Download pdf - Fighting Malware Without Antivirus

Transcript
Page 1: Fighting Malware Without Antivirus

jeff brynerfinding malware without antivirus

Page 2: Fighting Malware Without Antivirus

the problem#you hear about an 0-day#or malware coming your way

Page 3: Fighting Malware Without Antivirus

THE problem?#maybe it's already inside your enterprise?

Page 4: Fighting Malware Without Antivirus

how do you hear about it?#how do you get notified of a new threat?#internal? external? word of mouth?

Page 5: Fighting Malware Without Antivirus

how do you fight?#what tools do you have to fight?

Page 6: Fighting Malware Without Antivirus

safe?#antivirus doesn't cover the primary phase of IR: identification#when antivirus fires, you're already in containment#preparation,identification,containment,eradication,recovery,lessons learned

Page 7: Fighting Malware Without Antivirus

#what if there is no signature

Page 8: Fighting Malware Without Antivirus

#do you just wait it out?

Page 9: Fighting Malware Without Antivirus

#do you panic?

Page 10: Fighting Malware Without Antivirus

help!#what if folks want to help and share info?

Page 11: Fighting Malware Without Antivirus

sharing=hard#email is too informal, may not reach everyone?#logs only hold what they were told to log#pen/paper?#every security tool has it's own unique format

Page 12: Fighting Malware Without Antivirus

answer=open IOC?openioc.org

#IOC=Indicator of Compromise

Page 13: Fighting Malware Without Antivirus

<ioc > <short_description>firefox running</short_description> <description>Is firefox in the list of running processes</description> <authored_by>jab</authored_by> <authored_date>2012-08-14T21:46:51</authored_date> <links /> <definition> <Indicator operator="OR"> <IndicatorItem condition="contains"> <Context document="ProcessItem" search="ProcessItem/name" /> <Content type="string">firefox</Content> </IndicatorItem> </Indicator> </definition></ioc>#ioc is just xml

Page 14: Fighting Malware Without Antivirus

xml + malware=two problems?#I know..now we have two problems: a compromise and an xml format.# IOC format is a reasonable approach, but not many tools support it.# IOC too complex to do by hand (see flame.ioc)# IOC collection and analysis toolset is limited:

Page 15: Fighting Malware Without Antivirus

<ioc > <short_description>firefox running</short_description> <description>Is firefox in the list of running processes</description> <authored_by>jab</authored_by> <authored_date>2012-08-14T21:46:51</authored_date> <links /> <definition> <Indicator operator="OR"> <IndicatorItem condition="contains"> <Context document="ProcessItem" search="ProcessItem/name" /> <Content type="string">firefox</Content> </IndicatorItem> </Indicator> </definition></ioc>#sample ioc to see if firefox is running..could be svch0st.exe, etc.

Page 16: Fighting Malware Without Antivirus

automation advantages: Flame filename IOCs:

FileItem/FileName is ~a28.tmp or FileItem/FileName is ~DFL542.tmp or FileItem/FileName is ~DFL543.tmp or FileItem/FileName is ~DFL544.tmp or FileItem/FileName is ~DFL545.tmp or FileItem/FileName is ~DFL546.tmp or FileItem/FileName is ~dra51.tmp or FileItem/FileName is ~dra52.tmp or FileItem/FileName is ~fghz.tmp or FileItem/FileName is ~rei524.tmp or FileItem/FileName is ~rei525.tmp or FileItem/FileName is ~TFL848.tmp or FileItem/FileName is ~TFL842.tmp or FileItem/FileName is GRb2M2.bat or FileItem/FileName is indsvc32.ocx or FileItem/FileName is scaud32.exe or FileItem/FileName is scsec32.exe or FileItem/FileName is sdclt32.exe or FileItem/FileName is sstab.dat or FileItem/FileName is sstab15.dat or FileItem/FileName is winrt32.dll or FileItem/FileName is winrt32.ocx or FileItem/FileName is wpab32.bat or FileItem/FileName is commgr32.dll or FileItem/FileName is comspol32.dll or FileItem/FileName is comspol32.ocx or...73 different filenames! 125 different IOC items total!#malware is way beyond the point where we can hope to discover it#by just poking around a system

