Welcome to Siberia.
My name is Sean Pearson, the subject
matter expert from our analysis.
And I'll be teaching a short
introduction, a series of these
videos today.
I'm going to be covering the first
class, which is basic terminology
and a quick one minute triage
of some malware.
So who am I?
Well, as I said before,
my name is Schumpeter's, I have a
number of certifications,
such as a CISSP,
my Twitter handle, and if you need
to email me, there's an email there.
I've worked as malware analyst
for a few years,
and I.
I am not penetration tester,
I'm not a developer, and
my employer is a company
called Eyesight and I
am not a PR guy for them.
And whatever opinions
I have, there are mine, not
my companies.
So let's just jump right into it.
So what exactly is our analysis
and why is it useful?
Well, that's because mainly
antivirus software cannot be relied
upon because it is a very difficult
task to write
a program or make an algorithm
to Terminus.
Some software is malicious
and some people say
avy antivirus
is dead. I wouldn't go so far as
to say that
because I do catch a lot of old
stuff.
But statistics show that
when malware is released on
days or day one,
it's only.
Detected about 17 percent of
the time on average between
all of the vendors by day
10, that's usually up to like 30
to 80 percent.
That's a huge range
of detection.
And most of that
is due to heuristics.
So the malware
or the antivirus vendor
may not actually know if it's
malicious. It's just taking a guess.
So
why is it important that we pay so
close attention to our animals,
because 50 to
97 percent of the breaches
involve malware and
that's a huge amount.
And you might
consider like, OK, that's kind of
obvious, but maybe not necessarily.
Maybe there's a fuel injection
and someone steals the database.
OK, no real malware was used,
but and most
breaches, malware
is automated.
Some task for
an attacker or
instead of automation, they
are increasing their capabilities
there.
They're taking advantage of a
vulnerability on the system.
They're exploiting something they
may be are increasing
their foothold
on the system.
Maybe they use similar to
automatically create a new
administrator of user.
Maybe they
want to automate something like
lower some security settings like
the firewall, preventing some
security pop up, warning
to.
Maybe they're preventing some
security pop up dialogs
or appearing to the user.
Maybe they want to enable remote
desktop or
a great many other number of things.
But malware is quite essential to
most attackers and and
their tactics.
Now on the defender side.
I've worked in it for a few years
as like helpdesk.
And I remember the most
typical reaction to
an infection is that
we go collect the machine, you
know, just pull it off the network
and reimage it and give it back to
the user as fast as we could
because it was a nuisance.
And that's how most people react.
But if some.
Some companies, governments,
institutions, organizations have
a rather more mature information
security maturity program,
and they go and have an incident
response person or team or
policy where they go through
and look at the logs, network
traffic processes.
They figure out exactly what malware
it is and they try to trace
where it came from.
How did it get there and how can
they prevent it in the future?
Now, a really mature
organization would
attempt to gather intelligence.
This is pretty common in government,
financial and other
very influential industries.
Now.
At that point, they would go to
a third party malware analyzing
firm or forensics
team or forensics
company, or maybe
they have some people on staff,
which is pretty common
to help them with an
incident now.
This is this is really important
because as a malware
analyst, you know, people
are going to rely on your boss is
going to say what is the impact?
What is the risk?
And this is
something the antivirus cannot tell
them. This is something that
a program will not be able to give
them. You would be able to
tell your superior, we need
a lot of resources on this because
this is very important.
Say you found some malware
on a computer and it had a
little ticking time bomb and
24 hours the next day or something,
and it was about to go off and wipe
the computer.
Well, now you need to know.
More you need to know who else is
infected, you need to know who else
is compromised, who you go to, your
boss, you need to say we need to
pull everyone off of everything
else, need to scan the whole
organization.
We need to find where this is and
neutralize it. Or else our company
could be under water tomorrow.
We don't know.
So malware,
a malware analyst skills
are just irreplaceable.
They're very important because
software cannot do what humans
can.
And.
This is especially important
in the big world where
attribution is really
important
because if you find some
malware on the machine, you need to
know if it was an insider threat, if
it was hacktivism, if it was
opportunistic, if it was financially
motivated or foods that big buzzword
apte for advanced
persistent threat.
If it's some kind of nation state,
if it's some kind of very advanced
group, you need to know
who they are, how to battle them.
And these are the things
that malware analysts
usually have a pretty
good insight into.
Like many Apte groups
use very common off the shelf
malware like
poison ivy, dark
comment
section, whatever else
you do
as a power, analysts could determine
the difference between an advanced
persistent threat group
or some script,
some guy and, you know,
17 year old kid who barely knows
what they're doing.
And this is particularly
important when you consider
the fact that false negatives are
far, far worse than false
positives.
If you think about that, you should
much prefer that an antivirus
software would
go off on
alert you on benign
programs
that are.
Being labeled as malicious
rather than it letting
an actual malicious file through,
unfortunately there,
they aren't there.
Now.
You can look at
bridge reports like the Verizon data
breach report.
I think it's they're fairly good
reports.
