DOCSLIB.ORG

Linux Malware Detection by Hybrid Analysis

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Linux Malware Detection by Hybrid Analysis Linux malware detection by hybrid analysis By ANMOL KUMAR SHRIVASTAVA Department of Computer Science INDIAN INSTITUTE OF TECHNOLOGY,KANPUR A thesis submitted in partial fulfillment of the requirements for the degree of MASTER OF TECHNOLOGY Under the supervision of: DR. SANDEEP SHUKLA MAY 2018 Abstract Name of the student: Anmol Kumar Shrivastava Roll No: 16111031 Degree for which submitted: M.Tech. Department: Computer Science and Engineering Thesis title: Linux malware detection by hybrid analysis Thesis supervisor: Dr. Sandeep Shukla Month and year of thesis submission: ver the past two decades, cyber-security research community has been working on detect- ing malicious programs for the Windows-based operating system. However, the recent Oexponential growth in popularity of IoT (Internet of Things) devices is causing the mal- ware landscape to change rapidly. This so-called ’IoT Revolution ’ has fueled the interests of malware authors which has led to an exponential growth in Linux malware. The increasing number of malware is becoming a serious threat to data privacy as well as to the expensive computer resources. Manual malware analysis is not effective due to the large number of such cases. Furthermore, the malware authors are using various obfuscation techniques to impede the detection of traditional signature-based anti-virus system. As a result, automated yet robust malware analysis is much needed. In this thesis, we develop a hybrid approach by integrating both static features as well as dynamic features of a malware, to detect it efficiently. We performed our analysis on 7717 malware and 2265 benign files and got a highly promising detection accuracy of 99.14%. All prior work on Linux malware analysis used less than 1000 malware, and hence the accuracy numbers reported by them are not completely validated. Our work improves over prior work in two ways: substantial enhancement in the dataset, and hybrid analysis based on both static and dynamic features. Acknowledgements would like to extend my sincerest gratitude to my thesis supervisor, Dr. Sandeep Shukla, for his unparalleled guidance and support. I was new to this field, I Ican’t be much more thankful for all the wild ideas and new things i got to learn and explore under his guidance. I am grateful for his patience and all those weekly sessions of discussion. I would also thank my Family for believing in me and my Friends for their support. These 2 years would not have been same without you all. Last but not the least I would like to thank Gaurav kumar who has helped me in this work and making it possible to complete the work on time. TABLE OF CONTENTS Page List of Tables vii List of Figures viii 1 Introduction 1 2 Problem Background 4 2.1 Linux Malware and types . 4 2.2 Existing Malware detection strategy . 5 2.2.1 Static Analysis . 5 2.2.2 Dynamic Analysis . 6 2.3 Motivation For a new Approach . 7 2.4 Contribution . 7 3 Past work 8 3.1 Static analysis approaches . 9 3.2 Dynamic analysis approaches . 9 3.3 Drawback of past works: . 10 4 Analysis Infrastructure and Feature extraction 11 4.1 Analysis infrastructure . 11 4.1.1 Data Generation . 11 4.1.2 Feature Extraction . 14 4.1.2.1 Static feature vector . 14 4.1.2.2 Dynamic Feature Extraction . 23 4.1.3 Machine learning classifier . 29 4.2 Summary . 30 5 Result And Discussion 31 5.1 Dataset . 31 5.2 Evaluation Metric . 31 v TABLE OF CONTENTS 5.2.1 Confusion Matrix . 31 5.2.2 Additional metrics . 32 5.3 Training and Testing . 33 5.4 Result . 33 5.5 Comparison To Existing Approaches . 34 6 Scope and Future Work 36 6.1 Supporting Multiple architecture . 36 6.2 Analysis on different file format . 36 6.3 Multi-path execution of files . 37 A Appendix A 38 Bibliography 39 vi LIST OF TABLES TABLE Page 4.1 Fields in ELF header . 16 4.2 Fields in setion header . 17 4.3 Fields in segment header . 18 4.4 Mean value comparision of different fields in ELF header . 19 5.1 Confusion matrix for a two class classifier . 32 5.2 Test result on static feature set . 33 5.3 Test result on hybrid features . 33 5.4 Previous works on Linux malware analysis . 35 vii LIST OF FIGURES FIGURE Page 1.1 VirusTotal stats1 . 1 1.2 VirusTotal stats2 . 2 4.1 Architecture of hybrid model . 12 4.2 ELF file format . 13 4.3 Limon sandbox architecture . 14 4.4 ELF Layout in disk . 15 4.5 Frequency distribution of various section . 19 4.6 Frequency distribution of various section type . 20 4.7 Frequency distribution of various segment type type . 