Explore the dark underbelly of OpenSSH backdoors in this 38-minute conference talk from linux.conf.au. Delve into the analysis of Operation Windigo, a campaign that compromised over 40,000 Linux servers worldwide. Discover the modus operandi of cybercriminals, including their use of the Ebury backdoor to steal login credentials. Learn about the researchers' collection and analysis of hundreds of undocumented malware samples, ranging from basic to advanced implementations with exotic encryption algorithms and anti-logging techniques. Gain insights into the custom honeypot infrastructure used to study attacker behavior, including their pre-deployment checks, installation methods, and lateral movements. Acquire valuable knowledge on preventing such threats and verifying the legitimacy of OpenSSH daemons and clients. This talk provides a comprehensive look at the evolving landscape of OpenSSH-based attacks and offers practical advice for securing Linux systems against these sophisticated threats. Read more