Replies: 1 comment
-
Actually I did have a go at creating a static yara but didn't seem to have any luck. $ export LDFLAGS="-static-libgcc -static-libstdc++" Then configure, make, make install as usual, but its still dynamically linked. $ file /usr/local/bin/yara $ ldd /usr/local/bin/yara Are there any specific compiler / linker flags to use? |
Beta Was this translation helpful? Give feedback.
-
There's been some cases recently of Linux malware which attempt to avoid detection via shared library evasion techniques. For example:
https://www.intezer.com/blog/research/new-linux-threat-symbiote/
https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/
Could these potentially target yara itself? If so, is it recommended to statically link yara to avoid these attacks?
And is it possible to statically compile / link yara?
Beta Was this translation helpful? Give feedback.
All reactions