20 4.8 Frequency distribution of symbol table features type . 21 4.9 Example of GNU string output . 22 4.10 Example of strace output . 23 4.11 Benign sys call statistics . 24 4.12 Malware sys call statistics . 24 4.13 Benign proc file system access stats . 25 4.14 Malware proc files access stats . 25 4.15 Benign proc files access stats . 26 4.16 Malware sys file system access stats . 26 4.17 Benign etc files access stats . 27 4.18 Malware etc file system access stats . 28 5.1 Confusion matrix . 34 viii HAPTER C 1 INTRODUCTION ver the last past decades, the Internet has grown so much and so did the technology. This growth of the Internet and advancement in technology has resulted in a steep increase in O the number of Linux based servers, Linux based routers and Linux based IoT (Internet of Things) devices. Latest trends shows that Linux has now become a fresh worthy target for the hackers. FIGURE 1.1. Types of files submitted on VirusTotal [9] in the past 7 days 1 CHAPTER 1. INTRODUCTION A report from AV-Test [1] shows that in 2016 MacOS computers show a 360 percent increase in malware targeting with respect to the previous year, but Linux was not far behind.It saw a 300 percent increment in malware targeting with respect to its previous year. According to WatchGuard Security report [11] of Q1 2017, Linux malware made up 36 percent of the top threats. In Figure 1.1, we can see that the number of ELF [3] i.e Linux executables, submitted in the last seven days is in huge number and their counts can be compared to that of windows executable. This all statistics shows that Linux malware threats are now in an alarming state. As Linux is open source, all the latest threats are easily identified, and there are regular updates to the Linux kernel to catch up with new threats. Developers are regularly providing some system updates and are using some system protection mechanisms to protect the systems from emerging threats. These make Linux one of the safest platforms. But here comes the problem. Most of the IoT devices, router, etc. vendors do not provide this system updates as frequently, and if they do, this takes a long time for the consumer to download the updates and install on all the devices. These make the devices prone to exploitation. As the Linux malware threat is on the rise, there is a need for Anti-threat mechanisms to make our data and systems secure. In this work, we are going to present an automated Linux malware detection method which currently outperforms all the existing detection methods. Our work focuses on Linux binaries, i.e., ELF (Executable and Linkable Format) which is considered a standard binary file format. FIGURE 1.2. Number of files submitted on VirusTotal in the past 7 days 2 CHAPTER 1. INTRODUCTION As we see in Figure 1.2, the number of new malware and total malware submitted on VirusTotal is very high. To manually analyze this amount of data by manual reverse engineering and unpacking is a hectic task. This leads to the need for an efficient automatic detection system to detect malware. Currently, malware analyst are using two approaches for analysis namely, Static and Dynamic analysis. In static analysis, a file is analyzed just by looking at its structure and data present in it. As it is not executed, it is fast and easy to deploy, but there are some limitations for example, polymorphism/metamorphism and packers make the file data encrypted or packed so that no more static analysis can be done on it. This motivates for another approach, dynamic analysis. In this analysis, files are executed in a sandbox environment, and its behavior is analyzed. Since this analysis does not get affected by obfuscation and encryption of data, it has its limitation too. Some malware hide their true behavior when they find out that they are running in a controlled environment. Another limitation is that, since we usually monitor one of the paths of the process, hence rest of the code remains unexplored. So there is a need for a new detection mechanism which can overcome the limitations of these approaches. In the following chapters, we are going to discuss about Linux binary (ELF), types of malware and our methodology to detect Linux malware efficiently. 3 HAPTER C 2 PROBLEM BACKGROUND In this section, we describe some of the Linux malware and discuss what problems are present in the existing detection methodology and how we plan to overcome those problems using our approach. 2.1 Linux Malware and types Malware stands for malicious software which has some intention of disrupting infrastructure, stealing useful data, spying on a victims computer, etc. Malware can be categorized by their actions.
