BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsidesluxembourg-2026//speaker//SU38N8
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20250507T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T030000
RDATE:20261025T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T030000
RDATE:20270328T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Not So hARMless: The Hidden World of Linux Packers and Detection C
 hallenges - Massimo Bertocchi
DTSTART;TZID=Europe/Luxembourg:20260507T144500
DTEND;TZID=Europe/Luxembourg:20260507T152000
DTSTAMP:20260907T122524Z
UID:pretalx-bsidesluxembourg-2026-LL9LUX@pretalx.com
DESCRIPTION:Linux packers and loaders represent a blind spot in modern cyb
 ersecurity defenses. By compressing\, encrypting\, and obfuscating execut
 able code\, these tools enable fileless\, in-memory execution that bypasse
 s traditional detection mechanisms entirely.\nThis presentation dissects t
 he hARMless ARM64 ELF packer/loader to reveal sophisticated evasion techni
 ques: multi-layer page encryption\, CRC32 integrity verification\, and dir
 ect ARM64 syscall invocation. We expose critical security gaps where EDR s
 olutions lack Linux visibility\, static analysis fails against packed payl
 oads\, and memory-resident execution defeats forensic recovery. The bad ne
 ws? Traditional EDR solutions are practically blind on Linux\, static anal
 ysis can't keep up with modern packers\, and memory-only execution makes f
 orensics a nightmare. The good news? Well...let's see it together
LOCATION:Building D/room 1\, Workshops and Detection Engineering village
URL:https://pretalx.com/bsidesluxembourg-2026/talk/LL9LUX/
END:VEVENT
END:VCALENDAR