Главная
Study mode:
on
1
Intro
2
About this presentation
3
Why malware on Linux servers?
4
Why care?
5
Why understand them?
6
Artifacts
7
Common file metadata
8
Basic filesystem
9
Package integrity
10
Logs
11
Using auditd
12
Offline filesystem
13
Analyzing a live process
14
procfs exe magic link
15
Process stalling
16
Process memory dump
17
Kernel memory
18
Network configuration
19
Network capture
20
Two approaches
21
Reversing script-based malware
22
Reverse engineering compiled malware
23
This week you should
24
Within three months you should
25
Next you should
Description:
Explore server-side Linux malware threats and learn effective analysis techniques in this 46-minute RSA Conference talk by ESET Senior Malware Researcher Marc-Etienne M.Léveillé. Gain insights into creating a safe environment for studying Linux malware, understanding common artifacts, and investigating file metadata. Discover methods for examining basic filesystem structures, verifying package integrity, and analyzing logs using auditd. Learn to analyze live processes, utilize procfs exe magic links, and perform process memory dumps. Delve into kernel memory analysis, network configuration examination, and network capture techniques. Master two approaches: reversing script-based malware and reverse engineering compiled malware. Acquire practical skills to enhance your Linux security expertise and better protect your infrastructure against evolving threats.

Hunting Linux Malware for Fun and Flags

RSA Conference
Add to list
0:00 / 0:00