Load more

Recommended publications
  • A Story of an Embedded Linux Botnet
    A Moose Once Bit My Honeypot A Story of an Embedded Linux Botnet by Olivier Bilodeau (@obilodeau) $ apropos Embedded Linux Malware Moose DNA (description) Moose Herding (the Operation) What’s New? Take Aways $ whoami Malware Researcher at ESET Infosec lecturer at ETS University in Montreal Previously infosec developer, network admin, linux system admin Co-founder Montrehack (hands-on security workshops) Founder NorthSec Hacker Jeopardy Embedded Linux Malware What marketing likes to call "Internet of Things Malware" Malware Running On An Embedded Linux System Like consumer routers DVR Smart TVs IP Camera monitoring systems … Caracteristics of Embedded Linux Systems Small amount of memory Small amount of flash Non x86 architectures: ARM, MIPS Wide-variety of libc implementations / versions Same ABI-compatible Linux kernel (2.4 < x < 4.3) Support ELF binaries Rarely an integrated UI Networked Why Threats On These Systems Matters? Hard to detect Hard to remediate Hard to fix Low hanging fruit for bad guys It’s Real Several cases disclosed in the last two years A lot of same-old background noise (DDoSer) Things are only getting worse Wait, is IoT malware really about things? NNoo.. NNoott yyeett.. So what kind of malware can we find on such insecure devices? Linux/Aidra Linux/Bassobo ChinaZ family (XOR.DDoS, …) Linux/Dofloo Linux/DNSAmp (Mr Black, BillGates) Linux/Gafgyt (LizardStresser) Linux/Hydra Linux/Tsunami … LLeessssoonn LLeeaarrnneedd ##00 Statically-linked stripped binaries Static/stripped ELF primer No imports (library calls) present
    [Show full text]
  • Survivor: a Fine-Grained Intrusion Response and Recovery Approach for Commodity Operating Systems
    Survivor: A Fine-Grained Intrusion Response and Recovery Approach for Commodity Operating Systems Ronny Chevalier David Plaquin HP Labs HP Labs CentraleSupélec, Inria, CNRS, IRISA [email protected] [email protected] Chris Dalton Guillaume Hiet HP Labs CentraleSupélec, Inria, CNRS, IRISA [email protected] [email protected] ABSTRACT 1 INTRODUCTION Despite the deployment of preventive security mechanisms to pro- Despite progress in preventive security mechanisms such as cryp- tect the assets and computing platforms of users, intrusions even- tography, secure coding practices, or network security, given time, tually occur. We propose a novel intrusion survivability approach an intrusion will eventually occur. Such a case may happen due to to withstand ongoing intrusions. Our approach relies on an orches- technical reasons (e.g., a misconfiguration, a system not updated, tration of fine-grained recovery and per-service responses (e.g., or an unknown vulnerability) and economic reasons [39] (e.g., do privileges removal). Such an approach may put the system into a the benefits of an intrusion for criminals outweigh their costs?). degraded mode. This degraded mode prevents attackers to reinfect To limit the damage done by security incidents, intrusion re- the system or to achieve their goals if they managed to reinfect covery systems help administrators restore a compromised system it. It maintains the availability of core functions while waiting for into a sane state. Common limitations are that they do not preserve patches to be deployed. We devised a cost-sensitive response se- availability [23, 27, 34] (e.g., they force a system shutdown) or that lection process to ensure that while the service is in a degraded they neither stop intrusions from reoccurring nor withstand re- mode, its core functions are still operating.
