linux malware
play

Linux Malware Rootkits, Backdoors, and More... Michael Boelen - PowerPoint PPT Presentation

Dec 22, 2022 •184 likes •546 views

Dealing with Linux Malware Rootkits, Backdoors, and More... Michael Boelen michael.boelen@cisofy.com Utrecht, 19 March 2016 Agenda Today 1. How do they get in 2. Why? 3. Malware types 4. In-depth: rootkits 5. Defenses 2

  1. Dealing with Linux Malware Rootkits, Backdoors, and More... Michael Boelen michael.boelen@cisofy.com Utrecht, 19 March 2016

  2. Agenda Today 1. How do “they” get in 2. Why? 3. Malware types 4. In-depth: rootkits 5. Defenses 2

  3. Interactive ● Ask ● Share ● Presentation 3

  4. Michael Boelen ● Security Tools ○ Rootkit Hunter (malware scan) ○ Lynis (security audit) ● 150+ blog posts ● Founder of CISOfy 4

  5. How do “they” get in

  6. Intrusions ● Simple passwords ● Vulnerabilities ● Weak configurations ● Clicking on attachments ● Open infected programs 6

  7. Why?

  8. Why? ● Spam ● Botnet 8

  9. 9

  10. Types

  11. Types ● Virus ● Worm ● Backdoor ● Dropper ● Rootkit 11

  12. Rootkits 101

  13. Rootkits ● (become | stay) root ● (software) kit 13

  14. Rootkits ● Stealth ● Persistence ● Backdoor 14

  15. How to be the best rootkit?

  16. Hiding ★ In plain sight! /etc/sysconfig/… /tmp/mysql.sock /bin/audiocnf 16

  17. Hiding ★★ Slightly advanced ● Rename processes ● Delete file from disk ● Backdoor binaries 17

  18. Hiding ★★★ Advanced ● Kernel modules ● Change system calls ● Hidden passwords 18

  19. Demo

  20. Demo 20

  21. Demo 21

  22. Rootkit Hunter Detect the undetectable! 22

  24. Challenges ● We can’t trust anything ● Even ourselves ● No guarantees 24

  25. Continuous Game 25

  26. Defense

  27. Defenses At least ● Perform security scans ● Protect your data ● System hardening 27

  28. Scanning » Scanners ● Viruses → ClamAV ● Backdoors → LMD ● Rootkits → Chkrootkit / rkhunter 28

  29. Scanning » File Integrity ● Changes ● Powerful detection ● Noise AIDE / Samhain 29

  30. System Hardening » Lynis ● Linux / UNIX ● Open source ● Shell ● Health scan 30

  31. Conclusions

  32. Conclusions ● Challenge: rootkits are hard to detect ● Prevent: system hardening ● Detect: recognize quickly, and act 32

  33. Success! You finished this presentation

  34. More Linux security? Presentations michaelboelen.com/presentations/ Follow ● Blog Linux Audit (linux-audit.com) ● Twitter @mboelen 34

  35. 35

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd

Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd

Linux malware presentation Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd Paul Rascagnres from Malware.lu Linux malware presentation Plan - Presentation - Darkleech/Chapro - Cdorked - Wirenet

425 views • 31 slides
Understanding Linux Malware Emanuele Cozzi 1 , Mariano Graziano 2 , Yanick Fratantonio 1 , Davide

Understanding Linux Malware Emanuele Cozzi 1 , Mariano Graziano 2 , Yanick Fratantonio 1 , Davide

Understanding Linux Malware Emanuele Cozzi 1 , Mariano Graziano 2 , Yanick Fratantonio 1 , Davide Balzarotti 1 1 EURECOM 2 Cisco Systems, Inc. IEEE Symposium on Security & Privacy, May 2018 Malware and operating systems Malware and operating

690 views • 57 slides
A Moose Once Bit My Honeypot A Story of an Embedded Linux Botnet by Olivier Bilodeau (

A Moose Once Bit My Honeypot A Story of an Embedded Linux Botnet by Olivier Bilodeau (

A Moose Once Bit My Honeypot A Story of an Embedded Linux Botnet by Olivier Bilodeau ( @obilodeau ) $ apropos Embedded Linux Malware Moose DNA (description) Moose Herding (the Operation) Whats New? Take Aways $ whoami Malware

1.19k views • 97 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

568 views • 22 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Linux Kung Fu Introduction What is Linux? Why Linux? What is the difference between a client

Linux Kung Fu Introduction What is Linux? Why Linux? What is the difference between a client

Linux Kung Fu Introduction What is Linux? Why Linux? What is the difference between a client and a server? What is Linux? Linux generally refers to a group of Unix-like free and open-source operating system distributions that use the Linux

