Sign up to our newsletter
Following the recognition at Virus Bulletin 2014 of ESET’s research on Operation Windigo, I took the opportunity to ask Marc-Etienne Léveillé – who worked directly on the Operation Windigo report a few questions. Marc-Etienne is a malware researcher at ESET. He is interested in reverse engineering Linux and OS X malware. He is passionate about making links between different malware to have an overall view of how they are interconnected.
Quite some time has passed since you last spoke about the large Linux crimeware operation dubbed Operation Windigo. Has there been anything happening lately worth of mention?
We are still monitoring the Windigo gang. Unfortunately, we have not observed a decrease in their malicious activities since the publication of the report in March 2014. We still measure and block the same amount of traffic being redirected from Cdorked websites. Moreover, the various pieces of malware have been updated to evade our indicators of compromise (IoC).
What is the biggest challenge posed by threats like these to system administrators?
We have been notifying a lot of infected parties and I would say that the lack of Linux forensic knowledge is the main problem for sysadmins. Windigo uses a lot of tricks to stay under the radar. Since it doesn’t interrupt the affected server’s legitimate activity, such a server could be infected for a very long time before the administrator notices the infection. Some sysadmins may stay in denial and refused to believe their server is infected.
What does the ESET research team do to raise the awareness of the issue?
We are trying to reach out to the security community to help sites with Internet-facing servers protect themselves against the Windigo threat, and against other general purpose Linux malware overall. An effective way to do so is to get the opportunity to speak directly to system administrators and security researchers who are front-line defenders against such threats. That’s why we were so happy to present on the topic at DerbyCon and, in collaboration with Yandex, at Virus Bulletin.
In the near future we will be presenting at the following conferences:
If your readers would like to know more about Operation Windigo or Linux malware reverse-engineering, forensics and incident response please come and talk to us.
What kind of changes were introduced in the recent versions of the Linux/Ebury malware?
The authors of the Ebury malware react quite quickly to our publications. Within a month, we’ve seen a new version of the malware evading our indicators of compromise. Here are a few of the most noticeable changes:
Using this new information gleaned from our monitoring, CERT-Bund has updated its page with the Ebury IOCs.
In addition to the “Good job, ESET!” from the malware authors, your team has won the first Virus Bulletin Péter Szőr award for your report on Operation Windigo. How does that make you feel?
There were a lot of excellent papers on malware research this year and I would like to give credit and respect to the other nominees and to all the researchers who have published great work in the last years.
In addition to what was said before, I would like to acknowledge that most of the co-authors and researchers involved in the Operation Windigo paper are newcomers to the anti-virus industry. For us, receiving an award like this is much appreciated recognition from our peers and gives us confidence that we are heading in the right direction.
Our first priority is to protect our customers against all threats, including new and emerging ones. As a researcher, it is great to be able to focus deeply on a specific threat like this one. Thanks to ESET’s belief in proper research, we were able to really do a deep investigation and protect our customers at the same time. We are really pleased it was so well received by the press, our customers and Virus Bulletin.
Thanks Marc-Etienne for your time.
Author Olivier Bilodeau, ESET