SlideShare une entreprise Scribd logo

Malware analysis

•
•
X
xabean

Malware Analysis: Collaboration, Automation & Tuning - from Shmoocon 2013

Technologie
1  sur  37
Malware Analysis Collaboration Automation Training Richard Harman @ ShmooCon IX
Richard Harman ● Lead Intrusion Analyst @ SRA, Inc SOC ● Started out as a SysAdmin ● Info Sec Analyst for 8 years ● Member of NoVA Hackers group ● Co-Founder of Nova Labs in Reston, VA xabean warewolf richard@richardharman.com
Ingredients ● Intro to Malware Analysis & Tools ● Open Source Virtualization ● VM Efficiency & Consistency ● Light-weight VMs & Automating them ● Training – You're Doing It Wrong
Malware Analysis
Brain Food ● Books: ● Filesystem Forensic Analysis ● Windows Forensics Analysis Toolkit ● Malware Analyst's Cookbook ● Practical Malware Analysis ● Reversing: Secrets of Reverse Engineering ● Training: ● SANS GREM FOR610 ● ... upcoming classes ; )
The Process 1) Baseline System State 2) Monitor & Log System Activity 3) Infect system 4) Suspend, Dump & Terminate Processes 5) Stop Monitoring 6) Review Monitored Activity 7) Compare new state to baseline
The Essentials System Baseline Memory Analysis ● Regshot ● Volatility Framework ● Autoruns General Analysis Logging / Tracing ● OfficeCat ● OllyDbg & Plugins ● FileInsight ● IDA Pro ● Wireshark ● Procmon ● Didier Stevens's Tools ● Capturebat
Front-ends for sweet utilities Two I use most: Procmon & Autoruns ➔ @DaveHull is working on autorunalyzer on github.com/davehull/autorunalyzer – .py is a WIP, .sh version exists ➔ I (@xabean) wrote a Procmon XML processor on github.com/warewolf/Procmon
Virtualization RAM efficiency
512 MB 1 GB 512 MB XLS DOC sample sample
512 MB 1 GB 512 MB STRESS XLS DOC sample sample
DEDUPLICATION 1 GB NO DEDUPLICATON 1 GB
RAM De-dupe (Merging) Support ● Linux/QEMU/KVM – Kernel Samepage Merging ● VMware – Transparent page sharing ● VirtualBox – Page Fusion ● (requires guest support) ● Xen – Memory Sharing (tech preview) ● Unmerging – Host swaps, or Host asks Guest to swap.
Virtualization Consistency & Disk efficiency
Adobe Reader 9 Office XP Adobe Reader 8 Office 2003 Adobe Reader X Office 2007 Procmon Regshot Capturebat Wireshark IDA Pro FileInsight OllyDbg Autoruns OfficeCat Olly Plugins
CLONES
RAW DISK FILE SYSTEMS iSCSI NFS ATAoE GFS FC GLUSTRE
Read Only Copy on Write
Copy on Write is an enabler On shared storage ● Enables live VM migration to another analyst In a RAM disk (tmpfs) ● Snapshots become REALLY FAST. ● About 1 second! (revert/save, 7 shot test) Images are only changes – they're small ● Dead-box forensic analysis anyone?
CoW (Light-Weight) Disk Clones in Virtualization Software ● VMware ● Workstation has “linked clones” ● ESX(i) wants VMWare VCenter ($$) ● Xen ● OSS: ?? Commercial: yes? ● VirtualBox ● Linked Clones ala VMWare Workstation ● Libvirt + QEmu ● Libvirt LVM: No, QEmu QCOW2: yes (manual)
