HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
MatheuZSecurity
Singularity
C2025–2026
MatheuZSecurity / Singularity

Singularity

Stealthy Linux Kernel Rootkit

Systems & Infrastructure
Explore on GitHubRead Hacker News discussions
2Distinct people
6Mentions
0Explicit recommenders
1.8KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Stealthy Linux Kernel Rootkit

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by week6 dated mentions

Observed mentions: 2025-09-28 21:37:45 UTC to 2026-01-14 00:02:06 UTC. Weeks start Monday, UTC.

0122025-09-22 00:00:00 UTC to 2025-09-29 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 commentsSep 222025-09-29 00:00:00 UTC to 2025-10-06 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-10-06 00:00:00 UTC to 2025-10-13 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-10-13 00:00:00 UTC to 2025-10-20 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-10-20 00:00:00 UTC to 2025-10-27 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-10-27 00:00:00 UTC to 2025-11-03 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-11-03 00:00:00 UTC to 2025-11-10 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-11-10 00:00:00 UTC to 2025-11-17 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-11-17 00:00:00 UTC to 2025-11-24 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsNov 172025-11-24 00:00:00 UTC to 2025-12-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-12-01 00:00:00 UTC to 2025-12-08 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-12-08 00:00:00 UTC to 2025-12-15 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-12-15 00:00:00 UTC to 2025-12-22 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-12-22 00:00:00 UTC to 2025-12-29 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2025-12-29 00:00:00 UTC to 2026-01-05 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-05 00:00:00 UTC to 2026-01-12 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2026-01-12 00:00:00 UTC to 2026-01-19 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsJan 12

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Sep 222025-09-22 00:00:00 UTC2025-09-29 00:00:00 UTC110
Sep 292025-09-29 00:00:00 UTC2025-10-06 00:00:00 UTC000
Oct 62025-10-06 00:00:00 UTC2025-10-13 00:00:00 UTC000
Oct 132025-10-13 00:00:00 UTC2025-10-20 00:00:00 UTC000
Oct 202025-10-20 00:00:00 UTC2025-10-27 00:00:00 UTC000
Oct 272025-10-27 00:00:00 UTC2025-11-03 00:00:00 UTC000
Nov 32025-11-03 00:00:00 UTC2025-11-10 00:00:00 UTC000
Nov 102025-11-10 00:00:00 UTC2025-11-17 00:00:00 UTC000
Nov 172025-11-17 00:00:00 UTC2025-11-24 00:00:00 UTC000
Nov 242025-11-24 00:00:00 UTC2025-12-01 00:00:00 UTC000
Dec 12025-12-01 00:00:00 UTC2025-12-08 00:00:00 UTC000
Dec 82025-12-08 00:00:00 UTC2025-12-15 00:00:00 UTC000
Dec 152025-12-15 00:00:00 UTC2025-12-22 00:00:00 UTC000
Dec 222025-12-22 00:00:00 UTC2025-12-29 00:00:00 UTC211
Dec 292025-12-29 00:00:00 UTC2026-01-05 00:00:00 UTC000
Jan 52026-01-05 00:00:00 UTC2026-01-12 00:00:00 UTC211
Jan 122026-01-12 00:00:00 UTC2026-01-19 00:00:00 UTC101

What Hacker News says

6 sources
matheuzsec·Jan 5, 2026
The rootkit now disables SELinux enforcing mode on-demand when the ICMP reverse shell is triggered, leaving zero audit logs. How it works: SELinux maintains a global kernel structure called selinux_state that contains the enforcement flag. The rootkit resolves this non-exported symbol via kallsyms at module load time, then directly writes enforcing = 0 when triggered. This bypasses the normal setenforce() interface entirely. The clever part is the dual-layer approach: * Hooks netlink_unicast to drop audit messages for hidden PIDs * Attempts to modify selinux_state->enforcing directly in kernel memory On kernels built with CONFIG_SECURITY_SELINUX_DEVELOP=y, SELinux enforcement may stop at the kernel decision level, while userspace tools continue to report enforcing mode and /var/log/audit/audit.log shows nothing. - Advanced Network Hiding
Read the rest
Previous versions only hide TCP connections from /proc/net/tcp* by hooking tcp_seq_show, which blocked netstat. But modern tools like ss and conntrack bypass /proc entirely - they query the kernel directly via netlink. The new version filters at the netlink layer: * SOCK_DIAG filtering: ss uses NETLINK_SOCK_DIAG protocol to get socket info directly from the kernel. Singularity hooks recvmsg to intercept and filter these netlink responses before userspace sees them. Commands like ss -tapen or lsof -i return empty for hidden connections. * Conntrack filtering: Connection tracking (nf_conntrack) maintains state for all network flows. Reading /proc/net/nf_conntrack or running conntrack -L would expose hidden connections. The rootkit now filters both the proc interface and NETLINK_NETFILTER messages with conntrack types. * UDP hiding: Added hooks for udp4_seq_show and udp6_seq_show - previous versions only hide TCP. - Other improvements: * Optimized log filtering (switched from multiple strstr() calls to switch-case with strncmp()) * Audit statistics tracking (get_blocked_audit_count(), get_total_audit_count()) * Automated setup script Repo: https://github.com/MatheuZSecurity/Singularity
In Singularity Rootkit: SELinux bypass and netlink filter (ss/conntrack hidden)

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.