LinuxCon + CloudOpen + ELC-E Europe 2014

Server-side malware evolved. Attackers were motivated by defacement or direct damage, using small-scale and targeted operations. Nowadays we are seeing an increase in organized crimeware campaigns leveraging compromised Linux servers for financial gain through website redirections infecting end-users and spam. Furthermore, malicious gangs base their operation's infrastructure on these same servers, making takedown or law enforcement intervention complex.

This presentation will cover the evolution of Linux malware and describe the Windigo threats affecting more than 25 000 servers. We will give in-depth technical details on the malware involved, show how it is deployed by the operators and how they are able to defeat current defensive technologies. More importantly, we will describe hands-on detection and incident response tips to quickly assess one's servers and help in the fight.