Author(s):	Olivier Bilodeau
Location	OGGB3
Date	jan Fri 16	Days Raw Files
Start	13:20	First Raw Start	12:24
Duration	0:45:00	Offset	0:55:50
End	14:05	Last Raw End	14:16
Chapters	00:00
Total cuts_time	50 min.

http://lca2015.linux.org.au/schedule/30181/view_talk
raw-playlist raw-mp4-playlist encoded-files-playlist host public tweet mp4 svg png

assets release.pdf Advanced_Linux_ServerSide_Threats_How_they_work_and_what_you_can_do_about_them.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:	--------- borked edit encode push to queue post richard review 1 email review 2 make public tweet to-miror conf done
Locked:	clear this to unlock
Locked by:	user/process that locked.
Start:	initially scheduled time from master, adjusted to match reality
Duration:	length in hh:mm:ss
Name:	Video Title (shows in video search results)
Emails:	email(s) of the presenter(s)
Released:	Unknown Yes No has someone authorised pubication
Normalise:
Channelcopy:	m=mono, 01=copy left to right, 10=right to left, 00=ignore.
Thumbnail:	filename.png
Description:	Server-side malware has evolved. Attackers used to be motivated by defacement or direct damage, using small-scale and targeted operations. Nowadays we are seeing an increase in organized crimeware campaigns leveraging compromised Linux servers for financial gain through website redirections infecting end-users and spam. Furthermore, malicious gangs base their operation's infrastructure on these same compromised servers, making takedown or law enforcement intervention complex since they run legitimate workloads. This presentation will cover the evolution of the financially motivated Linux malware and will describe the threats that were part of Operation Windigo which affects more than 25 000 servers. We will give in-depth technical details on the pieces of malware involved, show how they are deployed by the operators and how they are able to defeat current defensive technologies. More importantly, we will describe hands-on detection and incident response tricks to quickly assess one's servers and help in the fight. markdown
Comment:	production notes