@haxrob

I enjoy breaking things. Telco / mobile and IoT security. Surfing the information super highway one keystroke at a time.

 Australia
haxrob.net
Joined April 2017
  • Tweets861
  • Following463
  • Followers15K
361Media
A friend asked me to find out why his connected lightbulb app was asking for his location, so I ducked out to Australia’s favourite hardware store, Bunnings, and grabbed one to check out. The Android grid connect app has 500k+ downloads. Let’s take a quick look! 🧵 (1/n)
105
1,497
230
5,264
1,432,379
#BPFDoor controller's source code (likely) originating from an owned host based in 🇰🇷. Found by pivoting on details in #rapid7's post, published today. Find the reconstructed / deobfuscated source here: github.com/haxrob/BPFDoor-co…
1
10
1
36
12,028
hash: 2eacc8d91b9829b9606a7945fc5311fb5876cfb42ffccc1b91f61841237b04c1 Devs maintained compatibility with Solaris 🤟
1
3
860
HaxRob retweeted
HaxRob
@haxrob1 Aug 2025
Replying to @itsalexvacca
A technical deep dive: haxrob.net/onavo-facebook-ss…
1
55
1
246
96,637
Replying to @haxrob
Cool! Related (a paper we wrote recently): arxiv.org/abs/2506.07827

User-space library rootkits revisited: Are user-space detection...

The kind of malware designed to conceal malicious system resources (e.g. processes, network connections, files, etc.) is commonly referred to as a rootkit. This kind of malware represents a...

arxiv.org
1
4
8
1,515
Really interesting ways here to hide files and other activity on Linux.
HaxRob
@haxrob13 Jul 2025
A relatively unknown but particularly stealthy technique to hide files on Linux hosts. On unhardened boxes, unprivileged users can conceal files from even the root user. Disk content remains in memory, hindering disk acquisition during forensic investigation. (1/7) 👇
1
2
21
2,722
A relatively unknown but particularly stealthy technique to hide files on Linux hosts. On unhardened boxes, unprivileged users can conceal files from even the root user. Disk content remains in memory, hindering disk acquisition during forensic investigation. (1/7) 👇
3
53
2
350
34,004
more replies
This method can be utilized to perform process masquerading.. Here an implant appears to be running from /usr/sbin/auditd but it's actually 'fileless'. No '(deleted)', no ':memfd', no '/dev/shm', no ptrace, no LD_PRELOAD. Just stealth. (6/7)
1
2
19
2,781
Full writeup including mitigations, threat hunting and other detection ideas.👇 (7/7) haxrob.net/hiding-in-plain-s…
2
13
65
3,537
Forget compliance by severity color, how about compliance by emoji happiness level? #systemd, stay classy. 🙃
1
20
1,651
Security researcher @haxrob released a two-part technical breakdown of BPFDoor, a Linux-targeting malware tied to past APT campaigns. The analysis includes insights on recent variants observed this year. haxrob.net/bpfdoor-past-and-… haxrob.net/bpfdoor-past-and-…
14
40
96
7,429
Great blog posts and updates on latest BPFDoor changes by @haxrob BPFDoor - Part 1 - The past: haxrob.net/bpfdoor-past-and-… BPFDoor Part 2 - The Present: haxrob.net/bpfdoor-past-and-…
7
14
1,670
Newer variants of the #BPFDoor has an interesting modification made that avoids detections looking for processes with raw sockets. The kernel reports SOCK_DGRAM rather then rather loud "SOCK_RAW". Here we have a sample found in the recent SKT telco breach. (1/20)
1
48
2
155
22,892
more replies
Newer samples can be found to have the authentication password as a salted MD5 hash. github.com/haxrob/bpfdoor-du… can extract the hashes from samples and generate the respective hashcat command. Here are a few cracked ones. Those that identify victims are not included. (21/x)
1
2
1
9
1,368
A writeup of this content can be found in a two part series: (22/x) haxrob.net/bpfdoor-past-and-…
1
11
1,080
Load more