Linux Malware

Total Page：16

File Type：pdf, Size：1020Kb

Linux Malware Looks don’t matter Michael Boelen [email protected] 2016-07-06 ‘s-Hertogenbosch, The Netherlands Agenda Today 1. How do “they” get in 2. Why? 3. Malware types 4. In-depth: rootkits 5. Defenses 2 Interactive ● Ask ● Share ● Presentation 3 Michael Boelen ● Security Tools ○ Rootkit Hunter (malware scan) ○ Lynis (security audit) ● 180+ blog posts ● Founder of CISOfy 4 How do “they” get in Intrusions ● Simple passwords ● Vulnerabilities ● Weak configurations ● Clicking on attachments ● Open infected programs 6 Why? Why? ● Spam ● Botnet 8 9 Types Types ● Virus ● Worm ● Backdoor ● Dropper ● Rootkit 12 Rootkits 101 Rootkits ● (become | stay) root ● (software) kit 14 Rootkits ● Stealth ● Persistence ● Backdoor 15 How to be the best rootkit? Hiding ★ In plain sight! /etc/sysconfig/… /tmp/mysql.sock /bin/audiocnf 17 Hiding ★★ Slightly advanced ● Rename processes ● Delete file from disk ● Backdoor binaries 18 Hiding ★★★ Advanced ● Kernel modules ● Change system calls ● Hidden passwords 19 Little Demo Demo 21 Demo 22 Rootkit Hunter Detect the undetectable! 23 Challenges ● We can’t trust anything ● Even ourselves ● No guarantees 25 Continuous Game 26 Defense Defenses At least ● Perform security scans ● Protect your data ● System hardening 28 Scanning » Scanners ● Viruses → ClamAV ● Backdoors → LMD ● Rootkits → Chkrootkit / rkhunter 29 Scanning » File Integrity ● Changes ● Powerful detection ● Noise AIDE / Samhain 30 System Hardening » Lynis ● Linux / UNIX ● Open source ● Shell ● Health scan 31 Conclusions Conclusions ● Challenge: rootkits are hard to detect ● Prevent: system hardening ● Detect: recognize quickly, and act 33 Success! You finished this presentation More Linux security? Presentations michaelboelen.com/presentations/ Follow ● Blog Linux Audit (linux-audit.com) ● Twitter @mboelen 35 36.

Copy Link

Recommended publications

Linux Security: What You Need to Know
Linux Security: What you need to know Dr. James Stanger Chief Technology Evangelist CompTIA Your presenter . James Stanger, PhD Chief Technology Evangelist - CompTIA Security+, Network+, MCSE, LPI Linux, Symantec STA Responsible for CompTIA’s cerGﬁcaGons and conGnuing educaGon • Security analyGcs • Risk management • PenetraGon tesGng, risk assessment, and intrusion detecon • Linux and open source Twier: @jamesstanger • Network administraGon • VirtualizaGon CompTIA hub: • Web technologies hps://Gnyurl.com/y94u3v7j • CerGﬁcaGon development • Award-winning author and instructor Poll quesGon(s) 1. What animal is the Linux mascot? 2. What is the Linux mascot’s name? 3. How did this mascot get chosen, anyway? Why Linux is important to security? Linux is table stakes for security • You’ll be securing Linux-based systems – Web servers and databases – Cloud and virtualizaon • Nearly 1 in 3 Azure virtual machines are Linux • Majority of cloud services use Linux • You will use a Linux system to perform audits – End points (e.g., IoT, mobile devices, ICS) – Many tools available – Flexibility, scalability, and cost • Used as foundaonal components for major business and security soluGons by companies worldwide Most open source security – Fortune 500 tools are built naGvely in Linux – SMB Plaorms you’ll be asked to secure • Content management systems – Wordpress – SharePoint (has other uses) • Web servers • Databases • Network infrastructure – Firewalls, routers and VPN servers – Edge devices (e.g., micro datacenters) – Mobile – DNS especially • End
[Show full text]
Drukkar P66 Android-X86 4.4 RC P67 Hotshots P68 Rcssmin P68 Gipfel P69 Lynx P69 Flpsed P70 Lynis P68 Nightmaretris P70 Zatacka P71
