Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Malware en Linux - Barcamp SE - Cali, Colombia 2013

948 views

Published on

El malware también existe en plataformas basadas en UNIX, como Linux.

Diferentes técnicas de infección, detección y eliminación de software melicioso.

Published in: Technology
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (Unlimited) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/qURD } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/qURD } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/qURD } ......................................................................................................................... Download doc Ebook here { https://soo.gd/qURD } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Malware en Linux - Barcamp SE - Cali, Colombia 2013

  1. 1. 1 Usa Linux decían ... ...En Linux no hay virus decían Alejandro Hernández CISSP, GPEN @nitr0usmx http://www.brainoverflow.org http://chatsubo-labs.blogspot.mx MALWAREEN LINUX
  2. 2. Contenido 2  ¿Por qué usar Linux (u otros basados en UNIX)?  Tipos de Malware  Similitudes y Diferencias con sistemas Windows  Motivadores para la creación de malware  Técnicas de Infección / Propagación  Demo(s)  Técnicas Anti Detección / Reversing / Debugging  Demo(s)  Técnicas de Detección / Eliminación  Demo(s)  Conclusión
  3. 3. ¿Por qué usar Linux (*NIX)? 3  Porque es “GRATIS”  PORQUE NO HAY VIRUS … DECÍAN  Porque es para expertos y hackers  Porque si…
  4. 4. ¿Por qué usar Linux (*NIX)? 4  http://www.dedoimedo.com/computers/linux-convert.html
  5. 5. ¿Por qué usar Linux (*NIX)? 5
  6. 6. ¿Por qué usar Linux (*NIX)? 6  http://www.dedoimedo.com/computers/linux-convert.html
  7. 7. Tipos de Malware en Linux 7  Backdoors  Plataformas de SPAM (Correo no deseado)  Servidores de archivos (FTP, Torrents, etc.)  Botnets  Virus  Bombas de tiempo  Sniffers de información bancaria  Etc.
  8. 8. 8  Rootkits  Set de herramientas para esconder rastros de ataque y mantener accesos futuros  Esconder archivos  Esconder procesos  Esconder conexiones de red  Usuarios escondidos  Y muchas otras capacidades Tipos de Malware en Linux
  9. 9. Motivadores para la creación de malware 9  Mayormente financiera  Espionaje  Recientemente cuestiones geopolíticas entran en juego  (Stalking)
  10. 10. 10 Similitudes y Diferencias con sistemas Windows
  11. 11. 11  Market share Similitudes y Diferencias con sistemas Windows
  12. 12. 12  Formato de archivo ejecutable  Windows: PE (Portable Executable)  Linux: ELF (Executable and Linking Format)  Muchos usuarios de Windows utilizan la cuenta de Administrador  Permisos de archivos en Linux por default  Menor factor de exposición Similitudes y Diferencias con sistemas Windows
  13. 13. Técnicas de Infección / Propagación 13  Existen virus / gusanos en diversos lenguajes de programación como:  Perl  Bash scripts  Python  Etc.  Los más comunes y sofisticados son en el formato de archivos ELF
  14. 14. Técnicas de Infección / Propagación 14  Executable and Linking Format  Formato de archivo mayormente utilizado en sistemas tipo UNIX como Linux, BSD, Solaris, Irix, etc.
  15. 15. 15  Muchísimas técnicas de infección de binarios ELF  Mayormente infección en los binarios estáticamente  Ejemplo, inyección de un parásito en el segmento de datos .text .data .bss Código malicioso: x6ax0bx58x99x52 x66x68x2dx46x89 xe1x52x66x68x65 x73x68x74x61x62 x6cx68x6ex2fx69 x70x68x2fx73x62 x69x89xe3x52x51 x53x89xe1xcdx80 Técnicas de Infección / Propagación
  16. 16. 16 .text .data .bss  nitr0us@linux:~$ ./binario_infectado Código malicioso: x6ax0bx58x99x52 x66x68x2dx46x89 xe1x52x66x68x65 x73x68x74x61x62 x6cx68x6ex2fx69 x70x68x2fx73x62 x69x89xe3x52x51 x53x89xe1xcdx80 Técnicas de Infección / Propagación
  17. 17. 17  nitr0us@linux:~$ ./binario_infectado Técnicas de Infección / Propagación
  18. 18. 18 DEMO INFECCIÓN ESTÁTICA INYECCIÓN DE UN PARÁSITO EN EL SEGMENTO DE DATOS ELF_data_infector.c http://www.brainoverflow.org/code/ELF_data_infector.c Técnicas de Infección / Propagación
  19. 19. 19  En tiempo de ejecución  Uno de los últimos troyanos identificado para Linux con capacidades de captura de información bancaria de los formularios de exploradores. “Hand of Thief” Trojan  https://blog.avast.com/2013/08/27/linux-trojan-hand-of-thief- ungloved/  https://blogs.rsa.com/thieves-reaching-for-linux-hand-of-thief- trojan-targets-linux-inth3wild/  http://ostatic.com/blog/hand-of-a-thief-linux-malware-goes-for-the- money Técnicas de Infección / Propagación
  20. 20. 20  “Hand of Thief” Trojan Técnicas de Infección / Propagación