    [Show full text]
  • Sureview® Memory Integrity Advanced Linux Memory Analysis Delivers Unparalleled Visibility and Verification
    SureView® Memory Integrity Advanced Linux Memory Analysis Delivers Unparalleled Visibility and Verification Promoting trustworthy and repeatable analysis of volatile system state Benefits Increased Usage of Linux in Forensics Field Guide for Linux Global Enterprises Systems2,” the apparent goal n Enables visibility into the state n Scans thousands of The use of Linux is everywhere of these attackers is to steal all systems with hundreds of of systems software while in the world. Linux is used in types of information. Perhaps of gigabytes of memory executing in memory our stock exchange transactions, greatest concern are the synchro- on Linux systems n Provides a configurable social media, network storage nized, targeted attacks against n Delivers malware detection using scanning engine for automated devices, smartphones, DVR’s, Linux systems. For several years, scans of remote systems an integrity verification approach online purchasing web sites, organized groups of attackers to verify that all systems software throughout an enterprise running is known and unmodified and in the majority of global (a.k.a. threat actors) have been n Incorporates an easy-to- Internet traffic. The Linux infiltrating Linux systems and to quickly identify threats use GUI to quickly assess Foundation’s 2013 Enterprise have been communicating with n Allows the integration and interpret results End User Report indicates that command and control (C2) of memory forensics into n Delivers output in a structured 80% of respondents planned servers and exfiltrating data enterprise security information data format (JSON) to to increase their numbers of from compromised Linux sys- and event management facilitate analytics systems (SIEMS) supporting Linux servers over the next five tems.
    [Show full text]
  • Malware Trends
    NCCIC National Cybersecurity and Communications Integration Center Malware Trends Industrial Control Systems Emergency Response Team (ICS-CERT) Advanced Analytical Laboratory (AAL) October 2016 This product is provided subject only to the Notification Section as indicated here:http://www.us-cert.gov/privacy/ SUMMARY This white paper will explore the changes in malware throughout the past several years, with a focus on what the security industry is most likely to see today, how asset owners can harden existing networks against these attacks, and the expected direction of developments and targets in the com- ing years. ii CONTENTS SUMMARY .................................................................................................................................................ii ACRONYMS .............................................................................................................................................. iv 1.INTRODUCTION .................................................................................................................................... 1 1.1 State of the Battlefield ..................................................................................................................... 1 2.ATTACKER TACTIC CHANGES ........................................................................................................... 2 2.1 Malware as a Service ...................................................................................................................... 2 2.2 Destructive Malware ......................................................................................................................
    [Show full text]
  • Russian GRU 85Th Gtsss Deploys Previously Undisclosed Drovorub Malware
    National Security Agency Federal Bureau of Investigation Cybersecurity Advisory Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware August 2020 Rev 1.0 U/OO/160679-20 PP-20-0714 Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware Notices and history Disclaimer of Warranties and Endorsement The information and opinions contained in this document are provided "as is" and without any warranties or guarantees. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government. This guidance shall not be used for advertising or product endorsement purposes. Sources and Methods NSA and FBI use a variety of sources, methods, and partnerships to acquire information about foreign cyber threats. This advisory contains the information NSA and FBI have concluded can be publicly released, consistent with the protection of sources and methods and the public interest. Publication Information Purpose This advisory was developed as a joint effort between NSA and FBI in support of each agency’s respective missions. The release of this advisory furthers NSA’s cybersecurity missions, including its responsibilities to identify and disseminate threats to National Security Systems, Department of Defense information systems, and the Defense Industrial Base, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders. Contact Information Client Requirements / General Cybersecurity Inquiries: Cybersecurity Requirements Center, 410-854-4200, [email protected] Media Inquiries / Press Desk: Media Relations, 443-634-0721, [email protected] Trademark Recognition Linux® is a registered trademark of Linus Torvalds.