FOSSPICKS Drukkar p66 Android-x86 4.4 RC p67 HotShots p68 rCSSmin p68 Gipfel p69 Lynx p69 Flpsed p70 Lynis p68 NightmareTris p70 Zatacka p71 Sparkling gems and new releases from the world of FOSSpicks Free and Open Source Software Mike Saunders has spent a decade mining the internet for open source treasures. Here’s the result of his latest haul… Lightweight blog platform Drukkar 2.0 http://drukkar.sourceforge.net ituation: you want to set up entries as simple XML files, and is your own blog. Options: a designed with minimum bandwidth Smillion and one competing overheads, so the “content should blog platforms, each one trying to account for most of your web be more feature-rich, flashy and traffic” as the developer puts it. Web 4.0 than the last. End result: you get tired of trying to work out Nice and simple what’s right for you, give up, and go To install Drukkar, extract its .zip to the pub instead. file directly into a location on your Sounds familiar? Most of us web server (note that it won’t create don’t need whizz-bang WordPress a subdirectory during extraction). installations with all the trimmings Then edit config.xml and set for our day-to-day musings, and the base_url and base_location Drukkar does a splendid job with settings to match your installation minimal requirements. It doesn’t path. Finally, make sure that the need a database or special Apache entries, files and cache directories Drukkar’s default theme, “flat”, is clean and simple. To change the modules or anything like that – its are writable by your web server text on the right, edit inc/sidebar.php.
[Show full text]
Hey Lynis, Audit This by Russ Mcree – ISSA Senior Member, Puget Sound (Seattle), USA Chapter
toolsmith Hey Lynis, Audit This By Russ McRee – ISSA Senior Member, Puget Sound (Seattle), USA Chapter Prerequisites/dependencies solution will include the existing Lynis Unix/Linux operating systems client that we’ll cover here, a management and reporting interface, as well as related plugins. Michael says they’re making great progress and each appy Holidays to all readers, the ISSA community, day brings them closer to an official first version. Specific to and infosec tool users everywhere. As part of De- the plugins, while a work in progress, they create specialized cember’s editorial theme for the ISSA Journal, Di- hooks via the client. As an example, imagine heuristics scan- Hsaster Recovery/Disaster Planning, I thought I’d try to con- ning with correlation at the central node to detect security in- nect tooling and tactics to said theme. I’m going to try and do trusions. Compliance checking for the likes of Basel II, GLBA, this more often so you don’t end up with a web application HIPAA, PCI DSS, and SOX is another likely plugin candidate. hacking tool as part of the forensics and analysis issue. I can The short-term road map consists of finishing the web inter- hear Thom (editor) and Joel (editorial advisory board chair) face, followed by the presenting and supporting documents. now: “Congratulations Russ, it only took you seven years to This will include documentation, checklists, control over- catch up with everyone else, you stubborn git.” views, and materials for system administrators, security pro- Better late than never I always say, so back to it.
[Show full text]
BSD UNIX Toolbox 1000+ Commands for Freebsd, Openbsd
76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iii BSD UNIX® TOOLBOX 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD®Power Users Christopher Negus François Caen 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page ii 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page i BSD UNIX® TOOLBOX 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page ii 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iii BSD UNIX® TOOLBOX 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD®Power Users Christopher Negus François Caen 76034ffirs.qxd:Toolbox 4/2/08 12:50 PM Page iv BSD UNIX® Toolbox: 1000+ Commands for FreeBSD®, OpenBSD, and NetBSD® Power Users Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2008 by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-0-470-37603-4 Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 Library of Congress Cataloging-in-Publication Data is available from the publisher. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permis- sion should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4355, or online at http://www.wiley.com/go/permissions.
