Malware Analysis as a Hobby - 44CON 2012
•Descargar como PPTX, PDF•
2 recomendaciones•710 vistas
Michael Boman and Siavosh Zarrasvand present Malware Analysis as a Hobby at 44CON 2012 in London, September 2012.
Recomendados
Recomendados
Más contenido relacionado
Destacado
Destacado (15)
Similar a Malware Analysis as a Hobby - 44CON 2012
Similar a Malware Analysis as a Hobby - 44CON 2012 (20)
Más de 44CON
Más de 44CON (20)
Último
Último (20)
Malware Analysis as a Hobby - 44CON 2012
- 1. Malware Analysis as a Hobby Michael Boman - Security Consultant/Researcher, Father of 5 Siavosh Zarrasvand – Security Consultant/Researcher, Searching
- 2. Why the strange hobby?
- 4. Drawbacks Time consuming Boring in the long run (not all malware are created equal)
- 5. Choose any two…. Cheap Good Fast
- 6. I can do it cheaply (hardware and license cost-wise). Human time not Choose any two? Why included. not all of them? I can do it quickly (I spend up to 3 Cheap hours a day doing this, at average even less). I get pretty good results (quality). Where the system lacks I can compensate for its shortcomings. Good Fast
- 7. Automate everything! Automate Engineer yourself out of the workflow
- 8. Birth of the MART Project Malware Analyst Research Toolkit
- 9. Components
- 11. Sample Acquisition • Public & Private Collections • Exchange with other malware analysts • Finding and collecting malware yourself • Download files from the web • Grab attachments from email • Feed BrowserSpider with links from your SPAM-folder
- 12. BrowserSpider Written in Python Using the Selenium framework to control REAL browsers Flash, PDFs, Java applets etc. executes as per normal All the browser bugs exists for real Spiders and follows all links seen
- 13. Sample Analysis • Cuckoo Sandbox • VirusTotal
- 14. A days work for a Cuckoo Fetch a task Process and Prepare the create reports analysis Lunch analyzer in Store the result virtual machine Complete the Execute an analysis analysis package
- 15. DEMO: Submit sample for analysis
- 17. Sample Reporting • Results are stored in MongoDB (optional, highly recommended) • Accessed using a analyst GUI
- 21. Data Mining
- 22. Where Virtual Machine analysis fails And what to do about it
- 23. Problems Cuckoo is easly bypassed User-detection Sleeping malware
- 24. Problems VM or Sandbox detection The guest OS might not be sufficient enough Any multistage attack
- 25. Iterating automatiation Sort out clearly Devide the non-malicious and Do brief static samples into obviosly malicious analysis categories samples Known Known Bad Good Unknown
- 26. Iterating automatiation Sort out clearly Devide the non-malicious and Do brief static samples into obviosly malicious analysis categories samples • Does not do anything • Detects environment • Encrypted segments • Failed execution
- 27. Iterating automatiation Sort out clearly Devide the non-malicious and Do brief static samples into obviosly malicious analysis categories samples • Run longer • Envirnoment customization
- 29. Budget Computer: €520 MSDN License: €800 (€590 renewal) Year 1: €1320 Year N: €590 Money saved from stopped smoking (yearly): €2040
- 30. Next steps • Barebone on-the-iron malware analysis • Android platform support • OSX platform support • iOS patform support
- 31. Questions? Michael Boman Siavosh Zarrasvand michael@michaelboman.org siavosh.zarrasvand@gmail.com http://michaelboman.org @mboman @zarrasvand