Linux Malware and Security, with Craig Rowland
Cybersecurity Advisors Network
Release Date: 04/17/2024
Nigel Phair - Nigel Phair - Cybercrime, Cybersecurity, Cyber-Certification, and More
Cybersecurity Advisors Network
We are honoured to welcome Nigel Phair, founding force behind Australia’s first High-Tech Crime Centre, Director for CREST Asia Pacific and Cybersecurity Professor at Monash university, to the Secure-in-Mind podcast. In this episode, we trace his shift from AFP investigations to shaping global infosec certification, we touch on Australia’s evolving cyber-professionalisation debate, and explore how AI and low-/no-code tools are rewriting secure development. We cross a lot of territory, so whether you're on a board or on a development team, there'll be something for you. Blog post with...
info_outline
Philipp Amann - Policy, Patching, Programming
Cybersecurity Advisors Network
Nick Kelly is pleased to welcome Philip Amann, the current Head of Digital Security at the and veteran strategist from , The , the , and beyond, for our latest podcast episode. We cut straight to how real-world security gets built: nailing secure coding and patching before chasing zero-days, turning and mandates into everyday habits, and even gamifying developer training to tackle legacy tech. Whether you’re drafting policy or shipping production code, this conversation offers practical takeaways on making cybersecurity everyone’s business. Tune in for some incredible...
info_outline
Artificial Intelligence, Cybersecurity, and Society - With Vilija Vainaite
Cybersecurity Advisors Network
Vilija Vainaite is co-founder of Women 4 Cyber Netherlands, and of Encode Europe. Notes and links: Due to the volume of supporting links and text, we've listed them on the CyAN blog, available here: Vilija Vainaite on LinkedIn: John Salomon on LinkedIn: Check out the rest of CyAN's media channels on https://cybersecurityadvisors.network/media - and visit us at Original video at Intro/outro music courtesy of Studio Kolomna via Pixabay:
info_outline
Return of the Bride of Terrorism, With Bjørn Ihler
Cybersecurity Advisors Network
Bjørn Ihler is Director of the Sweden-based Khalifa Ihler Institute, as well as founder and CEO of Revontulet, a Norwegian consultancy devoted to helping organisations protect themselves against terrorism and violent extremism. Part III of our mini-series on terrorism and violent extremism deals with freedom of speech, laws, personal and corporate obligations, and support for survivors of extremist violence. Notes and links: Due to the volume of supporting links and text, we've listed them on the CyAN blog, available here: Bjørn Ihler on LinkedIn: John Salomon on LinkedIn: ...
info_outline
Bjørn Ihler - Let's Talk Terrorism, Part II
Cybersecurity Advisors Network
Bjørn Ihler is Director of the Sweden-based Khalifa Ihler Institute, as well as founder and CEO of Revontulet, a Norwegian consultancy devoted to helping organisations protect themselves against terrorism and violent extremism. We continue our conversation about terrorism - including whether the term has been watered down due to overuse, how we can spot extremist content, what some of the tactics of actors are, and how extremist and violent groups relate to more legitimate-yet-extreme political parties. Notes and links: Due to the volume of supporting links and text, we've listed them...
info_outline
Let's Talk Terrorism, With Bjørn Ihler
Cybersecurity Advisors Network
Bjørn Ihler is Director of the Sweden-based Khalifa Ihler Institute, as well as founder and CEO of Revontulet, a Norwegian consultancy devoted to helping organisations protect themselves against terrorism and violent extremism. An activist, expert, and frequent speaker on the topic of terrorist and violent extremist content (TVEC), Bjørn joins us today to share his thoughts on the very broad topic of "terrorism". What is it, who are the major actors, who is affected and how, where does terrorism come from, and more - these are all topics that we touch on in this fascinating...
info_outline
DPO & Hacker Éthique : Une synergie stratégique au cœur de la cybersécurité
Cybersecurity Advisors Network
Retour sur le webinaire organisé par l’initiative Black Is Ethical – 26 mars 2025 Le 26 mars 2025, l’initiative Black Is Ethical, soutenue par le Cybersecurity Advisors Network (CyAN) a organisé un webinaire autour d’un thème essentiel pour l’avenir de la cybersécurité :Comment instaurer une relation de confiance entre le Data Protection Officer (DPO) et le Hacker Éthique ? Ce webinaire a permis de croiser les regards de professionnels issus des domaines de la protection des données, de la sécurité offensive et de la gouvernance numérique. Version video: ...
info_outline
Information Sharing, Cybersecurity Politics, Threats, and More
Cybersecurity Advisors Network
This week, CyAN welcomes Gate15 Managing Director Andy Jabbour for a meandering talk around intelligence sharing, information security investments and ROI, US and European cyber policy, defence, and more. Notes and links: Due to the volume of supporting links and text, we've listed them on the CyAN blog, available here: https://cybersecurityadvisors.network/2025/03/21/new-podcast-information-sharing-cybersecurity-politics-threats-and-more/ Andy Jabbour on LinkedIn: https://www.linkedin.com/in/andy-jabbour/ ...and on BlueSky: @andyjabbour.bsky.social John Salomon on LinkedIn:...
