veyepar: Advanced Linux Server-Side Threats: How they work and what you can do about them

Author(s):	Olivier Bilodeau
Location	OGGB3
Date	jan Fri 16	Days Raw Files
Start	13:20	First Raw Start	12:24
Duration	0:45:00	Offset	0:55:50
End	14:05	Last Raw End	14:16
Chapters	00:00
Total cuts_time	50 min.

http://lca2015.linux.org.au/schedule/30181/view_talk
raw-playlist raw-mp4-playlist encoded-files-playlist host public tweet mp4 svg png

assets release.pdf Advanced_Linux_ServerSide_Threats_How_they_work_and_what_you_can_do_about_them.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

Server-side malware has evolved. Attackers used to be motivated by defacement or direct damage, using small-scale and targeted operations. Nowadays we are seeing an increase in organized crimeware campaigns leveraging compromised Linux servers for financial gain through website redirections infecting end-users and spam. Furthermore, malicious gangs base their operation's infrastructure on these same compromised servers, making takedown or law enforcement intervention complex since they run legitimate workloads.

This presentation will cover the evolution of the financially motivated Linux malware and will describe the threats that were part of Operation Windigo which affects more than 25 000 servers. We will give in-depth technical details on the pieces of malware involved, show how they are deployed by the operators and how they are able to defeat current defensive technologies. More importantly, we will describe hands-on detection and incident response tricks to quickly assess one's servers and help in the fight.

Comment:

production notes