    [Show full text]
  • Linux Security Review 2015
    Linux Security Review 2015 www.av-comparatives.org AV-Comparatives Linux Security Review Language: English May 2015 Last revision: 26 th May 2015 www.av-comparatives.org -1- Linux Security Review 2015 www.av-comparatives.org Contents Introduction ....................................................................................................................... 3 Reviewed products ............................................................................................................... 4 Malware for Linux systems ..................................................................................................... 5 Linux security advice ............................................................................................................ 6 Items covered in the review .................................................................................................. 7 Avast File Server Security ...................................................................................................... 8 AVG Free Edition for Linux.................................................................................................... 11 Bitdefender Antivirus Scanner for Unices ................................................................................ 13 Clam Antivirus for Linux ....................................................................................................... 17 Comodo Antivirus for Linux .................................................................................................. 20 Dr.Web Anti-virus for
    [Show full text]
  • Analysis of SSH Executables
    Masaryk University Faculty of Informatics Analysis of SSH executables Bachelor’s Thesis Tomáš Šlancar Brno, Fall 2019 Masaryk University Faculty of Informatics Analysis of SSH executables Bachelor’s Thesis Tomáš Šlancar Brno, Fall 2019 This is where a copy of the official signed thesis assignment and a copy ofthe Statement of an Author is located in the printed version of the document. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out on my own. All sources, references, and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Tomáš Šlancar Advisor: RNDr. Daniel Kouřil, Ph.D. i Acknowledgements I want to thank a lot to my advisor RNDr. Daniel Kouřil, Ph.D., for his excellent guidance, patience, and time. I appreciate every advice he gave me. I would also like to thank him and ESET for the provided collection of the infected SSH executables. Last but not least important, I would like to thank my family for all the support. They gave me a great environment while writing the thesis, and I appreciate it very much. iii Abstract The thesis describes the dynamic analysis of SSH executables with the main focus on the client-side. There are also some small aspects relating to the server-side too. The examination is performed only on the level of system calls and using OS Linux. The purpose is to propose a series of steps and create tools that would help to determine whether an unknown SSH binary contains malicious code or is safe and whether it is possible to automate the decision.
    [Show full text]
  • Unix/Mac/Linux OS Malware 10/15/2020
    Unix/Mac/Linux OS Malware 10/15/2020 Report #: 202010151030 Agenda • Executive Summary • Origin of Modern Operating Systems • Overview of Operating Systems o Desktop o Servers o Super Computers o Mobile o Attack Surface and CVEs • Malware Case Studies o Drovorub o Hidden Wasp o Operation Windigo o MAC Malware Slides Key: • Defending Against Malware The picture can't be displayed. Non-Technical: Managerial, strategic and high- • Summary level (general audience) The picture can't be displayed. Technical: Tactical / IOCs; requiring in-depth knowledge (system admins, IRT) TLP: WHITE, ID# 202010151030 2 Executive Summary • Unix and Unix-like systems drive most of today's computer systems. • Vulnerabilities and malware • Threat mitigation o Comprehensive security policies o Access control o Regular updates and backups o Training employees o Improving posture and maturity TLP: WHITE, ID# 202010151030 3 Modern Operating Systems "Determining the operating system on which the server runs is the most important part of hacking. Mostly, hacking is breaking into the target's system to steal data or any such purpose. Hence, the security of the system becomes the thing of prime importance." Source: Parikh, K. (2020, August) The Hackers Library Functions of Operating Systems Timeline of the Origins of Operating Systems TLP: WHITE, ID# 202010151030 4 Overview of Operating Systems (Non-Mobile) Unix Chrome OS •Derived from Original AT&T Unix •Free and open-source •Command-line input •Graphical user interface •Very popular among scientific, •Based on Linux
    [Show full text]
  • What Is Linux?
    What is Linux? ● A computer operating system (OS). ● Based on the UNIX OS (a major server OS). ● Free and open source software (FOSS). ● Available free of cost. ● Runs on nearly every hardware platform: – mainframes, PCs, cell phones, embedded processors ● Heavily used for servers. ● Heavily used in devices with embedded processors. CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Linux?? ● “But I have never heard of Linux, so it must not be very commonly used.” ● “Nobody uses Linux.” ● “Everyone runs Windows.” ● “Linux is too hard for anyone but computer scientists to use.” ● “There's no malware for Linux because Linux is so unimportant.” CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Desktop OS? – many distributions: Ubuntu, Red Hat, etc. CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Desktop OS? – many distributions: Ubuntu, Red Hat, etc. CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Cell phones or tablets or netbooks? – Android and Chrome OS are Linux based CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Routers? – many routers and other network devices run Linux – projects like DD-WRT are based on Linux CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● NAS (Network Attached Storage) devices? – most run Linux CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept. SIUC Have You Used Linux? ● Multimedia devices? – many run Linux CS Day 2013: Linux Introduction © Norman Carver Computer Science Dept.