  21. 21. 21  “Hand of Thief” Trojan  Es importarte mencionar que un usuario no se infecta “automáticamente” al descargar este troyano (al igual que la mayoría de malware en Linux)  El autor recomienda… “Hand of Thief’s developer did not offer a recommended infection method, other than sending the trojan via email and using some social engineering to have the user launch the malware on their machine.” www.infosecurity-magazine.com/view/34349/hand-of-thief-trojan-has-no-claws/ Técnicas de Infección / Propagación
  22. 22. 22  Otro de los últimos detectado es http://www.symantec.com/security_response/writeup.jsp?docid=2013-111815-1359-99 Técnicas de Infección / Propagación
  23. 23. 23  A diferencia de Windows, el malware en Linux no se ejecuta y propaga tan fácilmente  Mayormente se requiere de la interacción del usuario  Ingeniería Social  Otros vectores de ataque  Cronjobs  Modificación de archivos de configuración  .bashrc  Etc. Técnicas de Infección / Propagación
  24. 24. 24  Propagación a través de vulnerabilidades remotas  Exploits embedidos  Malas configuraciones  FTP / NFS / SMB con permisos de escritura para todos  Contraseñas por default en servicios de red Técnicas de Infección / Propagación
  25. 25. 25  Error de capa 8 (PEBKAC) Técnicas de Infección / Propagación
  26. 26. Detección / Reversing / Debugging 26  Muchas técnicas conocidas  Detección del entorno  Dejar de funcionar si está corriendo bajo una Máquina Virtual  Detección de ejecución a través de debuggers:  http://xorl.wordpress.com/2009/01/01/quick-anti-debugging-trick-for-gdb/  ptrace(PTRACE_TRACEME, 0, 0, 0)
  27. 27. 27  Hasta más avanzadas como las presentadas por aczid  Linux debugging & anti-debugging  Hack In The Random 2600  Netherlands  September 8, 2012  http://www.hackintherandom2600nldatabox.nl/archive/slides/2012/aczid.pdf  http://www.hackintherandom2600nldatabox.nl/archive/slides/2012/antidebuggin g.tgz Detección / Reversing / Debugging
  28. 28. 28 DEMOS APROVECHÁNDOSE DE FALLOS EN DEBUGGERS PARA “MATARLOS” http://blog.ioactive.com/2012/12/striking-back-gdb-and-ida-debuggers.html gdb_elf_shield.c http://www.exploit-db.com/exploits/23523/ Detección / Reversing / Debugging
  29. 29. 29 Técnicas de Anti Detección / Reversing / Debugging
  30. 30. Técnicas de Detección / Eliminación 30  Presencia de elementos extraños y/o no identificados  Procesos | Archivos | Conexiones | Puertos  nitr0us@linux:~$ netstat -ant | grep LISTEN  Cuentas de usuarios no identificados  ‘h4ck3r::0:0::/:/bin/sh’ (/etc/passwd)  Elementos ocultos  Carpetas como “. “ o “.. “ o que inician con “.” no salen con un listado normal $ls –l
  31. 31. 31  Ejecución periódica de herramientas de detección  chkrootkit  rkhunter  otras Técnicas de Detección / Eliminación
  32. 32. 32 DEMO DETECCIÓN DE ROOTKITS rkhunter http://rkhunter.sourceforge.net Técnicas de Detección / Eliminación
  33. 33. 33  Ejecución periódica de integridad de archivos  Hashes  MD5  SHA-1  Etc.  Herramientas como  Tripwire ($)  AIDE (Advanced Intrusion Detection Environment) Técnicas de Detección / Eliminación
  34. 34. 34  Antivirus  Detectan la existencia de código malicioso  Heurística  Sandboxes  Sensores de Red  Reverse Engineering  Etc. Técnicas de Detección / Eliminación
  35. 35. 35  Y se ve así… Técnicas de Detección / Eliminación
  36. 36. 36  Antivirus  Mayormente detección basada en firmas de virus, por ejemplo, una pequeña lista de malware conocido  http://en.wikipedia.org/wiki/Linux_malware Técnicas de Detección / Eliminación
  37. 37. 37  Los engines analizadores no son suficientemente buenos aún  Research de Tavis Ormandy vs Sophos Antivirus [SOPHAIL]  http://lock.cmpxchg8b.com/sophail.pdf Técnicas de Detección / Eliminación
  38. 38. 38  Los engines analizadores no son suficientemente buenos aún  En Febrero de 2013 analicé el engine de ELFs de ClamAV  En libclamav se encuentra elf.c, que es el engine analizador  Todas las variables son de tipo unsigned  Esto es bueno, sin embargo… Técnicas de Detección / Eliminación
  39. 39. 39  Existen validaciones muy básicas (bypasseables) como: if(file_hdr.e_phentsize == sizeof(struct elf_program_hdr64)) if(file_hdr.e_ident[5] == 1) /* endianess */ if(phnum > 128) ... for(i = 0; i < phnum; i++) { if(shnum > 2048) Técnicas de Detección / Eliminación
  40. 40. 40 DEMO EJECUCIÓN DE ANTIVIRUS ClamAV http://www.clamav.net Técnicas de Detección / Eliminación
  41. 41. Conclusión 41  En Linux, SI hay virus y demás malware  Sus mecanismos de seguridad por default no lo hacen tan vulnerable contra el malware  El porcentaje de usuarios es mucho menor que Windows, así que el nivel de exposición también es menor  Existen tendencias de atacar estaciones Linux de usuarios finales para obtención de información financiera y datos personales  El software anti-malware para Linux necesita mejorar
  42. 42. 42 G R A C I A S 42 Alejandro Hernández CISSP, GPEN @nitr0usmx http://www.brainoverflow.org http://chatsubo-labs.blogspot.mx

×