How to catch crypto miners using syscall signatures
6/6/2024
Introduced `seccheck`, a syscall-based program analysis component integrated into Modal's runtime. This system utilizes gVisor's efficient syscall interception to monitor container execution. It analyzes syscall traces, specifically focusing on patterns indicative of cryptomining, such as `execve` calls to suspicious binaries or network connections to known mining pools. When a match is found, `seccheck` emits a security event that leads to the immediate termination of the Function and potential user banning. The implementation prioritizes low runtime overhead, avoiding the performance penalties of traditional `strace`.