive":30,"critical":32},{"positive":32,"critical":30},[30,32,32,40,32,33,32,33,30,32,32,30,32],5,null,{"problem":43,"audience":41,"pricing":41,"motivation":50,"time_to_build":41,"stack":57,"openness":66,"stage":67,"team_size":67},{"value":44,"source":45,"evidence":46},"Demonstrates modifying source code en route to a compiler or interpreter in a sneaky way","maker",[47],{"id":48,"by":11,"text":49},"8597069","Hmmm, well, no, it's not a full on \"Trusting Trust\" attack; though it has a similar outcome insofar as producing dirty binaries from clean source goes. The module is simple, with…",{"value":51,"source":45,"evidence":52},"To play around with the idea of sneaky source modification; a learning project",[53,54],{"id":48,"by":11,"text":49},{"id":55,"by":11,"text":56},"8598163","I'm only a learner myself. Not a security expert or trying to claim that this is super 1337. It's just a neat thing to play with.",[58],{"value":59,"source":60,"evidence":61},"C","inferred",[62],{"id":63,"by":64,"text":65},"8596978","cplease","This doesn't attack gcc or python, it's just a trivial kernel module that interposes SYS_read. There's no germline persistence a la trusting trust. e.g. if I compile gcc, compile…","open_source","unknown",{"praise":69,"objections":86,"requests":99,"questions":104,"alternatives":112},[70],{"value":71,"source":72,"evidence":73},"Nice hack and good for learners","commenter",[74,78,82],{"id":75,"by":76,"text":77},"8595831","unwind","Nice! The name is clearly a nod to the classic \"Reflections on Trusting Trust\" by Ken Thompson (http:\u002F\u002Fcm.bell-labs.com\u002Fwho\u002Fken\u002Ftrust.html). I feel the presentation in the video…",{"id":79,"by":80,"text":81},"8596672","Lai0chee","There is a high chance that it will crash your system. - Unlocked access to ->comm - What if buf is less than 6 bytes or not NULL terminated? - Only searching for sys_close() is…",{"id":83,"by":84,"text":85},"8597902","m00dy","This is OK for learners. But, it's not even middle grade.",[87,91,95],{"value":88,"source":72,"evidence":89},"Not a true Trusting Trust attack; only a trivial kernel module",[90],{"id":63,"by":64,"text":65},{"value":92,"source":72,"evidence":93},"Could crash the system due to unsafe code",[94],{"id":79,"by":80,"text":81},{"value":96,"source":72,"evidence":97},"Too basic to be useful beyond learners",[98],{"id":83,"by":84,"text":85},[100],{"value":101,"source":72,"evidence":102},"Cat source files on screen in the demo video",[103],{"id":75,"by":76,"text":77},[105],{"value":106,"source":72,"evidence":107},"How was the gif generated?",[108],{"id":109,"by":110,"text":111},"8595950","junto","As a side note, how did you generate that gif?",[113,120],{"value":114,"source":72,"evidence":115},"Suterusu rootkit and an IDT-based syscall hooking write-up",[116],{"id":117,"by":118,"text":119},"8595879","vezzy-fnord","This module appears to use a simple brute force method for uncovering the address of the system call table, as opposed to hardcoding from System.map. There's another more elegant…",{"value":121,"source":72,"evidence":122},"Designing BSD Rootkits book",[123],{"id":117,"by":118,"text":119},{"comments":40,"answered":30,"key":125},[126,127,130],{"id":48,"text":49},{"id":128,"text":129},"8596542","Good advice, I may re-shoot the gif later and do that. Thanks! :)",{"id":131,"text":132},"8596537","I used licecap, it's extremely awesome. https:\u002F\u002Fgithub.com\u002Flepht\u002Flicecap :]",{"commenters":134,"max_depth":33,"maker_replies":40,"first_comment_mins":135,"lifespan_hours":136},8,55,7,[138,140,142,146,148,150,152,153,155,158,160,163,164],[63,32,30,139,64,32],"project\u002Fcritical\u002Fidea",[48,32,32,141,11,30],"maker\u002Fneutral\u002Fidea",[143,32,32,144,145,32],"8598477","commenter\u002Fneutral\u002Fnone","kazinator",[75,30,40,147,76,32],"project\u002Fpositive\u002Fdocs",[128,30,32,149,11,30],"maker\u002Fpositive\u002Fdocs",[109,31,33,151,110,32],"maker\u002Fneutral\u002Fnone",[131,31,32,151,11,30],[117,33,33,154,118,32],"project\u002Fneutral\u002Fexecution",[79,156,30,157,80,32],4,"project\u002Fcritical\u002Fexecution",[159,156,32,144,80,32],"8597973",[161,156,32,162,11,30],"8598289","maker\u002Fpositive\u002Fexecution",[83,40,30,139,84,32],[55,40,32,141,11,30],[],[167,172,177,182,187,192],{"id":168,"name":169,"points":170,"category":171},"8592597","Let's Talk Over Coffee",427,"consumer_social",{"id":173,"name":174,"points":175,"category":176},"8568181","StackShare",218,"dev_tools",{"id":178,"name":179,"points":180,"category":181},"8566971","Colores",157,"creative",{"id":183,"name":184,"points":185,"category":186},"8565977","Wall of Text",90,"productivity",{"id":188,"name":189,"points":190,"category":191},"8591193","Pfs",74,"infrastructure",{"id":193,"name":194,"points":195,"category":196},"8566982","Assembly",70,"web_saas",false,"v2",{"id":200,"name":5,"line":6,"ai":197,"cat":19,"year":13,"points":14,"comments":15,"rec":27,"s":201,"top":15,"kw":202,"maker":11,"domain":10,"tier":18,"attempts":32,"strip":203,"url":9,"mix":204,"praise":71,"objection":88,"sub":20},8595533,-0.22,[23,24,25,26],"1005030310010",[30,31,32,33],1794036524989]