DAP/22-E01
Finished
Innovation for Defence
October 2021 August 2026
59 months
Zacharia Mansouri, Thibault Debatty
Linux
The goal of the project is to study the different options for injecting a malware on a Linux platform, for making it persistent, performing a privilege escalation, and for establishing a command & control channel with the operator of the malware.
Linux Containers C Docker eBPF
Most of us use Docker every day without knowing what’s happening under the surface. We treat it like a miniature virtual machine but, if you strip away the classical wrappers, you realize that a container isn’t a VM at all and doesn’t manage security the same way. In order to better understand these concepts, we will build a lightweight container and sandbox from scratch in C.
ReadWhen analyzing Linux kernel exploits, observing malware behavior in a controlled environment is the best way to build robust detection. The copy.fail vulnerability is a great case study in how attackers can abuse specific kernel mechanisms and sockets to escalate privileges. In this post, we’ll walk through setting up a safe, isolated environment using Vagrant, running the exploit and using eBPF (bpftrace) to track what it does under the hood. By...
ReadLinux Virtualization Containers
We’ve all been there: a project builds perfectly on your laptop, but the moment your colleague clones it, everything breaks. For years, containers (like Docker) have been the go-to solution for this. But what if you want stronger hardware-level isolation, real persistence for your development environment and the ability to literally “ship your machine” as a single executable file? There comes SmolVM, an open-source, Rust-powered CLI tool that let...
ReadModern container engines like Docker and Podman act as convenient black boxes, obscuring the Linux primitives running behind them. In this guide, we’ll tear down that box by building an entirely rootless, network-isolated, and cgroup-limited Linux container from scratch using only raw Linux commands. By manually orchestrating unshare for namespaces, systemd-run for resource limits, slirp4netns for user-space networking, and pivot_root for filesys...
Read