    [Show full text]
  • Leveraging Advanced Linux Debugging Techniques for Malware Hunting
    Beyond Whitelisting: Fileless Attacks Against Linux Shlomi Boutnaru ./whomai • Currently: − CTO & Co-Founder, Rezilion • Previous: − Chief Technologist Cybersecurity, PayPal − CTO & Co-Founder, CyActive − Acquired by PayPal (2015) Fileless Malware - Definition “… a variant of computer related malicious software that exists exclusively as a computer memory-based artifact i.e. in RAM. It does not write any part of its activity to the computer's hard drive meaning that it's very resistant to existing Anti-computer forensic strategies that incorporate file-based whitelisting, signature detection, hardware verification, pattern-analysis, time-stamping, etc., and leaves very little by way of evidence that could be used by digital forensic investigators to identify illegitimate activity. As malware of this type is designed to work in-memory, its longevity on the system exists only until the system is rebooted…” https://en.wikipedia.org/wiki/Fileless_malware In the News… https://www.techradar.com/news/why-fileless-malware-is-the-biggest-new-threat-to-your-business https://securelist.com/fileless-attacks-against-enterprise-networks/77403/ https://threatpost.com/threatlist-ransomware-attacks-down-fileless-malware-up-in-2018/136962/ And More… Statistics https://www.barkly.com/ponemon-2018-endpoint-security-statistics-trends “…77% of attacks that successfully compromised organizations in 2017 utilized fileless techniques…” https://blog.barkly.com/2018-cybersecurity-statistics A third of all attacks are projected to utilize fileless techniques in 2018.
    [Show full text]
  • MMALE„A Methodology for Malware Analysis in Linux Environments
    Computers, Materials & Continua Tech Science Press DOI:10.32604/cmc.2021.014596 Article MMALE—A Methodology for Malware Analysis in Linux Environments José Javier de Vicente Mohino1, Javier Bermejo Higuera1, Juan Ramón Bermejo Higuera1, Juan Antonio Sicilia Montalvo1,*, Manuel Sánchez Rubio1 and José Javier Martínez Herraiz2 1Escuela Superior de Ingeniería y Tecnología, Universidad Internacional de La Rioja, Logroño, 26006, La Rioja, Spain 2Departamento de Ciencias de la Computación de la Escuela Politécnica Superior, Universidad de Alcalá de Henares, Alcalá de Henares, Madrid, Spain *Corresponding Author: Juan Antonio Sicilia Montalvo. Email: [email protected] Received: 01 October 2020; Accepted: 28 November 2020 Abstract: In a computer environment, an operating system is prone to malware, and even the Linux operating system is not an exception. In recent years, malware has evolved, and attackers have become more qualified compared to a few years ago. Furthermore, Linux-based systems have become more attractive to cybercriminals because of the increasing use of the Linux operating system in web servers and Internet of Things (IoT) devices. Windows is the most employed OS, so most of the research efforts have been focused on its malware protection rather than on other operating systems. As a result, hundreds of research articles, documents, and methodologies dedicated to malware analysis have been reported. However, there has not been much literature concerning Linux security and protection from malware. To address all these new challenges, it is necessary to develop a methodology that can standardize the required steps to perform the malware analysis in depth. A systematic analysis process makes the difference between good and ordinary malware analyses.
    [Show full text]
  • Geek Guide > Childhood's
    GEEK GUIDE Childhood’s End Table of Contents The Conventional Wisdom ...................................................6 A Worthy Target in Its Own Right .........................................8 Facing the New Reality .........................................................9 Arming Yourself with a Few Basic Countermeasures ......11 How Attacks Happen and How to Avoid Them .................13 Don’t Presume Linux Is Not a Target and Do Nothing ����������������������������������������������������13 Recognize That Files on Any Platform Can Be Encrypted and Locked for Ransomware ���������������������������������������������������������������������������������������������������������������13 Unpatched Software, Including SSH and Common Services Like Apache and FTP, Create Vulnerabilities ����������������������������������������������������������������������������������������14 Unpatched Services atop Other Services Are Entry Points for Malware, Regardless of OS Platform ����������������������������������������������������������������������������������������������14 Linux Systems Can Be “Resistant Carries” That Pass Viruses and Malware to Vulnerable Systems �����������������������������������������������������������������������������������������������������14 Remote, Non-Native Scans Can Leave Linux Filesystems Open and Vulnerable ����������15 Unencrypted Remote Shares Can Leave Network Traffic Vulnerable ����������������������������15 Don’t Let the Scale of Your Operation Keep You from Monitoring Everything���������������16 Create Policies
    [Show full text]