Page 17: Fighting Malware Without Antivirus

IOC collection and analysis toolset is limited:

IOCFinder,IOCEditor are free but: -Windows only, no unix/linux/mac-time consuming

-(45 mins to collect data on a win2k8r2 vanilla install)

-manual process: -run iocfinder-collect xml data (lots)-process iocs on data

#OK, if it's so great why aren't we using it#existing IOC tools have some gaps

Page 18: Fighting Malware Without Antivirus

No support for IOCs in common agents: BigFixncircletripwireSCCMnessus...

#you probably have one of these agents#in addition to AV running on your hosts#no love for IOCs...

Page 19: Fighting Malware Without Antivirus

open source to the rescue?#maybe we can ease the burden with some open source tools?

Page 20: Fighting Malware Without Antivirus

What if we could create a system for centrally issuing indicators of compromise?

What if hosts we suspect as being compromised used this system to check themselves for compromise?

Lets find out...

Page 21: Fighting Malware Without Antivirus

portability,accessibility,price,readability#proposal: a simple python-based client/server system to rapidly deploy agents to search for IOCs when necessary.##complimentary to AV, not a replacement

Page 22: Fighting Malware Without Antivirus

zero-install; copy and paste a single .exe#simple zero-install python client #compiled to native executable on linux/windows. 32 and 64bit.

Page 23: Fighting Malware Without Antivirus

simple server for issuing IOCs in realtime#simple python server to dish out IOCs and receive results

Page 24: Fighting Malware Without Antivirus

demos

Page 25: Fighting Malware Without Antivirus

simple IOC client/server examples

Page 26: Fighting Malware Without Antivirus

small server $ wc -l pyiocServer.py 141 pyiocServer.py

Page 27: Fighting Malware Without Antivirus

small-ish client$ wc -l *.py */*.py 249 pyiocClient.py 118 iocItems/FileItem.py 47 iocItems/PortItem.py 82 iocItems/ProcessItem.py 77 iocItems/RegistryItem.py 0 iocItems/__init__.py 0 lib/__init__.py 55 lib/log.py 18 lib/settings.py 37 lib/util.py 683 total#client is fairly small with support for #common files, processes and registry IOCs.

Page 28: Fighting Malware Without Antivirus

server folder structure: $ find iocs/iocs/iocs/172.16.0.0-16iocs/172.18.6.0-24iocs/172.18.6.0-24/pybackdoor.iociocs/10.83-16iocs/10.83-16/sshto10.83.222.50.iociocs/10.83-16/windows.iociocs/10.83-16/duqu.iociocs/172.21-16iocs/172.21-16/firefox.iociocs/10.200-16iocs/10.200-16/firefox.iociocs/10.200-16/windows.iociocs/10.200-16/duqu.ioc#uses netblock cidr masks as folders to determine #what iocs to send to what clients

Page 29: Fighting Malware Without Antivirus

simple ioc detection demowindows.iocfirefox.ioc

Page 30: Fighting Malware Without Antivirus

our malware#what good is a malware finding tool without malware? Lets create some#create python back-door

Page 31: Fighting Malware Without Antivirus

ioc creation using IOC Editor

Page 32: Fighting Malware Without Antivirus

ioc distribution via the ioc server#CIDR mask directory names to control what IOCs go to what servers

Page 33: Fighting Malware Without Antivirus

ioc client push#simple xcopy installation#wmiFileTransfer demo

Page 34: Fighting Malware Without Antivirus

ioc client run#run once or run via at job for recurring checks.

Page 35: Fighting Malware Without Antivirus

next steps: Publish: github.com/jeffbrynerIs it useful?Will it be used?What's missing?Vendor support in their tools?

