veyepar: The dark side of the ForSSHe

Author(s):	Hugo Porcher, romain dumont
Location	C3
Date	jan Thu 24	Days Raw Files
Start	16:45	First Raw Start	16:33
Duration	0:45:0	Offset	0:11:36
End	17:30	Last Raw End	17:33
Chapters	00:00 0:18:57
Total cuts_time	37 min.

https://2019.linux.conf.au/schedule/presentation/157/
raw-playlist raw-mp4-playlist encoded-files-playlist host public tweet mp4 svg png

assets release.pdf The_dark_side_of_the_ForSSHe.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

In February 2014, ESET researchers from Montreal published a report on a group who compromised more than 40,000 Linux servers worldwide since 2011. This research was presented at the LCA 2015 as Operation Windigo. The modus operandi of this campaign consisted mainly in stealing login credentials through an OpenSSH backdoor called Ebury, allowing them to extend their network of compromised servers. Prior to the installation of the backdoor, operators used a recon script to collect a handful of information, including the presence of other OpenSSH backdoors on the system.
In 3 years, we collected hundreds of undocumented samples matching the rules based on the signatures we extracted from the script. This talk will present the analysis we made of these samples, from the most basic ones to advanced ones involving exotic encryption algorithms, anti-logging and diverse methods of exfiltration.
In order to pivot on these findings, we have setup a custom honeypot infrastructure and let the operators behind the backdoors play with it. We will present the checks they make before deploying their malware, how they install it and the lateral movements we observed so far. We will also talk about the new samples we were able to obtain thanks to this poker strike. 
Finally, we will give some pointers on preventing this kind of threats and how one can ensure the legitimacy of OpenSSH daemons and clients.

Comment:

production notes