Linux security

Axios

This guy is suppose to be the best in linux security 30+ years
Been reading his twitter page and have disected some useful commands to run
for kernal rootkits. (needless to say I am clean) (I didnt even know you could do this with few simple linux commands!!!)
It Is very dry reading and if anything it should enlighten a person on linux security even if you just read it
I will keep thumbing through it from time to time and reading picking up on things.
https://twitter.com/CraigHRowland

Hope you can find it useful.
Note He just deals with linux.

brent

a lot of it was him hawking his services but the real gems were his linux compromise assessment cheat sheet of where to look for problems, and the stuff other people (mostly infosec peeps) sent him.
On the cheat sheet most infected files start with immutable files🙂 but probably there was no sequence to the info.

Also under process to look at is something I've seen before in my windows days:

Lots of place to probe if one was worried. but I wouldn't know how to interpret the output if I was intruded. but that's what search engines are for. I bookmarked this, it's cool.

Axios

brent Not really worried more of learning than anything I am a sponge for this crap lately....Guess to much news...
Some the wild stuff just blows my mind that ppl would sit down and think up stuff like that but I never did think
like a criminal...lol

I compiled late last nite a program they make and ran it with those other commands on solus mate and it was uneventful not that I thought I would find anything but still cool. (Mostly rootkit detection)
will put them in my little securtiy bag to have and run from time to time and add to.

brent

Axios yep I have one of those security bags too. I have a morbid curiosity about that too. Every year I read about more and more tricky linux bad actors doing bad linux things and it makes me wonder sometimes.
For the 2nd time in my Linux life I ran the flatpak version of ClamAV recently. 460 infected files. 458 were Libre Office files which is Clam's normal 99% false positive rate...the other file was identified as a WIN trojan (clam av is mostly WIN signatures isn't it?) so that I just threw away and maybe a downloaded program was ID's as a PUA.
so no worries but I'm surprised more people don't find clam useless.
What kinds of things do you do to detect rootkits?

Axios

brent CLAM IS JUNK-CRAP..

Check for tainted kernel
I start with this if it comes back 0 with the first command yer good if not you need to research
further. (Could or Could not be something)
https://twittez.com/CraigHRowland/status/1628883826738077696
(change the z-r above in twittez..lol )

Then I check for hidden pids
Go here download the program you need to have golang installed (in repo) compile
Got to run it manual from terminal or the terminal window will close without seeing results.
https://github.com/sandflysecurity/sandfly-processdecloak

Reading and trying to understand the systemd stuff little more confusing.
when i figure it out will post.

Other than eufi (another whole issue in itself)
What little I have read on eufi varmits is you should be running secure boot,but got read more on that

All I got right now but its a start.
As I said earlier Solus mate had flying colors with those 2 tests
Note I am prob about 50/50 on installing crap from all over internet...lol

brent

Axios love it, thanks. it's a project for another night with lager and patience.

brent

Axios ok I downloaded the sandfly hidden pid (rootkit) software and am going to test is across solus/fedora and compare. then golang etc from repo.

Axios Got to run it manual from terminal or the terminal window will close without seeing results.

ok will do with the old ./blah command. let me read whatever readme is in the targz.

it's interesting. when I got into linux in 2017 most people (especially here at the time) scoffed and said linux never gets anything. it's true. I never got anything I know of. with WIN you have no choice to bring in already compromised outside software to run against your already compromised native software and WIN is an endless loop of scans/rootkit hunts/malware detection because it all shows infected every scan every software maker every time except the mysterious windows in-house scans that never find anything... And they pass this off as normal computing to 96% of the world market....what a fool I was all those all years....all your custom policy/group settings, registry settings...all reset unbeknownst to you after some updates...normal computing....
...but blackhats are getting restless looking at Linux more and more all the cool sources are saying...

lotsa blah blah blah just to say I wonder whats out there besides the awful Clam? thanks for the tips it might be worth a couple hours soon

Axios

brent On my main win7 machine had avg updated it awhile back and it crashed
whole thing Fiddled around awhile got machine booting and running again.
needless to say all I run on those now is malwarebytes.

Linux just trying put together few simple things that I can run now then (peace of mind I guess)
Did read eset and kerpasky only 2 that really do linux roots and out those 2 eset because you can choose
what to scan and what to do with it, if it finds something (going download bootable eset iso someday and try it)

The 2 I gave you from researching are prob dependable what to do with it if it finds something is another story..lol (printed page as pdf and put in directory so I would have it)

Looking at another one but I think its interitation is to broad hence maybe to many falses
(I dont want that still thinking on it)

Work in progress.
Grumbles speel check internet ruined my speeling

brent

Axios On my main win7 machine had avg updated it awhile back and it crashed
whole thing Fiddled around awhile got machine booting and running again.
needless to say all I run on those now is malwarebytes.

I liked W7 and would of kept it if I didn't nuke it. notoriously stable. wonder if it took a dive on you being out of service so long or avg scan. malwarebytes was a decent scan I forgot about that one. it missed sometimes too but reliable. man I like eset best too a cut above most a/v's. kaspersky was the same as sophos to me: competent but they always left me skeptical.
I can't imagine running an operating system where I needed all that crap daily anymore.... That was WIN life.
Even in my Mac days maybe scan once a week.

yeah peace of mind. just stepping into that world now w/linux. sign of the times.