dealing with linux malware - cisofy · dealing with linux malware rootkits, backdoors, and more......

35

Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen [email protected]

Upload: doantruc

Post on 21-Sep-2018

226 views

Category:

Documents

4 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Dealing withLinux Malware

Rootkits, Backdoors, and More...

Utrecht, 19 March 2016

Michael [email protected]

https://cisofy.com

Page 2: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Agenda

Today1. How do “they” get in2. Why?3. Malware types4. In-depth: rootkits5. Defenses

2

Page 3: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Interactive

● Ask● Share● Presentation

3

Page 4: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Michael Boelen

● Security Tools○ Rootkit Hunter (malware scan)

○ Lynis (security audit)

● 150+ blog posts

● Founder of CISOfy

4

https://rootkit.nl

https://rootkit.nl

https://cisofy.com/lynis/

https://cisofy.com/lynis/

Page 5: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

How do “they” get in

Page 6: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Intrusions

● Simple passwords● Vulnerabilities● Weak configurations● Clicking on attachments● Open infected programs

6

Page 7: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Why?

Page 8: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Why?

● Spam● Botnet

8

Page 9: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

9

Page 10: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Types

Page 11: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

● Virus● Worm● Backdoor● Dropper● Rootkit

Types

11

Page 12: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Rootkits 101

Page 13: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Rootkits

● (become | stay) root● (software) kit

13

Page 14: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Rootkits

● Stealth● Persistence● Backdoor

14

Page 15: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

How to be the best rootkit?

Page 16: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Hiding ★

In plain sight!

/etc/sysconfig/…/tmp/mysql.sock/bin/audiocnf

16

Page 17: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Hiding ★★

Slightly advanced

● Rename processes● Delete file from disk● Backdoor binaries

17

Page 18: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Hiding ★★★

Advanced

● Kernel modules● Change system calls● Hidden passwords

18

Page 19: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Demo

Page 20: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Demo

20

Page 21: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Demo

21

Page 22: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Rootkit Hunter

Detect theundetectable!

22

Page 23: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Page 24: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Challenges

● We can’t trust anything● Even ourselves● No guarantees

24

Page 25: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Continuous Game

25

Page 26: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Defense

Page 27: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Defenses

At least● Perform security scans● Protect your data● System hardening

27

Page 28: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Scanning » Scanners

● Viruses → ClamAV● Backdoors → LMD● Rootkits → Chkrootkit / rkhunter

28

Page 29: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Scanning » File Integrity

● Changes● Powerful detection● Noise

AIDE / Samhain

29

Page 30: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

System Hardening » Lynis

● Linux / UNIX● Open source● Shell● Health scan

30

Page 31: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Conclusions

Page 32: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

Conclusions

● Challenge: rootkits are hard to detect

● Prevent: system hardening

● Detect: recognize quickly, and act

32

Page 33: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

You finished this presentation

Success!

Page 34: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

More Linux security?

Presentationsmichaelboelen.com/presentations/

Follow● Blog Linux Audit (linux-audit.com)● Twitter @mboelen

34

http://michaelboelen.com/presentations/

http://michaelboelen.com/presentations/

http://linux-audit.com

Page 35: Dealing with Linux Malware - CISOfy · Dealing with Linux Malware Rootkits, Backdoors, and More... Utrecht, 19 March 2016 Michael Boelen michael.boelen@cisofy.com

35

Security Analysis of Online Centroid Anomaly Detectionios dealing with human activity rather than natural phenomena (e.g., information ranking, spam detection, malware detection, etc.)

Dealing with Online Security Threats - The Illawarra PC ... notes/Dealing with online... · Dealing with Online Security Threats. A presentation on Dealing with ... Free Anti-Malware

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Practical Malware Analysis: Ch 11: Malware Behavior

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Best Practices for Dealing with Phishing and Next ... · ©2015 Osterman Research, Inc. 5 Best Practices for Dealing with Phishing and Next-Generation Malware SECURITY NEEDS SIGNIFICANT

Reversing malware analysis training part8 malware memory forensics

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Best Practices for Dealing with Phishing and Next ......Best Practices for Dealing with Phishing and Next-Generation Malware • Decision makers should conduct a thorough analysis

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

The Other Side Of The Fence. Dealing With Hackers And Malware

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Evolving Endpoint Malware Detection: Dealing with Advanced ... › assets › library › reports › ... · Evolving Endpoint Malware Detection: Dealing with Advanced and Targeted

Malware and Anti-Malware Seminar by Benny Czarny

Best Practices for Dealing with Phishing and Next ... Practices … · Malware being introduced from employees’ home computers 17% Malware being introduced from employees’ use

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

BH webinar making life difficult for malware · • But people have various reasons why that is not feasible ... Malware is very bad at dealing with surprises • Anything of out

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Trafﬁc Exchanges

Android Malware Exposed-Evolution of Android Malware

Advanced malware analysis training session6 malware sandbox analysis

PRACTICAL STEPS TO DEALING WITH PHISHING ......PRACTICAL STEPS TO DEALING WITH PHISHING, MALWARE, AND OTHER THREATS TO YOUR BUSINESS Edition: 4.2116 thinkhr.com | 855.271.1050 6 home

Reversing malware analysis trainingpart9 advanced malware analysis

Traction - CISOfy · Traction Getting Traction for (your) Open Source Projects Michael Boelen [email protected] T-DOSE 2016, 12 November (NLLGG track)

Malware Detection with Malware Images using …cosc.canterbury.ac.nz/research/reports/HonsReps/2018/...Malware Detection with Malware Images using Deep Learning Techniques by Ke HE

Intrusion Detection and Malware Analysis - Malware collection

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to