Linux-Security

Ransomware LockBit

LockBit 5.0 Linux Malware Analysis: ChaCha20 + Curve25519 Offline Encryption, strace Evasion & IOCs

LockBit 5.0 Linux encrypts files with ChaCha20+Curve25519 with zero network activity — the public key is embedded at compile time. strace attachment triggers immediate termination. Free space is actively wiped post-encryption to prevent carving. Full analysis pipeline: eBPF syscall tracing, Ghidra static RE of crypto routines, pcap-confirmed network behavior, and extracted IOCs including file markers, dropped ransom note paths, and encryption extension patterns.

CVE-2025-6019 udisks2

CVE-2025-6019: udisks2 TOCTOU Race Condition → Local Privilege Escalation | Polkit Bypass & SUID Exploit

udisks2 handles XFS resize via temporary /tmp/blockdev.XXXXXX mount points. Between mount creation and nosuid application, a race window allows SUID binary execution. Three-stage exploit: Polkit bypass via ~/.pam_environment local seat0 session spoofing, XFS image crafting with pwnbash SUID binary baked into mkfs.xfs Protofile metadata, D-Bus resize request flood to continuously recreate race window. Architecture-agnostic (x86/x64/ARM). Confirmed LPE on openSUSE Leap 15.6 kernel 6.4.0.

Assembly x64

Linux Anti-Debugging & Memory Dump Prevention: ptrace + prctl in x64 Assembly | EDR Evasion

Two syscalls, zero libc: PTRACE_TRACEME (sys_ptrace 101) self-traces the process to block gdb/strace with EPERM, PR_SET_DUMPABLE=0 (sys_prctl 157) kills core dump creation at OS level. Syscall numbers are calculated dynamically at runtime to evade YARA static analysis. Full x64 Assembly implementation with eBPF detection surface analysis.