info_outline
Breaking the Cycle: Combating Online IBSA for a Safer Digital Experience
Cybersecurity Advisors Network
Image-Based Sexual Abuse (IBSA) is a Growing Threat Online! IBSA can happen to anyone—regardless of age, sex, or gender. With the rise of AI and deepfakes, both real and fake intimate images are being shared without consent, causing immense harm. Explore the recorded session of "Breaking the Cycle – Combating Online Image-Based Sexual Abuse." Delve into expert discussions on the severe impacts of IBSA (Image-Based Sexual Abuse), strategies for prevention, and the pivotal role of technology in creating safer digital spaces. This webinar discusses the complexity and...
info_outline
State of (Cyber)War - Military Cryptology, Part II: The Cold War and Beyond
Cybersecurity Advisors Network
Due to the volume of supporting links and text, we've listed them on the CyAN blog, available here: Hugo Tarrida on LinkedIn: John Salomon on LinkedIn: Check out the rest of CyAN's media channels on https://cybersecurityadvisors.network/media - and visit us at Original video at https://youtu.be/twC6NTt9R8E Intro music courtesy of AlexiAction via Pixabay: https://pixabay.com/users/alexiaction-26977400/ Outro music courtesy of Studio Kolomna via Pixabay: Episode artwork via
info_outlineIn today's conversation, Craig Rowland joins us to talk about the often overlooked significance of Linux as a key part of global communications and computing infrastructure, and discuss various types threats targeting Linux systems.
Malware, attackers, and techniques are often very distinct from those seen on Windows; Craig shares insights all of these from his extensive experience both writing and reverse-engineering Linux malware.
Craig is CEO of Sandfly Security, a New Zealand-based provider of Linux threat behavior scanning tools. Full disclosure: John Salomon is a paid consultant to Sandfly Security.
Notes from the video:
03:48 I can't find a source for the 95% figure, but a 2023 ZDNet article says 90%, which seems to be the most common figure: https://www.zdnet.com/article/linux-has-over-3-of-the-desktop-market-its-more-complicated-than-that/
03:55 Percentage of top million websites running Linux is another interesting statistic, which seems to be well above 90%. For example: https://gitnux.org/linux-statistics/
04:08 https://www.linuxinsider.com/story/the-flying-penguin-linux-in-flight-entertainment-systems-65541.html etc. etc.
05:54 France's Gendarmerie Nationale: https://en.wikipedia.org/wiki/GendBuntu
06:40 https://www.zdnet.com/article/linux-not-windows-why-munich-is-shifting-back-from-microsoft-to-open-source-again/
14:10 A propos, F5 has some interesting ways of using web shells as an attack vector: https://www.f5.com/labs/learning-center/web-shells-understanding-attackers-tools-and-techniques
14:40 "attacks on kubernetes" is a fun web search string. Same for "attacks on S3 buckets". Enjoy.
14:56 https://redis.io/solutions/messaging/
15:42 https://en.wikipedia.org/wiki/Patch_Tuesday
17:40 To be fair, Bob in Accounting is a pretty powerful entry point to the organization for various types of cyberattackers.
19:35 Mirai botnet: https://www.cloudflare.com/learning/ddos/glossary/mirai-botnet/
19:37 NoaBot: https://www.akamai.com/blog/security-research/mirai-based-noabot-crypto-mining
20:35 Chroot (change root directory): https://wiki.archlinux.org/title/chroot
27:42 PuTTY: https://www.putty.org/
29:45 There are several cryptojackers that try to neutralize competing malware, e.g. ChaosRAT https://www.trendmicro.com/en_th/research/22/l/linux-cryptomining-enhanced-via-chaos-rat-.html or Jenkins https://www.f5.com/labs/articles/threat-intelligence/new-jenkins-campaign-hides-malware--kills-competing-crypto-miner
35:30 For example LockBit: https://www.akamai.com/blog/security/learning-from-the-lockbit-takedown
35:37 My mistake - AvosLocker is also a Linux port of Windows malware: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker - HiddenWasp may be a better example: https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/hiddenwasp-malware-targets-linux-systems-borrows-code-from-mirai-winnti
35:42 Diamorphine LKM rootkit: https://github.com/m0nad/Diamorphine
36:44 https://core.vmware.com/esxi - an example is ESXiArgs ransomware: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-039a
38:42 Abuse.ch MalwareBazaar: https://bazaar.abuse.ch/
38:49 Fraunhofer FKIE Malpedia: https://malpedia.caad.fkie.fraunhofer.de
39:35 You could just run a Linux version of the virus aquarium: https://xkcd.com/350/
39:52 A few examples of VM detection: https://www.cynet.com/attack-techniques-hands-on/malware-anti-vm-techniques/
41:15 Joe Sandbox: https://www.joesandbox.com/
42:10 No I won't, because I can't find it. Bit of Baader-Meinhof going on there...
42:59 https://www.youtube.com/@SandflySecurity
Craig on LinkedIn: https://www.linkedin.com/in/craighrowland/
Sandfly Security: https://sandflysecurity.com
Check out the rest of CyAN's media channels on https://cybersecurityadvisors.network/media - and visit us at https://cybersecurityadvisors.network
Intro/outro music courtesy of Studio Kolomna via Pixabay: https://pixabay.com/users/studiokolomna-2073170/
Original video available at https://youtu.be/W-7edx7Le6Y?si=NOoOy1kF3KiVOPUe