And you can see that
quotes like 70 to 90
percent of our samples are unique to
an organization, so.
Targeting does really happen,
I promise you, and if
you are in a high
enough industry, you
have been or will be targeted
and will be compromised.
If not already.
So the scope of this is
a very basic introduction to
our analysis, just to get your feet
wet, just to show you that it's not
witchcraft, it's not black magic,
so.
Malware analysis is really just
a subset of software
analysis, if you want to figure out
what a program is doing, what
installer is doing,
what, you know, program
like a ZIP program or Weinraub
or whatever else
is doing, then
you have to use
a few tools to either say,
oh, you know, it's using
these files, it's
of these register keys or whatever
else. And malware is a bit
interesting and that is usually
pretty small and much less noisy
than traditional software.
So we'll show
that analyzing malware is actually
sometimes easier than
analyzing regular software.
And so you should know
some stuff about malware
already should know something about
software, about networking,
about how operating systems
work. You know, you should probably
know what a kernel is.
It's basically the
operating system at its core.
You should probably know a bit about
software vulnerabilities.
So if I say, oh, you
know, this malware is using
a stock based buffer overflow
to elevate its privileges,
it'd be good to know that.
So
it's also probably no, you know
what?
Detoxes like distributed
denial of service with
a script kiddies I just referenced,
it should probably know
what Linux is and be moderately
comfortable with using it.
So with these foundations,
we will cover some of the
basics of malware
analysis of basic
forensics as a response,
maybe hunting some malware and
some reverse engineering.
And if you don't know what that is,
that's OK. We'll cover it in
the future.
Like I was saying, what exactly is
malware? Well, it's malicious
software.
It is something that executes
without your permission
or tricks you into thinking it's
something else or it
is something that is working
against the user's wishes.
It's a really abstract thing.
I know. But when you get looking
at it, you'll know what's malicious
and what's not.
Like I was saying earlier, malware
is software
and it suffers from all the same
problems as regular software
does. So I've seen lots
malware out there that has
compatibility issues,
have bugs
that have customer service.
You know, I mean, seriously,
if you go on to some of the
forums on the underground and you
say, oh, I want to buy this or I
want to go with this, you
know, sometimes if you pay a little
extra, you'll get better customer
support or customer service.
You'll get updates.
You'll get you can put in
helped us tickets if something's not
working right or, you know,
put a ticket for bugs to be fixed,
you know, you can say, oh, I want
the next version when it comes out
in a few months,
you know, and even then, like
our authors have issues
maintaining like source code.
Sometimes they have issues with
stuff getting leaked
proprietary stuff or even
their their malware being pirated.
That's happened a number of times,
like Zoosk, malware.
So if you want to know more about
this, which I think is a good.
Background for a lot of the stuff
I was suggesting, you
look for DEFCON 17, making
fun of your malware, DEFCON
17 Malware Freak Show and
DEFCON 18.
My life is a spyware developer.
Those are good talks that really
give you insight and
good perspective into how
the stuff works.
So you've probably heard a lot of
terms like virus Trojan worm,
and, you know, you'll get pretty
generic descriptions
of those and I'll go through
these really fast right now.
And that virus
very generically is what most people
refer to. But technically, that's
a file infector where
executable code is inserted
into an executable file
like an XY
to hijack its
execution.
I've never seen one in the wild,
like in the few years
that I've been working.
I just don't I just
think they're very rare, like I've
seen some before, like historical
things and some
games that hackers play and
some proof of concept stuff.
But I've never seen a real malicious
one, Trojans
or much more common.
They are usually bundled with games
like, you know, the North Koreans
did that. They they took some
a game developer and they said, oh,
you know, we'll insert this code and
we'll distribute it for free or
really cheap.
And then one day they decide to
start dosing the South
Korean banks so that it's
fairly common worms.
They're actually on the Internet.
There are some that are just still
going.
But I find them kind of
rare.
They usually execute
without your permission and
they don't try to trick you into
executing them like Trojans
or viruses, worms or
self-propagating.
They usually are exploiting some
vulnerability in an operating
system. And then as
soon as they get killed, execution
operations, operating system,
they scan the network
or the Internet for more vulnerable
systems and just repeat the process.
Bots are extremely common.
They're the most common things I
see.
Bots are usually financially
motivated.
The help and spamming, they sell
personal information.
They they do draft stuff.
It's usually cyber crime type
campaigns, root
kits or.
This malware that usually corrupts
and modifies the operating
system, most of the time
they are hiding.
Files or processes?
For any user land programs,
so it hides deep in the operating
system just to hide its other
components, rats
are very common, such
as or rats
to find that as a remote access
tool or remote access
Trojan,
they are there as legitimate ones.
There's not so legitimate ones.
They are like they're
the most common, I think,
and they are very.
Easy to find.
I've seen routes that have been
around for 10 years
and are still being used like dark
comment, the
shell.
So seven was the first one I
ever saw.
And, you know, those are broad
categories. And there are
there is malware that overlaps.
So a bot could have a root
attached to it,
you know, that could be bundled with
a Trojan.
