Linux Threat Hunting - PSW #942 — Security Weekly Podcast Network (Audio)

Paul Sedorian leads a technical segment on Linux threat hunting, detailing how attackers abuse startup services, systemd overrides, and legacy init scripts to hide indicators of compromise. He emphasizes the need to verify system integrity by comparing file hashes and using external binaries, as local utilities may be compromised. The discussion highlights that despite decades of knowledge, many organizations still fail to monitor these basic persistence mechanisms effectively.

Topics discussed

Introduction to Linux threat hunting and IOCs Show intro and sponsor read Attack Surface Management Summit promotion Technical segment overview and GitHub repo Threat hunting on Linux devices vs servers Memory snapshots and binary integrity Bringing your own binaries for forensics Core dumps and read-only mount volumes Bootable media and session recording Zero Trust and kernel update challenges Live response tips and attack surface Startup services as IOC locations Why basic startup checks matter SysV init scripts and rc.local Systemd configuration files and overrides User-specific startup directories Local accounts and federated identity Desktop vs server startup scripts Monitoring local account creation Attackers exploiting configuration cracks Systemd timers vs cron jobs LD_PRELOAD and code execution Systemd overrides and package shipping Detecting malicious startup patterns Default security and user responsibility Audit logs and anomaly detection tools Journalctl and distro-specific configs CIS benchmarks and detection engineering Security news segment introduction Water systems cybersecurity focus Regulations for water system security Water quality vs cyber regulations Free water system assessment program Red team exercises in critical infra Vulnerability reports and basic hygiene Effectiveness of security exercises Real-world consequences of negligence Mannequin vs real incident impact Specific vs holistic security changes Patching and EDR limitations Institutional security changes Open source OS age verification law Protecting children on Linux Parental supervision of devices Meta's kids messenger and oversight Human judgment in tech safety Privacy vs safety for children Enabling non-experts in security Internet as a privilege State regulation of internet access Early hacker culture and free internet Use cases and access restrictions Patriot Act vs GDPR comparison Privacy Act of 1974 relevance Patronizing tone in security discourse AI-generated patch reports Fortinet vulnerability and detection Vendor neutrality and detection tech Who is watching the watcher Probability of doom in AI Cisco XR software hardening Cisco NX-OS attack case discovery Reserve ports and CVEs Chaining low and medium vulnerabilities PaperCut print management vulns Running latest models and software Evolution of security over 30 years Trust in vendors by maturity level Fortune 500 vendor scrutiny Vendor scrutiny research studies PCI compliance in Fortune 100 Outsourcing PCI compliance Building plans and regulatory needs Security poverty line and trust Security as a commodity Cost vs security in device choice Nvidia entertainment device security Cheap devices and botnets Persistence of botnet issues Evolution of media consumption PCI v4 remediation plans Chaining vulnerabilities in attacks Government intervention in security Dusty corners and infrastructure management DNS zones and phone number routing Leaked call data and metadata Patriot Act and FISA loopholes Metadata collection and evidence Hypothetical information scenarios Movie night and sci-fi AI Star Trek and AI themes Corporate calls for government action United Laboratories and funding AI for defensive malware analysis Validating AI malware findings Modern terms for AI security AI and civilization terminating events

Episode summaries and topics are generated from the audio by Castria — a free podcast app that skips ads automatically. IP Geolocation by DB-IP

Linux Threat Hunting - PSW #942

Summary

Topics discussed