# linux security

Published articles for linux security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Attacking UNIX Systems via CUPS, Part I

DevFeed: [Attacking UNIX Systems via CUPS, Part I](<https://devfeed.tech/articles/attacking-unix-systems-via-cups-part-i-41270.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/>)

Author: Simone Margaritelli

Published: 2024-09-26T14:51:30Z

Content type: article

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Security](<https://devfeed.tech/topics/security.md>), [Unix](<https://devfeed.tech/topics/unix.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [gnu linux](<https://devfeed.tech/topics/gnu-linux.md>), [systems](<https://devfeed.tech/topics/systems.md>)

Tags: [bugs](<https://devfeed.tech/tags/bugs.md>), [cups](<https://devfeed.tech/tags/cups.md>), [cups-browsed](<https://devfeed.tech/tags/cups-browsed.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2024-47076](<https://devfeed.tech/tags/cve-2024-47076.md>), [cve-2024-47175](<https://devfeed.tech/tags/cve-2024-47175.md>), [cve-2024-47176](<https://devfeed.tech/tags/cve-2024-47176.md>), [cve-2024-47177](<https://devfeed.tech/tags/cve-2024-47177.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [disclosure](<https://devfeed.tech/tags/disclosure.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [gnu-linux](<https://devfeed.tech/tags/gnu-linux.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [ipp](<https://devfeed.tech/tags/ipp.md>), [lan](<https://devfeed.tech/tags/lan.md>), [linux-security](<https://devfeed.tech/tags/linux-security.md>), [mdns](<https://devfeed.tech/tags/mdns.md>), [no-authentication](<https://devfeed.tech/tags/no-authentication.md>), [port](<https://devfeed.tech/tags/port.md>), [print-services](<https://devfeed.tech/tags/print-services.md>), [printer](<https://devfeed.tech/tags/printer.md>), [printers](<https://devfeed.tech/tags/printers.md>), [printing](<https://devfeed.tech/tags/printing.md>), [rce](<https://devfeed.tech/tags/rce.md>), [responsible-disclosure](<https://devfeed.tech/tags/responsible-disclosure.md>), [security](<https://devfeed.tech/tags/security.md>), [udp](<https://devfeed.tech/tags/udp.md>), [unauthenticated-access](<https://devfeed.tech/tags/unauthenticated-access.md>), [unix](<https://devfeed.tech/tags/unix.md>), [vulnerability-research](<https://devfeed.tech/tags/vulnerability-research.md>), [zeroconf](<https://devfeed.tech/tags/zeroconf.md>)

### AI overview

A security writeup describes multiple vulnerabilities in CUPS components affecting GNU/Linux and other UNIX systems. It reports that remote unauthenticated attackers may replace printer IPP URLs and trigger arbitrary command execution when a print job starts, with attacks possible over the public internet or via spoofed LAN advertisements.

### Source excerpt

Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start

## Process Behaviour Anomaly Detection Using eBPF and Unsupervised-Learning Autoencoders

DevFeed: [Process Behaviour Anomaly Detection Using eBPF and Unsupervised-Learning Autoencoders](<https://devfeed.tech/articles/process-behaviour-anomaly-detection-using-ebpf-and-unsupervised-learning-autoencoders-41266.md>)

Original publisher: [Read original article](<https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/>)

Author: Simone Margaritelli

Published: 2022-08-15T14:06:05Z

Content type: tutorial

Language: en

Sources: [evilsocket](<https://devfeed.tech/sources/evilsocket.md>)

Topics: [eBPF](<https://devfeed.tech/topics/ebpf.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Linux Kernel](<https://devfeed.tech/topics/linux-kernel.md>), [Learning](<https://devfeed.tech/topics/learning.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [anomaly-detection](<https://devfeed.tech/tags/anomaly-detection.md>), [artificial-intelligence](<https://devfeed.tech/tags/artificial-intelligence.md>), [autoencoder](<https://devfeed.tech/tags/autoencoder.md>), [bcc](<https://devfeed.tech/tags/bcc.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [deep-learning](<https://devfeed.tech/tags/deep-learning.md>), [deep-neural-networks](<https://devfeed.tech/tags/deep-neural-networks.md>), [defensive-security](<https://devfeed.tech/tags/defensive-security.md>), [dnn](<https://devfeed.tech/tags/dnn.md>), [ebpf](<https://devfeed.tech/tags/ebpf.md>), [github](<https://devfeed.tech/tags/github.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [kprobe](<https://devfeed.tech/tags/kprobe.md>), [kretprobe](<https://devfeed.tech/tags/kretprobe.md>), [linux](<https://devfeed.tech/tags/linux.md>), [linux-security](<https://devfeed.tech/tags/linux-security.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [neural-networks](<https://devfeed.tech/tags/neural-networks.md>), [process-anomaly-detection](<https://devfeed.tech/tags/process-anomaly-detection.md>), [process-behaviour](<https://devfeed.tech/tags/process-behaviour.md>), [raw-syscalls](<https://devfeed.tech/tags/raw-syscalls.md>), [runtime-protection](<https://devfeed.tech/tags/runtime-protection.md>), [sys-enter](<https://devfeed.tech/tags/sys-enter.md>), [syscall-tracing](<https://devfeed.tech/tags/syscall-tracing.md>), [tensorflow](<https://devfeed.tech/tags/tensorflow.md>), [tracepoint](<https://devfeed.tech/tags/tracepoint.md>), [unsupervised-learning](<https://devfeed.tech/tags/unsupervised-learning.md>)

### AI overview

This tutorial describes using eBPF syscall tracing and an unsupervised autoencoder to detect process behavior anomalies at runtime. It explains an approach that models syscall frequency without requiring an explicit allowlist and discusses potential detection of exploitation, denial-of-service, and other attacks.

### Source excerpt

Hello everybody, I hope you've been enjoying this summer after two years of Covid and lockdowns :D In this post I'm going to describe how