These are very broad descriptions,
like I said.
And there is malware, certainly more
specialized like spyware,
which just steals your information
or scare where which just trying to
scare you into giving over some
money, you know, adware, back
doors, credential
theft, like Poni.
And there's like a..
Analysis code sometimes baked into
these things where,
you know, you as an analyst are
trying to figure out what some hours
doing and they throw in some
weird tricks to try to
stop you or defeat
your goal, which is to figure out
something about it.
So I've seen malware out there that
says, oh, you know, if I think
I'm, you know, being analyzed,
do this, open up a port
and then, you know, start
taking commands from it.
It's basically a back door.
But if it's not being analyzed,
I'll tell you exactly how these
things work, then it would
do its normal bot operation
so it reach out to the correct IP
address for more instructions.
And really, the purpose depends
on what
industry.
The powers that you might be
thinking, what do you mean industry
I'm talking about there are
pockets of
the underground economy where
there's buyers and sellers
and banks and escrows
that support these economic
systems like paper install.
So you can go and say,
I want this piece of malware that
I'm going to give you. I want it
installed on a thousand computers.
They will go and do that.
Or you say, I want to buy credit
card information
dumps, as they call it, or I
want to hire some hackers to get
into this company or I want to,
you know, whatever.
And there's other software that
sometimes is considered malware with
those industries like builders.
This is some software that will make
malware for you,
usually a rat or a Trojan
exploit kids.
You know, these are.
Kind of websites
that you can rent so you can say,
oh, I want to use this exploit
kit for two days and
you will try to spam.
That website link out as much
as you can, and as soon as
someone clicks on that link, they
will get compromised and
they'll be loaded up through the
malware.
So you could go
in with a couple of thousand
dollars, buy a Trojan,
then you can configure it and then
you can say, OK, I want to
buy access to an exploit kid
and I want to buy, you
know, two
days or five days on it.
And then you say, OK, now
I have a couple hundred people that
my malware is controlling.
And then you can say, well, I want
more, so I'm going to buy another
thousand computers.
And let's say the antivirus
is quickly catching on, they're
starting to detect your malware, we
can use a hacker or
a krypto to
scramble its insides to encrypt
your malware.
And you can say, OK, I want to
change it every day or even every
hour.
You can change out.
Your malware and
hackers and cricketer's will help
bad guys do that.
So you should be aware of how these
things work, and particularly
packers' and cricketer's,
I mostly call them Packers',
just that you
should pay attention to that.
And we will talk about that in the
future, because that
definitely does hinder analysis.
When I talk about analysis, I'm
saying usually
one of two things, dynamic
analysis, which is where
we just take some hour, execute
in a virtual machine and see
what happens.
Usually it's pretty telling.
You know, you can get some network
information. We get the
command control servers, we can
get the IP addresses,
the speaking in and out to network
information, all sorts of stuff.
But it is easy to miss things.
For instance, if there is a kill
date baked into the malware,
like I know of one
instance where there
is a.
Payment gateway that was
compromised with some malware and.
They couldn't get it off and they
couldn't restart it, and they they
said they would lose a lot of money
if they ever took it offline and
it would cost a lot to try to.
You know, replace it
so they decide to just firewall
it off that only that
it couldn't talk to the Internet and
that only a
certain computers could talk to
could send it information.
And they said, OK, well, it's not
going to do anything.
It's not going to.
You know, reboot is not going
to the malware is not going to
kill it, so we'll just
make sure we never contact home
and the hackers never
sent it information.
I said, well, that's good.
I guess that is a creative
solution.
However, what if it has a KDDI in
it and at some point in the future
it'll wipe the computer?
They just like walls that come
you. No, certainly not and
not usually ever.
But it could happen.
And the only way to figure something
out like that,
other than seeing the clock far
ahead in the future, would be
something called static analysis
where you don't execute
the malware but you slowly step
through it. You see one instruction
at a time.
What is this doing?
You know, and then you could
identify capabilities in the malware
and you can pick out a lot more
information.
And this technique
requires very deep technical
knowledge.
And it can take a long time,
especially with anything
that has a lot of information in it
that's particularly sophisticated
or large.
And it's important to note
that most of what
we say malware analysis is actually
hybrid is where you are
using a virtual machine
to execute this malware safely or
some kind of sandbox or,
you know, whatever reporting
feature.
And then you also verify this
with a static
approach where you say, OK, die
that IP addresses in there and
it's being decrypted like this and
the network works like this and
supports these commands.
And then you can also do things like
in memory, like volatile
forensics, where
you can, you know, execute
this malware and then dump
whatever is in memory.
And you look at it statically like
that, you just pause it effectively
and then you look at what
is in memory at the time.
This is useful for Packers'.
So Packers' usually
it will encrypt the malware
and then you won't be able to see
anything from a static perspective
so you can execute it.
It will load up in the memory, it'll
decrypt the original malware and
then begin executing it.
So if you dump that in
from memory, you can see
what the original thing was.
So it was trying to protect.
Now, don't worry if this doesn't
make too much sense to will cover
it in the future.