[Show full text]
Hodetector: the Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine 1393
HODetector: The Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine 1393 HODetector: The Hidden Objects Detection Based on Static Semantic Information Library Outside Virtual Machine YongGang Li1, 2, ChaoYuan Cui1, BingYu Sun1, WenBo Li3* 1 Institute of Intelligent Machine, Chinese Academy of Sciences, China 2 School of Information Science and Technology, University of Science and Technology of China, China 3 Institute of Technology Innovation, Chinese Academy of Sciences, China [email protected], {cycui, bysun, wbli}@iim.ac.cn Abstract objects for virtual machine security. For virtualization security, the traditional secure With the spread of malwares, the security of virtual tools detecting malwares are placed into the guest VM machine (VM) is suffering severe challenges recent years. (GVM) that may be injected by computer viruses. So, Rootkits and their variants can hide themselves and other it’s possible that the secure tool will be bypassed or kernel objects such as processes, files, and modules cheated. For example, a rootkit named f00lkit can making malicious activity hard to be detected. The bypass Chkrootkit and Rkhunter, the most popular anti- existed solutions are either coarse-grained, monitoring at malwares tools in Linux. Compared with the traditional virtual machine level, or non-universal, only supporting method, one mechanism called out-of-box [3] detecting specific operating system with specific modification. In malwares out of VM is a better way, because the this paper, we propose a fine-grained approach called secure tool is outside any span of malwares. Then HODetector based on static semantic information library another problem appears: semantic gap [4].
[Show full text]
2.6 Auditing Linux/Unix Systems
Processing engine for security health checks Christofer Huynh, Jesper Gustafsson Department of Computer Science © Christofer Huynh, Jesper Gustafsson. LTH School of Engineering Lund University Box 882 SE-251 08 Helsingborg Sweden LTH Ingenjörshögskolan vid Campus Helsingborg Lunds universitet Box 882 251 08 Helsingborg Printed in Sweden. Lunds University Lund 2017 Abstract Computer security is still an often neglected field even though the IT industry is huge and still growing. Making sure that systems are secure is something that is very important but can take a lot of man hours. This thesis contains the research and documentation for an auditing tool created on behalf of a company that specialises in computer security, TrueSec. The audit tool uses the log files that are built from the scripts that TrueSec uses to runs various unix commands as a base, but it has been designed in such a way to allow the addition of other types of logs. The tool was designed with future development in mind. It uses configuration files that are seperated from the code itself to declare rules which the log files are checked against, allowing the tool to evolve with time by adding new rules. At the request of TrueSec a simple web service as a proof of concept for an online service with an authentication model with log in and user roles for uploading log files and storing the output from the audit tool was also developed. Keywords: audit tool, computer security, security audit, analysis engine, security health check 3 Sammanfattning Datasäkerhet är fotfarande ofta ett misskött fält även fast IT- sektorn är stor och fortfarande växer.
[Show full text]
Lynis Enterprise on the Other Hand Has Much More Possibilities to Display Data, Including Extended Reports in Several Formats
Lynis Lynis Installation and Usage • Introduction • Installation • Using Lynis • Basics • Commands, Options, and Arguments • Suggestions and Warnings • Behind the scenes • Profiles • HostIDs Introduction Lynis is an open source security tool. It helps with auditing systems running UNIX-alike systems (Linux, macOS, BSD), and providing guidance for system hardening and compliance testing. This document contains the basics to use the software. Installation The installation of Lynis is explained in the Get Started guide. Using Lynis Basics By running 'lynis' the program is started and will provide the basic parameters available. If you manually extracted Lynis (or used Git), then use './lynis' to start the program from the local directory. The most common command to start Lynis is using audit system command. This still start the security scan. To run Lynis you should meet one requirement: have write access to /tmp (temporary files) Commands, Options, and Arguments Introduction The behavior of programs can influenced with commands, arguments, and options. These terms are often mixed up, so we start with a quick introduction. Commands tell the program what to do. An option tells the program how to do it. If an argument is used, it tell on what it applies. Arguments usually follow an option, like a filename, or a target. Example $ ./lynis audit system --quick --auditor "The Auditor" In this example we tell Lynis to audit (command), with the target system (argument). By using the --quick (option), we tell it not to wait. We used --auditor (option) and defined it as "The Auditor" (argument). Lynis Commands The Lynis tool requires a minimum amount of parameters to run.
