Linux distribution

It's really fascinating.

And all this is happening at the same time as so many Linux projects and Linux distributions are banning AI code.

What are they going to do now that the Linux kernel itself is being developed essentially by AI? At this point, I would say it's a reasonable gamble that if you removed the vast majority of human maintainers from the Linux kernel, the Linux kernel development is going to continue at the current pace more or less because it's predominantly being developed by AI with paid corporate and Linux foundation maintainers driving those AIs.

That's how it's being developed now.

And that's just all there is to it.

So what do the Linux distributions who have banned AI do with that? Do they continue using the Linux kernel, which is an AI developed project now? They have.

They have so far, even though they ban AI from all other portions of the project.

It's fascinating.

And I remember trying out things like window blinds, which is a way to customize the GUI by replacing Explorer.exe on your Windows box.

So for me, I remember trying out Linux Distro and, you know, you could literally tweak anything.

And there was this massive array of software on the disk that you get.

It was just like...

Yeah.

I think it's like a full Linux, uh, Distro, but I'm not sure.

There's still, it's another one of the unknowns.

We're not quite sure.

I wasn't sure if the 2014 version of Chaos had KDE or not.

I was, I was just looking at Distro ro- watch real quick when writing this story, so.

But at least over 10 years it's had KDE.

Um, you know, the Plasma's been the d- default desktop for a long time.

That wasn't so much interesting to me.

What was interesting is where they got to deploying backdoors on Linux systems.

Overall, I'm finding, and I don't want to give too much away here, but overall, I look at these every single week.

It's a huge part of my role here at Eclipsium to understand the threat landscape.

Sure, you might run Debian, but have you modified or extended or customized your kernel in some way that makes it unique to how you would implant a kernel-level rootkit? Perhaps.

So what I find is these very basic techniques.

And one that I've seen now in three different cases of malware on Linux systems are one of the processes that they'll run for persistence, they'll call it kWorker.

Now, kworker, if you've ever done a process listing on a Linux system, you'll see multiple kworker processes.