veyepar: Tutorial: Hunting Linux malware for fun and $flags

Author(s):	Marc-Etienne M.Léveillé
Location	D2.211
Date	feb Thu 04	Days Raw Files
Start	13:20	First Raw Start	13:19
Duration	1:40:00	Offset	0:00:18
End	15:00	Last Raw End	15:04
Chapters	00:00 0:41:16
Total cuts_time	94 min.

https://linux.conf.au/schedule/30055/view_talk
raw-playlist raw-mp4-playlist encoded-files-playlist host archive tweet mp4 svg png

assets release.pdf Tutorial_Hunting_Linux_malware_for_fun_and_flags.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

Server-side Linux malware is a real threat now. Unfortunately, as for its Windows counterpart, most system administrators are inadequately trained or don't have enough time allocated by their management to analyze and understand the threats that their infrastructures are facing. This tutorial aims at creating an environment where Linux professionals have the opportunity to study such threats safely and in a time-effective fashion.

In this introductory tutorial you will learn to fight real-world Linux malware that targets server environments. Attendees will have to find malicious processes and concealed backdoors in a compromised Web server.

In order to make the tutorial accessible for a range of skill levels several examples of malware will be used with increasing layers of complexity -- from scripts to ELF binaries with varying degrees of obfuscation. Additionally, as is common in Capture-The-Flag information security competitions, flags will be hidden throughout the environment for attendees to find.

Requirements

* Some programming experience
* Good understanding of Linux server systems (userland)
* Pre-installed tools: text-editor, radare2, gdb
* Optional: ipython, IDA Pro (proprietary)

Skills to acquire

* Live system incident response and forensics using Linux's standard tools
* System hardening
* Introduction to reverse-engineering obfuscated scripts and binaries

Comment:

production notes