Linux Malware Rootkits, Backdoors, and More... Michael Boelen - - PowerPoint PPT Presentation

▶
linux malware
SMART_READER_LITE
LIVE PREVIEW

Linux Malware Rootkits, Backdoors, and More... Michael Boelen - - PowerPoint PPT Presentation

Dec 22, 2022 184 likes •547 views

Dealing with Linux Malware Rootkits, Backdoors, and More... Michael Boelen michael.boelen@cisofy.com Utrecht, 19 March 2016 Agenda Today 1. How do they get in 2. Why? 3. Malware types 4. In-depth: rootkits 5. Defenses 2

slide-1
SLIDE 1

Dealing with

Linux Malware

Rootkits, Backdoors, and More...

Utrecht, 19 March 2016

Michael Boelen

michael.boelen@cisofy.com

slide-2
SLIDE 2

Agenda

Today

  • 1. How do “they” get in
  • 2. Why?
  • 3. Malware types
  • 4. In-depth: rootkits
  • 5. Defenses

2

slide-3
SLIDE 3

Interactive

  • Ask
  • Share
  • Presentation

3

slide-4
SLIDE 4

Michael Boelen

  • Security Tools

○ Rootkit Hunter (malware scan) ○ Lynis (security audit)

  • 150+ blog posts
  • Founder of CISOfy

4

slide-5
SLIDE 5

How do “they” get in

slide-6
SLIDE 6

Intrusions

  • Simple passwords
  • Vulnerabilities
  • Weak configurations
  • Clicking on attachments
  • Open infected programs

6

slide-7
SLIDE 7

Why?

slide-8
SLIDE 8

Why?

  • Spam
  • Botnet

8

slide-9
SLIDE 9

9

slide-10
SLIDE 10

Types

slide-11
SLIDE 11
  • Virus
  • Worm
  • Backdoor
  • Dropper
  • Rootkit

Types

11

slide-12
SLIDE 12

Rootkits 101

slide-13
SLIDE 13

Rootkits

  • (become | stay) root
  • (software) kit

13

slide-14
SLIDE 14

Rootkits

  • Stealth
  • Persistence
  • Backdoor

14

slide-15
SLIDE 15

How to be the best rootkit?

slide-16
SLIDE 16

Hiding ★

In plain sight! /etc/sysconfig/… /tmp/mysql.sock /bin/audiocnf

16

slide-17
SLIDE 17

Hiding ★★

Slightly advanced

  • Rename processes
  • Delete file from disk
  • Backdoor binaries

17

slide-18
SLIDE 18

Hiding ★★★

Advanced

  • Kernel modules
  • Change system calls
  • Hidden passwords

18

slide-19
SLIDE 19

Demo

slide-20
SLIDE 20

Demo

20

slide-21
SLIDE 21

Demo

21

slide-22
SLIDE 22

Rootkit Hunter

Detect the undetectable!

22

slide-23
SLIDE 23
slide-24
SLIDE 24

Challenges

  • We can’t trust anything
  • Even ourselves
  • No guarantees

24

slide-25
SLIDE 25

Continuous Game

25

slide-26
SLIDE 26

Defense

slide-27
SLIDE 27

Defenses

At least

  • Perform security scans
  • Protect your data
  • System hardening

27

slide-28
SLIDE 28

Scanning » Scanners

  • Viruses → ClamAV
  • Backdoors → LMD
  • Rootkits → Chkrootkit / rkhunter

28

slide-29
SLIDE 29

Scanning » File Integrity

  • Changes
  • Powerful detection
  • Noise

AIDE / Samhain

29

slide-30
SLIDE 30

System Hardening » Lynis

  • Linux / UNIX
  • Open source
  • Shell
  • Health scan

30

slide-31
SLIDE 31

Conclusions

slide-32
SLIDE 32

Conclusions

  • Challenge: rootkits are hard to detect
  • Prevent: system hardening
  • Detect: recognize quickly, and act

32

slide-33
SLIDE 33

You finished this presentation Success!

slide-34
SLIDE 34

More Linux security?

Presentations

michaelboelen.com/presentations/

Follow

  • Blog

Linux Audit (linux-audit.com)

  • Twitter

@mboelen

34

slide-35
SLIDE 35

35