While there are several rootkits that target Linux, they have so far not fully embraced the open-source ethos typical of Linux software. Luckily, Matheus Alves has been working to remedy this lack by creating an open-source rootkit called Singularity for Linux systems. Users who feel their computers are too secure can install the Singularity kernel module in order to allow remote code execution, disable security features, and hide files and processes from normal administrative tools. Despite its many features, Singularity is not currently known to be in use in the wild — instead, it provides security researchers with a testbed to investigate new detection and evasion techniques.
虽然已经存在一些针对 Linux 的 rootkit，但它们至今并未真正拥抱 Linux 软件所特有的开源精神。幸运的是，Matheus Alves 正在努力弥补这一空白，他为 Linux 系统创建了一个名为 Singularity 的开源 rootkit。觉得自己电脑“过于安全”的用户可以安装 Singularity 内核模块，以实现远程代码执行、禁用安全特性，并将文件和进程从常规管理工具中隐藏起来。尽管功能强大，目前尚无证据表明 Singularity 已在真实攻击环境中被使用；相反，它为安全研究人员提供了一个用于研究新型检测与规避技术的实验平台。
Alves is quite emphatic about the research nature of Singularity, saying that its main purpose is to help drive security research forward by demonstrating what is currently possible. He calls for anyone using the software to \”be a researcher, not a criminal\”, and to test it only on systems where they have explicit permission to test. If one did wish to use Singularity for nefarious purposes, however, the code is MIT licensed and freely available — using it in that way would only be a crime, not an instance of copyright infringement.
Alves 非常强调 Singularity 的研究属性，表示它的主要目的是通过展示“目前技术上能做到什么”，来推动安全研究向前发展。他呼吁所有使用该软件的人“做研究者，而不是罪犯”，并且只在获得明确授权的系统上进行测试。不过，如果有人确实想将 Singularity 用于恶意目的，其代码采用 MIT 许可证并可自由获取——这样做只会构成犯罪行为，而不是侵犯版权。
Getting its hooks into the kernel
将钩子植入内核
The whole problem of how to obtain root permissions on a system and go about installing a kernel module is out of scope for Singularity; its focus is on how to maintain an undetected presence in the kernel once things have already been compromised. In order to do this, Singularity goes to a lot of trouble to present the illusion that the system hasn\’t been modified at all. It uses the kernel\’s existing Ftrace mechanism to hook into the functions that handle many system calls and change their responses to hide any sign of its presence.
如何在系统上获取 root 权限并安装内核模块的问题并不在 Singularity 的研究范围之内；它关注的是在系统已经被攻陷之后，如何在内核中维持一种不被察觉的存在。为此，Singularity 费尽心力去制造一种“系统从未被修改过”的假象。它利用内核已有的 Ftrace 机制，钩住处理大量系统调用的函数，并修改这些调用的返回结果，从而隐藏自身存在的任何迹象。
Using Ftrace offers several advantages to the rootkit; most importantly, it means that the rootkit doesn\’t need to change the CPU trap-handling vector for system calls, which was one of the ways that some rootkits have been identified historically. It also avoids having to patch the kernel\’s functions directly — kernel functions already have hooks for Ftrace, so the rootkit doesn\’t need to perform its own ad-hoc modifications to the kernel\’s machine code, which might be detected. The Ftrace mechanism can be disab
