Dealing with Linux Malware
•
3 gefällt mir•1,805 views
We often hear that viruses do not affect Linux systems. If it was only true... To understand why there is malware in the first place, we look at the reasons for evildoers to create harmful software. When that is clear, we move on by defining several types of malware, to finally focus on a very particular one, the rootkit. A quick course into the cleverness of rootkits follows, with the related challenges it offers for detection. We close the session by giving tips on detection and prevention.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Was ist angesagt?
Was ist angesagt? (20)
Andere mochten auch
Andere mochten auch (20)
Ähnlich wie Dealing with Linux Malware
Ähnlich wie Dealing with Linux Malware (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
Dealing with Linux Malware
- 1. Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com
- 2. Agenda Today 1. How do “they” get in 2. Why? 3. Malware types 4. In-depth: rootkits 5. Defenses 2
- 3. Interactive ● Ask ● Share ● Presentation 3
- 4. Michael Boelen ● Security Tools ○ Rootkit Hunter (malware scan) ○ Lynis (security audit) ● 150+ blog posts ● Founder of CISOfy 4
- 5. How do “they” get in
- 6. Intrusions ● Simple passwords ● Vulnerabilities ● Weak configurations ● Clicking on attachments ● Open infected programs 6
- 7. Why?
- 9. 9
- 10. Types
- 11. ● Virus ● Worm ● Backdoor ● Dropper ● Rootkit Types 11
- 12. Rootkits 101
- 13. Rootkits ● (become | stay) root ● (software) kit 13
- 14. Rootkits ● Stealth ● Persistence ● Backdoor 14
- 15. How to be the best rootkit?
- 16. Hiding ★ In plain sight! /etc/sysconfig/… /tmp/mysql.sock /bin/audiocnf 16
- 17. Hiding ★★ Slightly advanced ● Rename processes ● Delete file from disk ● Backdoor binaries 17
- 18. Hiding ★★★ Advanced ● Kernel modules ● Change system calls ● Hidden passwords 18
- 19. Demo
- 20. Demo 20
- 21. Demo 21
- 24. Challenges ● We can’t trust anything ● Even ourselves ● No guarantees 24
- 26. Defense
- 27. Defenses At least ● Perform security scans ● Protect your data ● System hardening 27
- 28. Scanning » Scanners ● Viruses → ClamAV ● Backdoors → LMD ● Rootkits → Chkrootkit / rkhunter 28
- 29. Scanning » File Integrity ● Changes ● Powerful detection ● Noise AIDE / Samhain 29
- 30. System Hardening » Lynis ● Linux / UNIX ● Open source ● Shell ● Health scan 30
- 31. Conclusions
- 32. Conclusions ● Challenge: rootkits are hard to detect ● Prevent: system hardening ● Detect: recognize quickly, and act 32
- 33. You finished this presentation Success!
- 34. More Linux security? Presentations michaelboelen.com/presentations/ Follow ● Blog Linux Audit (linux-audit.com) ● Twitter @mboelen 34
- 35. 35