SPiCa

SPiCa 系统进程完整性 & 跨视图分析 "我要歌唱，所以闪耀吧，SPiCa……" SPiCa 是一款基于 eBPF 的 Linux 内核级恶意软件检测器，用 Rust 编写。其名称来源于初音未来的歌曲《SPiCa》及其所指的恒星——角宿一（室女座α星），即室女座中最亮的那颗星。肉眼看似一颗星的它，实际上是一对分光双星：两颗恒星相互绕转，如果不测量它们的光谱，就无法区分它们是独立的天体。SPiCa 将相同的原理应用于内核观测：通过物理上不同的机制，多个独立通道测量相同的内核状态，抑制其中一条通道的内核级恶意软件会在其他通道中暴露无遗。 免责声明： 本代码库中有相当一部分代码是借助 GL...

boopkit

================================================================ ██████╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗██╗████████╗ ██╔══██╗██╔═══██╗██╔═══██╗██╔══██╗██║ ██╔╝██║╚══██╔══╝ ██████╔╝██║ ██║██║ ██║██████╔╝█████╔╝ ██║ ██║ ██╔══██╗██║ ██║██║ ██║██╔═══╝ ██╔═██╗ ██║ ██║ ██████╔╝╚██████╔╝╚██████╔╝██║ ██║...

TripleCross

TripleCross TripleCross 是一个 Linux eBPF 根工具包，展示了 eBPF 技术的攻击性能力。 TripleCross 的灵感来源于先前该领域的植入设计，特别是 Jeff Dileo 在 DEFCON 271、Pat Hogan 在 DEFCON 292、Guillaume Fournier 和 Sylvain Afchain 也在 DEFCON 293 的工作，以及 Kris Nóva 的 Boopkit4。我们复用并扩展了这些先前对 eBPF 技术攻击性能力的探索中开创的一些技术。 此根工具包是为我在 UC3M 的学士学位论文创建的。其设计细节在 论文文...

Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit

Attackers took over more than 400 packages in the Arch User Repository AUR this week and rewrote their build scripts to install a credential stealer on any machine that built them. The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF...

Malicious code in weavedb-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a352d761eba6aa71b41fc09bb621d3f04e8c7c0e74487392a7c69e77719426b9 No concrete indicators of installer-side harm were identified in this version of weavedb-contracts. No lifecycle scripts, network beacons, credential...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...