My Malware Environment ● QEmu/KVM (libvirt) ● Windows disk images in LVM, CoW in RAM ● $ qemu-img create -o backing_file=/dev/vg/base -o /tmp/ram/overlay.qcow2 ● RAM drive full? VMs auto-pause self! ● MITM “internet” Linux VM ● Apache, iptables -J REDIRECT, dnsmasq, samba ● Apache vhosts of copies of websites – google, etc ● Connected to malware network & public network
A cluster, not a cluster- FSCK Virtualization: ● QEmu/KVM + libvirt for migration Shared disk access: ● Linux tgtd iSCSI – use gigabit ethernet! – Clustered LVM for base images – GFS for CoW storage ● Note: disable cache in tgtd
Automation
libvirt VM Management Life cycle management: ● Start / Pause / Stop ● Snapshot management ● Dump VM physical memory Provisioning Automation: ● Capture “parent” XML config ● Modify & define new VM
libguestfs for Guest Management Guest Disk FS management: ● Supports scripting / automation ● Download & Upload files to guest file system ● Extract analyst data from a standard dir – C:malwareticket_#* --> upload to IR tracking system Windows Registry Support: ● Change hostname to prevent NetBIOS name conflicts on same network
Provisioning & Automation ● clone-vm.pl – Clone an existing VM, generate unique MAC & UUID, create Copy-On-Write disk image, change hostname in registry. ● insert-zip.pl & extract-zip.pl – Insert and extract data ● peek.pl –Dump physical memory of a VM for analysis ● ksmstat.pl – Monitor KSM efficiency & CPU usage ala vmstat(1)
Collaboration & Training
VM vncreflector (host:1) vncreflector FBS output (host:99) FBS VNC video capture
Screencasting & Playback Screencasting: ● record-vnc.pl to record & screencast Playback: ● rfbproxy -c -p in inetd ● inetd makes rfbproxy multi-client and self-service ● Shell script to feed rfbproxy VNC videos ● Extra credit: rfbproxy can export to PPM stream – PPM -> MPEG2 + instructor audio = Training Video
What do you have now? ● Consistent analysis VMs w/ efficient resource use. ● Multi-participant, interactive, live training sessions. ● Thin-provisioned VM & Acquire analysis data ● Analysis session recorded for future playback ● HQ VNC jukebox (~300MB) ● Medium quality portable MPEG video (~1.5G)
DEMO
Next Steps... ● Diff pre/post infection of RAM and FS ● Identify injected code/new executables ● Dump, generate signatures, scan, detect variants of the same sample ● Make this all a web-app; snapshots, file mgmt, java applet vnc display ● Auto-provision private networks & VMs per analyst & remote (VPN) access
Thank you Jamie! ● @gleeda / http://gleeda.blogspot.com ● Blackbelt in Volatility & EnCase ● Released a Differential EnScript – diff two versions of the same disk & report on 'em
Nova-Labs.org ● Malware Analysis Lab ● Classes on Malware Analysis / Reverse Engineering ● Expected to start in April/May ● $$ not yet set (but expected to be cheap) ● Various Malware samples ● Learn, Teach, pass it on!
How do I .... It's all at: ● warewolf.github.com / thin-provisioning ● Automation Code ● Documentation (still working on it) ● Configs for MITM: – Apache – dnsmasq – iptables config – samba
Malware analysis

