SINGULARITY: DEEP DIVE INTO A MODERN STEALTH LINUX KERNEL ROOTKIT

Summary from the TLDR InfoSec newsletter

Singularity demonstrates advanced Linux rootkit tactics by leveraging legitimate kernel features (ftrace) for syscall hooking and implementing defense-in-depth across processes, filesystems, network layers, and logging systems. The rootkit's dual-architecture support (x86_64 and ia32) prevent a common detection bypass in which investigators use 32-bit binaries to circumvent 64-bit-only hooks. Comprehensive anti-forensics capabilities, including log sanitization, taint flag manipulation, and module auto-hiding, render traditional detection methods ineffective. Defenders should adopt memory-based forensics techniques, monitor ftrace hook signatures in kernel debug interfaces, test with both 32-bit and 64-bit tools, and recognize that filesystem-based security checks can be completely intercepted by kernel-level adversaries.