Page 36: Fighting Malware Without Antivirus

jeff [email protected]/jeffbryner


Recommended

The Ultimate Protection Against Viruses and Malware€¦ · AntiVirus recognizes Rootkits before they can infect the user’s computer and eliminates them completely. STOPZILLA ANTIVIRUS
The Ultimate Protection Against Viruses and Malware€¦ · AntiVirus recognizes Rootkits before they can infect the user’s computer and eliminates them completely. STOPZILLA ANTIVIRUS Documents
Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware
Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware Documents
Fighting malware and spam CONTENTS IN THIS ISSUE · CONTENTS IN THIS ISSUE ISSN 1749-7027 Fighting malware and spam 2 COMMENT PWN2KILL, EICAR and AV: ... Electronique, Automatique
Fighting malware and spam CONTENTS IN THIS ISSUE · CONTENTS IN THIS ISSUE ISSN 1749-7027 Fighting malware and spam 2 COMMENT PWN2KILL, EICAR and AV: ... Electronique, Automatique Documents
Teknologi antivirus vs malware 2015 expanded
Teknologi antivirus vs malware 2015 expanded Internet
Fighting malware and spam VB100 COMPARATIVE REVIEW ON … · 2012-05-02 · APRIL 2012 ISSN 1749-7027 Fighting malware and spam VB100 COMPARATIVE REVIEW ON WINDOWS XP PROFESSIONAL
Fighting malware and spam VB100 COMPARATIVE REVIEW ON … · 2012-05-02 · APRIL 2012 ISSN 1749-7027 Fighting malware and spam VB100 COMPARATIVE REVIEW ON WINDOWS XP PROFESSIONAL Documents
Quick Heal AntiVirus Pro tough on malware, light on …...Security Simpli˜ed Quick Heal AntiVirus Pro tough on malware, light on your PC. Strong Protection • Our robust scan engine
Quick Heal AntiVirus Pro tough on malware, light on …...Security Simpli˜ed Quick Heal AntiVirus Pro tough on malware, light on your PC. Strong Protection • Our robust scan engine Documents
Best Free Malware Removal Tool - Akick Antivirus
Best Free Malware Removal Tool - Akick Antivirus Documents
ESET - Antivirus vs. Malware
ESET - Antivirus vs. Malware Social Media
Malware Fighting - Lucha contra el Ciber-crimen
Malware Fighting - Lucha contra el Ciber-crimen Documents
Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face … · 2018-02-26 · Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face of Antivirus Software November
Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face … · 2018-02-26 · Antivirus Evasion with ShCoLo/ExLo - Why Malware Works in face of Antivirus Software November Documents
Fighting Stealth Malware – Towards Verifiable OSes
Fighting Stealth Malware – Towards Verifiable OSes Documents
By: Anthony Bosnak. Malware How Antivirus Programs Work Future Threats
By: Anthony Bosnak. Malware How Antivirus Programs Work Future Threats Documents
Presented by: Craig Mayfield & Joey Police What solution works best for you? AntiVirus & Malware
Presented by: Craig Mayfield & Joey Police What solution works best for you? AntiVirus & Malware Documents
Fighting advanced malware using machine learning - PacSec
Fighting advanced malware using machine learning - PacSec Documents
Embedded devices, an AntiVirus-free safe hideout for ... … · - Gaming consoles as an attacking tool - Hacking with NDS - Malware on Console Gaming systems - Malware on Wii - Malware
Embedded devices, an AntiVirus-free safe hideout for ... … · - Gaming consoles as an attacking tool - Hacking with NDS - Malware on Console Gaming systems - Malware on Wii - Malware Documents
Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English) Technology
Virus, antivirus, spam, spyware y malware
Virus, antivirus, spam, spyware y malware Documents
SecureAnywhere Business Endpoint Protection: It’s About Time · antivirus/malware protection. For both free and paid antivirus/malware software, surveyed IT pros report that their
SecureAnywhere Business Endpoint Protection: It’s About Time · antivirus/malware protection. For both free and paid antivirus/malware software, surveyed IT pros report that their Documents