562 views • 53 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
Team 21: Autonomous RoboSub Final Presentation Fall 2012 Team Members: Santiago Franco, Darryl

Team 21: Autonomous RoboSub Final Presentation Fall 2012 Team Members: Santiago Franco, Darryl

Team 21: Autonomous RoboSub Final Presentation Fall 2012 Team Members: Santiago Franco, Darryl McGowan, Kyle Miller, Sondra Miller, Gregory Robertson, Stuart Royal, Alex Smith Advisors: Dr. Clark, Dr. Frank, Dr. Harvey Competition 15th

627 views • 20 slides
NEW OIZ OMR XC EMBARGO 25TH JUNE 4 PM (TC+2) AIM FOR THE TOP * MAKING THE BEST EVEN BETTER 1

NEW OIZ OMR XC EMBARGO 25TH JUNE 4 PM (TC+2) AIM FOR THE TOP * MAKING THE BEST EVEN BETTER 1

NEW OIZ OMR XC EMBARGO 25TH JUNE 4 PM (TC+2) AIM FOR THE TOP * MAKING THE BEST EVEN BETTER 1 OMR STRUCTURE FULL EPS // FIBERLINK // UFO 2 2 RACE FOCUS DESIGN INSIDE LINE // FULL ICR 3 XC ULTIMATE WEAPON AD DYNAMICS // RACE GEO// TWO

690 views • 25 slides
& SE & SERVIC VICES ES CO CONFE NFERENCE RENCE JUNE JUNE 20 2019 19 SAF SAFE

& SE & SERVIC VICES ES CO CONFE NFERENCE RENCE JUNE JUNE 20 2019 19 SAF SAFE

BAI AIRD RD GLOBAL AL CO CONSUM SUMER, ER, TECH TECHNOLOGY Y & SE & SERVIC VICES ES CO CONFE NFERENCE RENCE JUNE JUNE 20 2019 19 SAF SAFE E HAR HARBOR BOR ST STATE TEMENT MENT This presentation does not

945 views • 32 slides
GAS ODORIZING GAS ODORIZING SYSTEM SYSTEM ASOG (AUTOMATED GAS ODORIZING ASOG AUTOMATED GAS

GAS ODORIZING GAS ODORIZING SYSTEM SYSTEM ASOG (AUTOMATED GAS ODORIZING ASOG AUTOMATED GAS

GAS ODORIZING GAS ODORIZING SYSTEM SYSTEM ASOG (AUTOMATED GAS ODORIZING ASOG AUTOMATED GAS ODORIZING SYSTEM SYSTEM) DOSER DOSER ASOG ASOG is disigned for is disigned for: - Pulsed dosing of odorant Pulsed dosing of odorant supply to

475 views • 9 slides
Dutch Masters Co. Group Leader: Teddy Deligianis Co-Workers: Frank Mader Sarah Marnhout

Dutch Masters Co. Group Leader: Teddy Deligianis Co-Workers: Frank Mader Sarah Marnhout

Dutch Masters Co. Group Leader: Teddy Deligianis Co-Workers: Frank Mader Sarah Marnhout Jonathan Ripper Jonathan Beckley Frank, Jon R., Teddy, Jon B., Sarah Introduction of What to Expect Teddy~ Intro Assignment Frank~

435 views • 21 slides
Distilling Regulations for Cannabis Manufacturers: An In Depth Examination of California

Distilling Regulations for Cannabis Manufacturers: An In Depth Examination of California

Distilling Regulations for Cannabis Manufacturers: An In Depth Examination of California Cannabis Regulations & the Practical Issues Facing Producers Legal Licensing and Compliance in the Cannabis Industry Categories of Manufacturing

617 views • 30 slides
An Unconventional Path to Successful Branding November 29, 2003 The Alchemist opens in

An Unconventional Path to Successful Branding November 29, 2003 The Alchemist opens in

An Unconventional Path to Successful Branding November 29, 2003 The Alchemist opens in Waterbury, VT You cant open a brew pub in Waterbury, no one goes to Waterbury to drink our mantra was: FOCUS ON COMMUNITY FIRST, the rest will

603 views • 31 slides
TH -203 EBULLIOMETRIC DETERMINATION OF THE `INFINITE DILUTION ACTIVITY COEFFICIENT' (IDAC)

TH -203 EBULLIOMETRIC DETERMINATION OF THE `INFINITE DILUTION ACTIVITY COEFFICIENT' (IDAC)

TH -203 EBULLIOMETRIC DETERMINATION OF THE `INFINITE DILUTION ACTIVITY COEFFICIENT' (IDAC) Instructor : Prof. H S Shankar Staff : A Francis TAs : Harini M Prawal Agarwal Shubham Gupta AIM To determine "Infinite Dilution Activity

341 views • 11 slides

More recommend