Відео

Thanks for watching!

We assume anyone that gets on a Linux box is going to get root is our philosophy. There are many ways it can happen with bugs, mis-configurations, etc. We scan systems on random basis for signs of attack but are not a vulnerability scanner. We specifically focus on compromise detection and agentless threat hunting. Many systems remain unpatched or open to attack and admins need an automated way to search out and identify hosts that have been compromised. Hope that helps.

Yes. The chart basically is this: $1$ = MD5 $2a$ = Blowfish $2y$ = Blowfish $5$ = SHA-256 $6$ = SHA-512 $y$ = yescrypt

Thanks for the compliment and watching. We will be posting a lot more of these short topic videos so please subscribe.

@SandflySecurity Already did! Also maybe if it's possible to make the red font a little brighter ☺️

Thanks for the feedback. We'll fix for next time.

And built into most distros!

Thanks for the comment. No doubt it's possible to hide on Linux for quite a while.

It doesn't matter what cryptographic hash you use. The problem is identical. In fact, the longer the hash, the more of a problem it actually becomes.

It was demonstrating how easy it is also for a malware binary to be changed and why using hashes to look for malware is a bad approach. The use of a system command is just convenience for others that want to try it as an experiment. You are correct that hashes work great for spotting things that change where you don't want them to change (like a distro binary). They work very poorly for malware that changes all the time.

@@SandflySecurity Ah OK that makes sense. If you're skimming your server for a known exploit .badbash.rc and are scanning based on hash value, yeah the hash might change every time it's run

@@SandflySecurity Exactly. A lot of AVs do hash based static analysis and it's absolutely worthless 90% of the time. I've had at least 10x more false positives from hash based detection than true positives

@@cedricbrisson7240 I mean kind of? Most use yara rules that look for specific bytes in critical sections that a malware can't easily change. Maybe its just my exposure but I don't see many people using hashes to identify malware. What I do see are systems using hashes to identify goodware (for lack of a better term).

Thanks. Please spread the word!

We can profile systems running containers. You can also use recon modules that include only containerized processes, or do not include containerized processes to setup what kind of drift you want to find. For instance, profile containerized to only track containers running on a host. Or track non-containerized only to only track the host OS regardless of what containers it is running. Thanks for your comment.

Thank you for clarification. It would be very helpful to see a video that demonstrates how to hunt for threats on a Kubernetes node.

Thanks for the comment. No plans for a course yet, but our product can teach you a lot about Linux forensics by just what it does. We have a free license for home lab users that may be of interest.

Best way would be to profile the known-good image of where the system started (e.g. base image of the distro used). Then scan the prod system and review each change alert to make sure you know what it is (does this process belong here, is this user OK?, etc.). Then add/append it to the drift profile. After that, all new changes will be alerts going forward. You can then also use that profile to check your other systems to see how they drifted from your updated profile.

Customers self-host our product where they want. It is not run by our company and no customer data is sent to us in any form. You can self-host on-prem, in the cloud, or wherever you want. SSH secrets can be managed by our product with elliptic curve cryptography protecting the keys, or we can integrate with a key vault of your choice. Please read more about SSH key security in our install docs: docs.sandflysecurity.com/docs/standard-vs-maximum-security-install docs.sandflysecurity.com/docs/credentials-security We do not store or process any customer data here: sandflysecurity.com/why-sandfly/data-privacy/

I 99% sure their server connects to all the machines via SSH and then issues 'recon' commands over the SSH connection. You see during his setup that he's assign SSH credentials to each of the new boxes so that their server can connect. Generally any management software that calls itself agentless generally means it's using SSH (or equivalent).

We connect over SSH and have a purpose built binary with Linux forensic engines to gather data. We do not hook into the kernel or leave anything permanently running as is typical of agent-based deployments.

@@SandflySecurity Ok, thanks.

@@SandflySecurity Without access to ring 0, are you relying entirely on userland indicators as demonstrated in this video? The centralized collector and viewer is nice, but what does this offer, mechanically, over something like tripwire?

We use a variety of indicators and artifacts from a host but do not hook into ring 0 as it is not necessary to find virtually any malware on Linux (and introduces stability and performance impacts). We have no recent experience with tripwire, but in general we do not do just traditional file integrity monitoring, but can also profile running processes (even done by fileless malware). Also users, cron entries, systemd services, SSH keys, at jobs, and so on. Any forensic artifact we collect can be tracked for drift agentlessly. Finally, we can work on any Linux host we can log into which includes not just servers, but embedded systems, appliances, and so on up to a decade+ old. We also cover Intel, AMD, ARM, MIPS and Power CPUs seamlessly on virtually any Linux distribution.

Thanks for the compliment.

Thanks. We'll make it larger for future videos.

Thanks for watching.

Thanks for watching.

Thanks for watching.

We will have that feature soon as it is on our near-term roadmap.

Thanks for your response. Pricing is one of these things where it can vary so much depending on a customer's size and number of endpoints that we just need to talk to them to see how many hosts they actually have to see what discounts apply. The product is affordable even for very small deployments and also for very large ones. We don't actually look at any logs or use any built-in system tools at all. We have custom built forensic engines designed specifically to investigate Linux. We are addressing after the fact intrusions because that is the major exposure for Linux. Even if you have a security product that claims to intercept and block all attacks (not possible), then there is always the chance the intruder still gained entry. For instance a product that blocked five attacks and gave you five alerts. That's fine. But suppose there was a sixth attack it simply didn't see or block and that worked? At that point you better be looking on the host for compromise signs or you are in trouble. If we detect attacks we can in fact respond to them. The latest version of the product can actively respond to process attacks by either suspending or killing the malicious process as soon as it is found. Other response options are possible. On top of this you can also build your own custom checks very easily and deploy them agentlessly. So if you are dealing with a specific threat to your orgranization and want to keep it confidential you can deploy custom modules yourself to help with incident response and clean-up. Contact us if you'd like a demo for your organization. We are happy to give a live demo on live attacks and supply a trial license. Thanks.

Thanks for the comment.

Too many to list and changes constantly!

🤔....how bout just post q pic and I'll do the rest. I'm overwhelmed at the layered onion this topic has become. It seems almost purposely convoluted and obfuscated. Typical / average ....navice..... users have no hope of securing themselves in today's cyberspace. As a programmer, I'm hoping to deep dive and become competant in this space before looking into where some attention should be directed in order to enable the average user some useful and reliable tools for better protection. Virus software that simply white or black lists or compares hashes against a lookup table are woefully unable to offer any real protection. We need software that can recognize what a script/executable/binary is actually doing and how its interacting with the OS and to limit and restrict BEHAVIOR rather than to attempt to use lazy shortcuts that are easily defeated. We need to create security software that can find unknown vulnerabilities based on more granular analysis of the system it protects. I also think that the whole trust model the cert authorities are providing have proven useless and another framework is needed soon. I think that anything involving "trust" metrics have proven in recent years, to be a corrupt and broken system. The most effected of these sloppy policies are the average user. ....and they are likely ovlivious. Although ignorance can reduce the shock of some situations (your identity has been stolen, 110k pervs are watching your daughter shower thru her phone and you just realized that on the internet, men are men......women are men and teenage girls are FBI Guys) for these average folk, that may be enough. However, I prefer knowing- REGARDLESS if there is nothing I can do. ... at least i can take comon sense precautions to protect my data, money and privacy. G Daerr

Search for it at firstmonday.org. It should still be there.

Written in C.