FLIPSWITCH: A NOVEL SYSCALL HOOKING TECHNIQUE

Summary from the TLDR InfoSec newsletter

FlipSwitch is a novel Linux rootkit technique that bypasses kernel 6.9's new syscall dispatch mechanism by directly patching machine code in the x64_sys_call function rather than overwriting the traditional sys_call_table. The technique locates specific call instructions within the kernel dispatcher and modifies their 4-byte offsets to redirect syscalls to malicious functions, demonstrating how attackers adapt to kernel hardening measures. This research highlights the ongoing arms race between Linux kernel security improvements and rootkit evolution. Elastic has provided YARA signatures to detect this proof-of-concept implementation.