[Show full text]
Detecting Kernel Rootkits
Dartmouth College Dartmouth Digital Commons Computer Science Technical Reports Computer Science 9-2-2008 Detecting kernel rootkits Ashwin Ramaswamy Dartmouth College Follow this and additional works at: https://digitalcommons.dartmouth.edu/cs_tr Part of the Computer Sciences Commons Dartmouth Digital Commons Citation Ramaswamy, Ashwin, "Detecting kernel rootkits" (2008). Computer Science Technical Report TR2008-627. https://digitalcommons.dartmouth.edu/cs_tr/314 This Technical Report is brought to you for free and open access by the Computer Science at Dartmouth Digital Commons. It has been accepted for inclusion in Computer Science Technical Reports by an authorized administrator of Dartmouth Digital Commons. For more information, please contact [email protected]. Detecting kernel rootkits Ashwin Ramaswamy Department of Computer Science Dartmouth College Masters Thesis Proposal Dartmouth Computer Science Technical Report TR2008-627 Proposal Presentation Date: 2 September, 2008 Abstract Kernel rootkits are a special category of malware that are deployed directly in the kernel and hence have unmitigated reign over the functionalities of the kernel itself. We seek to detect such rootkits that are deployed in the real world by ﬁrst observing how the majority of kernel rootkits operate. To this end, comparable to how rootkits function in the real world, we write our own kernel rootkit that manipulates the network driver, thus giving us control over all packets sent into the network. We then implement a mechanism to thwart the attacks of such rootkits by noticing that a large number of the rootkits deployed today rely heavily on the redirection of function pointers within the kernel. By overwriting the desired function pointer to its own function, a rootkit can perform a proverbial man-in-the-middle attack.
[Show full text]
Unix/Mac/Linux OS Malware 10/15/2020
Unix/Mac/Linux OS Malware 10/15/2020 Report #: 202010151030 Agenda • Executive Summary • Origin of Modern Operating Systems • Overview of Operating Systems o Desktop o Servers o Super Computers o Mobile o Attack Surface and CVEs • Malware Case Studies o Drovorub o Hidden Wasp o Operation Windigo o MAC Malware Slides Key: • Defending Against Malware The picture can't be displayed. Non-Technical: Managerial, strategic and high- • Summary level (general audience) The picture can't be displayed. Technical: Tactical / IOCs; requiring in-depth knowledge (system admins, IRT) TLP: WHITE, ID# 202010151030 2 Executive Summary • Unix and Unix-like systems drive most of today's computer systems. • Vulnerabilities and malware • Threat mitigation o Comprehensive security policies o Access control o Regular updates and backups o Training employees o Improving posture and maturity TLP: WHITE, ID# 202010151030 3 Modern Operating Systems "Determining the operating system on which the server runs is the most important part of hacking. Mostly, hacking is breaking into the target's system to steal data or any such purpose. Hence, the security of the system becomes the thing of prime importance." Source: Parikh, K. (2020, August) The Hackers Library Functions of Operating Systems Timeline of the Origins of Operating Systems TLP: WHITE, ID# 202010151030 4 Overview of Operating Systems (Non-Mobile) Unix Chrome OS •Derived from Original AT&T Unix •Free and open-source •Command-line input •Graphical user interface •Very popular among scientific, •Based on Linux
[Show full text]
Hardening Freebsd: an Approach to a Secure System Remy
Hardening FreeBSD: An Approach to a Secure System Remy Baumgarten University of Hawaii [email protected] October 4th, 2009 Hardening FreeBSD 知己知彼百戰不殆 If you know both yourself and your enemy, you can win a hundred battles without a single loss. Sun Tzu's The Art of War “Operating System are not broken into; the programs running on the operating system are.” -Micheal W. Lucas General Summary: Hardware and Software Specifications Foreword and Forewarn Who are our Adversaries? Updating and Package Auditing Mailing Lists Permissions Networking and Firewalls Kernel Security Remote Logging Command Logging Secure Remote Access with SOCKS Proxy Forwarding Web Browsing Encryption Auditing Further Reading Hardware Specifications: