Training for Linux Forensics
After the two Network Hunting and Incident Response trainings I had a refresh training for Linux forensics last week
After the two Network Hunting and Incident Response trainings I had a refresh training for Linux forensics last week.
Here are my personal main points as valid information for you from the Linux forensics training:
- Without memory analyses it is mostly impossible to catch any modern Malware on Linux systems.
- Analyse of Linux flies make only sense on other Linux machines.
- Never run forensics on live target system because we cannot trust the Linux server at all.
- If you able to catch modern malware on Linux, you can be sure a second Malware on the same Server exist as well.
- With modified kernel modules modern Malware can hide anything from any root user and open hidden communication channel.
- Always use at least two out of the three preferred memory dump tools to capture memory.
- Some very advanced malwares detect memory capture ongoing process and store malware before capturing out of the memory to the HDD and after three minutes inject it back into memory.
- With pure log analyse on the target Linux system you will normally not find any modern malware.
- Active network hunting is required.
These four days of state-of-the-art Linux forensic training based on today captured malware was really eye opened for me regarding hiding processes from root users.
