How Modal catches crypto miners using syscall signatures
Modal added a runtime program-analysis component called seccheck to its serverless container runtime, detecting and disabling cryptomining Functions before banning the offending users. Because miners can change metadata but not their programs, Modal analyzes syscall logs rather than source code, binaries, or container images. The system avoids ptrace-based strace overhead, which can slow syscall-heavy programs by over 100x.