Intel Core i7 920 Nehalem 2.66GHz 4 x 256KB L2 Cache 8MB L3 Cache LGA 1366 130W Quad-Core Processor ASUS P6T6 WS Revolution LGA 1366 Intel X58 ATX Intel Motherboard CORSAIR XMS3 6GB (3 x 2GB) 240-Pin DDR3 SDRAM DDR3 1333 (PC3 10666) Triple Channel CORSAIR CMPSU-850TX 850W ATX12V 2.2 / EPS12V 2.91 SLI Ready CrossFire Ready Active PFC Power Supply 2x - EVGA 896-P3-1260-TR GeForce GTX 260 896MB 448-bit GDDR3 PCI Express 2.0 x16 HDCP Ready SLI Supported Video Card LG W2452T-TF Black 24" 2ms(GTG) Widescreen LCD Monitor 400 cd/m2 10000:1 DCR with HDCP support LG Black 22X (CAV) DVD+R 8X DVD+RW 16X DVD+R DL 22X (CAV) DVD-R 6X DVD-RW 12X DVD-RAM 16X DVD-ROM 48X CD-R 32X CD-RW 48X CD-ROM 2MB Cache SATA 22X DVD¬±R DVD Burner Antec Nine Hundred Black Steel ATX Mid Tower Computer Case Software Specifications: FreeBSD 7.3 AMD64 Minimal Customized Compiled Kernel Installed Packages of Relevance: tripwire-2.4.1.2 lynis-1.2.6 snort-2.8.4.1_1 john-1.7.2_1 scponly-4.8 munin-main-1.2.6 postfix-2.6.5,1 mysql-server-5.0.86 portupgrade-2.4.6_3,2 portaudit-0.5.13 netcat-1.10_2 nmap-5.00 oinkmaster-2.0_1 Foreword and Forewarn: Security tips are mostly useless unless one understands why and how that tip works with other practices to protect your system from attacks.
[Show full text]
6.4.0-0 Release of SIMP, Which Is Compatible with Centos and Red Hat Enterprise Linux (RHEL)
SIMP Documentation THE SIMP TEAM Sep 16, 2020 Contents 1 Level of Knowledge 3 1.1 Quick Start................................................4 1.2 Changelogs................................................4 1.3 SIMP Getting Started Guide....................................... 64 1.4 SIMP User Guide............................................ 81 1.5 Contributing to SIMP.......................................... 228 1.6 SIMP Security Concepts......................................... 263 1.7 SIMP Security Control Mapping..................................... 282 1.8 Vulnerability Supplement........................................ 642 1.9 Help................................................... 644 1.10 License.................................................. 652 1.11 Contact.................................................. 652 1.12 Glossary of Terms............................................ 652 Index 669 i ii SIMP Documentation This is the documentation for the 6.4.0-0 release of SIMP, which is compatible with CentOS and Red Hat Enterprise Linux (RHEL). This guide will walk a user through the process of installing and managing a SIMP system. It also provides a mapping of security features to security requirements, which can be used to document a system’s security conformance. Warning: Be EXTREMELY CAREFUL when performing copy/paste operations from this document! Different web browsers and operating systems may substitute incompatible quotes and/or line endings in your ﬁles. The System Integrity Management Platform (SIMP) is an Open Source
[Show full text]
Securing Debian Manual
Securing Debian Manual Javier Fernández-Sanguino Peña <[email protected]> ‘Authors’ on this page Version: 3.13, Sun, 30 Jan 2011 19:58:16 +0000 Abstract This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribu- tion installation, it also covers some of the common tasks to set up a secure network environ- ment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team. Copyright Notice Copyright © 2002-2007 Javier Fernández-Sanguino Peña Copyright © 2001 Alexander Reelsen, Javier Fernández-Sanguino Peña Copyright © 2000 Alexander Reelsen Some sections are copyright © their respective authors, for details please refer to ‘Credits and thanks!’ on page 28. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 (http://www.gnu.org/licenses/ old-licenses/gpl-2.0.html) or any later version (http://www.gnu.org/copyleft/ gpl.html) published by the Free Software Foundation. It is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY. Permission is granted to make and distribute verbatim copies of this document provided the copyright notice and this permission notice are preserved on all copies. Permission is granted to copy and distribute modiﬁed versions of this document under the conditions for verbatim copying, provided that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.
[Show full text]