HOWTO : ClamAV 0.99 on Ubuntu 16.04 LTS

Clam AntiVirus (ClamAV) is a free and open-source, cross-platform antivirus software tool-kit able to detect many types of malicious software, including viruses.

This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand". It is also target to Desktop usage only.

The current version at this writing is ClamAV 0.99.

Step 1 :

sudo apt-get install clamav clamav-freshclam clamav-daemon libclamunrar7

Step 2 :

sudo nano /etc/clamav/clamd.conf

To make the entries looking like the following. Make sure to replace "samiux" with your username.


cd ~
mkdir quarantine

Step 3 :

sudo nano /etc/clamav/freshclam.conf

To make the entries looking like the following.



sudo systemctl enable clamav-daemon
sudo systemctl restart clamav-daemon
sudo freshclam

Remark :

Download or copy will not trigger the ClamAV scan but browsing or executing (or etc) will. If any malware or virus (no matter it is for Windows, Linux or Mac OSX) is detected, it will be moved to "quarantine" directory. You can also check the log at "/var/log/clamav/clamav.log". Be aware that ClamAV may produce a lot of false positive warning in Linux.

Testing :

You can install NO harm virus testing files for testing.

sudo apt-get install clamav-testfiles

The NO harm virus testing files are located at "/usr/share/clamav-testfiles".

Reference

AppArmor Wiki

That's all! See you.

Will Linux Be Infected By Malware Or Not?

When I came to know Linux, almost all advanced Linux users told me that Linux is impossible to be infected by virus and malware due to its excellent design. Except root or sudoer, nobody has the privilege to do harm on the system including malware. In case your Linux is infected, only you (the user) is affected. Therefore, you are not required to install any anti-virus or anti-malware application on Linux system. Meanwhile, Linux will not infected Windows based malware. Moreover, Linux developers tried to harden the Linux kernel in many ways, such as ASLR, XD/NX, SELinux, Apparmor, and Gentoo's harden-kernel, etc.

After being an Information Security Enthusiast, I recognized that it is totally not true. In my opinion, Linux just like any other operating systems that can be infected by malware and the interference is not limited to your system only. There are many such news recently.

Linux users can be infected with malware in many ways and some malware are cross-platform software too. The most common way to be infected malware is by surfing internet with your browsers. The other most common way is not keeping your Linux system up-to-date. For example, the very famous Heartbleed vulnerability is still vulnerable for over 200,000 devices in the world after more than a year.

Once you are infected, the malware can perform privilege escalation on your Linux system to gain the rights of root. How this to be done? The most common one is vulnerability of the kernel and/or application software. The other is by social engineering. The most insecure part is human being anyway.

Furthermore, most modern Linux distributions implied sudoer. Sudoer has the rights of root. However, most sysadmins or users will set their account name and password in a very weak way. In addition, the password of root can be easily guessed in most cases for those distributions that not using sudoer. I just name some of them here and there are many ways to get root privilege on Linux systems, for example, misconfiguration of Linux system and/or application software.

Hereby, I name some software, skills and tools as well as technologies on Linux malware for your reference. Hope you all understand that Linux is not a bullet-proof system. It is very easy to break for sure. Finally, I would like to introduce how I hardening Ubuntu for my current daily use, here you are.

Open Source Anti Linux Malware

Linux Malware Detect

ClamAV

Linux Forensics and Linux Malware Analysis

REMnux: A Linux Toolkit for Reverse-Engineering and Analyzing Malware

Linux and Disk Forensics

Books for Linux Malware Analysis and Forensics

Malware Forensics Field Guide for Linux Systems: Digital Forensics Field Guides

Linux Forensics

Reference

Don’t believe these four myths about Linux security

Wiki - Linux malware

Wiki - Address Space Layout Randomization (ASLR)

Wiki - Social Engineering


That's all! See you.

HOWTO : ClamAV on Ubuntu 14.04 LTS

Clam AntiVirus (ClamAV) is a free and open-source, cross-platform antivirus software tool-kit able to detect many types of malicious software, including viruses.

This guide will lead you to set up ClamAV for "Scan On Access" instead of "Scan On Demand". It is also target to Desktop usage only.

The current version at this writing is ClamAV 0.98.7+dfsg.

Step 1 :

sudo apt-get install clamav clamav-freshclam clamav-daemon libclamunrar6

Step 2 :

sudo nano /etc/clamav/clamd.conf

To make the entries looking like the following. Make sure to replace "samiux" with your username.



cd ~
mkdir quarantine

Step 3 :

sudo nano /etc/clamav/freshclam.conf

To make the entries looking like the following.



sudo freshclam

Step 4 :

sudo nano /etc/apparmor.d/usr.sbin.clamd

To make the entries looking like the following.



After that, execute the following command to reload the apparmor rules.

sudo apparmor_parser -r /etc/apparmor.d/usr.sbin.clamd

Remark :

Download or copy will not trigger the ClamAV scan but browsing or executing (or etc) will. If any malware or virus (no matter it is for Windows, Linux or Mac OSX) is detected, it will be moved to "quarantine" directory. You can also check the log at "/var/log/clamav/clamav.log".

Testing :

You can install NO harm virus testing files for testing.

sudo apt-get install clamav-testfiles

The NO harm virus testing files are located at "/usr/share/clamav-testfiles".

Reference

AppArmor Wiki

See also : Fireclam Firefox Add-ons

That's all! See you.

The Volatility Framework

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer unprecedented visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.

The following video and command list are not created by me, I just copied them for the reference. Please credit to the video maker.



Commands list

./vol.py –f zeus.vmem pslist

To list the processes of a system, use the pslist command.

./vol.py –f zeus.vmem malfind

You can use it to find hidden or injected code/DLLs in user mode memory

./vol.py –f zeus.vmem ldrmodules

To find out the hidden dll

./vol.py –f zeus.vmem apihooks

To find API hooks in user mode or kernel mode

./vol.py –f zeus.vmem idt

IDT (Interrupt Descriptor Table)

./vol.py –f zeus.vmem gdt

Gdt (Global Descriptor Table)

./vol.py –f zeus.vmem threads –L

The command gives you extensive details on threads

./vol.py –f zeus.vmem callbacks

Callbacks for detecting Windows kernel use of these callbacks to monitor and/or react to events.

./vol.py –f zeus.vmem driverirp

To print a driver's IRP Major Function table

./vol.py –f zeus.vmem devicetree

Windows uses a layered driver architecture

./vol.py –f zeus.vmem psxview

This plugin helps you detect hidden processes.

Source : - Volatility Wiki

That's all! See you.