Would you know a virus if you saw it?
this post was submitted on 28 May 2024
30 points (100.0% liked)
Linux
48072 readers
1 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS
If the kernel is compromised all bets are off. They have complete control of your machine.
Depends on the malware.
With total access, nothing would prevent the malicious code from modifying the task viewer itself to make it ignore the resources it is using.
Accounting for every way malware might be discovered is difficult, but with enough system access, it's all possible.
It also depends on the viewer. I remember using prctl() in C to chamge a process name and top showed my change but htop didn't. I'm sure a competent malware writer would be able to trick it though
iirc, postgresql renames itself in htop to show its current status and which database it's operating on
True. There are various legitimate tools that are only really one step away from malware, so it's not too hard to imagine going that one step further.
Thinking specifically of the fact that a new process is allowed to change its apparent name, as well as creating secondary process pools, but there are bound to be other, deeper ways.
Here is an alternative Piped link(s):
https://www.piped.video/watch?v=c-ftuiRDqO0
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.
in theory, a virus can hide from them if it replaces (or LD_PRELOADs) them with something that filters the virus from its output.
those task viewers will show everything running, except some kernel modules, because they are part of the kernel.
also fast cron jobs will only be visible for a very short time. only while they run. if they run for like 250ms you probably won't notice them.