Recommandé

Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
Albert Hui
 
Malware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineeringMalware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineering
bartblaze
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
Prakashchand Suthar
 
Spo2 t19 spo2-t19
Spo2 t19 spo2-t19Spo2 t19 spo2-t19
Spo2 t19 spo2-t19
SelectedPresentations
 
Sans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleSans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sample
Michel Coene
 
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Lane Huff
 
Fileless Malware Infections
Fileless Malware InfectionsFileless Malware Infections
Fileless Malware Infections
Ramon
 
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
grecsl
 

Recommandé

Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware Analysis
Albert Hui
 
Malware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineeringMalware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineering
bartblaze
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
Prakashchand Suthar
 
Spo2 t19 spo2-t19
Spo2 t19 spo2-t19Spo2 t19 spo2-t19
Spo2 t19 spo2-t19
SelectedPresentations
 
Sans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleSans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sample
Michel Coene
 
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Lane Huff
 
Fileless Malware Infections
Fileless Malware InfectionsFileless Malware Infections
Fileless Malware Infections
Ramon
 
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
grecsl
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
Balaji Rajasekaran
 
Basic malware analysis
Basic malware analysisBasic malware analysis
Basic malware analysis
securityxploded
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
Andrew McNicol
 
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
CODE BLUE
 
Automating Malware Analysis
Automating Malware AnalysisAutomating Malware Analysis
Automating Malware Analysis
securityxploded
 
Ch0 1
Ch0 1Ch0 1
Ch0 1
TylerDerdun
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat
INSIGHT FORENSIC
 
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detectionAnti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Neel Pathak
 
Hack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration TestingHack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration Testing
Steve Phillips
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
securityxploded
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
Ross Wolf
 
Metasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner ClassMetasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner Class
Georgia Weidman
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware Analysis
Antonio Parata
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
EC-Council
 
Malware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invaders
Tazdrumm3r
 
Metasploit for Web Workshop
Metasploit for Web WorkshopMetasploit for Web Workshop
Metasploit for Web Workshop
Dennis Maldonado
 
Taking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryTaking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in Memory
Joe Desimone
 
Hunting For Exploit Kits
Hunting For Exploit KitsHunting For Exploit Kits
Hunting For Exploit Kits
Joe Desimone
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
Paul Melson
 
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki ChidaIDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
CODE BLUE
 
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Lance Albertson
 
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit FrameworkUnmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
egypt
 

Contenu connexe

Tendances

Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
CODE BLUE
 
Hack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration TestingHack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration Testing
Steve Phillips
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
Ross Wolf
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
EC-Council
 

Tendances (20)

Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
 
Basic malware analysis
Basic malware analysisBasic malware analysis
Basic malware analysis
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
 
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
 
Automating Malware Analysis
Automating Malware AnalysisAutomating Malware Analysis
Automating Malware Analysis
 
Ch0 1
Ch0 1Ch0 1
Ch0 1
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat
 
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detectionAnti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection
 
Hack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration TestingHack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration Testing
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
 
Metasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner ClassMetasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner Class
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware Analysis
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
 
Malware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invaders
 
Metasploit for Web Workshop
Metasploit for Web WorkshopMetasploit for Web Workshop
Metasploit for Web Workshop
 
Taking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryTaking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in Memory
 
Hunting For Exploit Kits
Hunting For Exploit KitsHunting For Exploit Kits
Hunting For Exploit Kits
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
 
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki ChidaIDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
 

Similaire à Malware analysis

A3Sec Advanced Deployment System
A3Sec Advanced Deployment SystemA3Sec Advanced Deployment System
A3Sec Advanced Deployment System
a3sec
 
CodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest 2013. Mosesohn M. — Automating environments with CobblerCodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest
 
Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Lightweight Virtualization with Linux Containers and Docker I YaC 2013Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Docker, Inc.
 
Backing up Wikipedia Databases
Backing up Wikipedia DatabasesBacking up Wikipedia Databases
Backing up Wikipedia Databases
Jaime Crespo
 
Varnish http accelerator
Varnish http acceleratorVarnish http accelerator
Varnish http accelerator
no no
 

Similaire à Malware analysis (20)

Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
 
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit FrameworkUnmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
 
A3Sec Advanced Deployment System
A3Sec Advanced Deployment SystemA3Sec Advanced Deployment System
A3Sec Advanced Deployment System
 
CodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest 2013. Mosesohn M. — Automating environments with CobblerCodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest 2013. Mosesohn M. — Automating environments with Cobbler
 
Lightweight Virtualization with Linux Containers and Docker | YaC 2013
Lightweight Virtualization with Linux Containers and Docker | YaC 2013Lightweight Virtualization with Linux Containers and Docker | YaC 2013
Lightweight Virtualization with Linux Containers and Docker | YaC 2013
 
Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Lightweight Virtualization with Linux Containers and Docker I YaC 2013Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Lightweight Virtualization with Linux Containers and Docker I YaC 2013
 
Let's Containerize New York with Docker!
Let's Containerize New York with Docker!Let's Containerize New York with Docker!
Let's Containerize New York with Docker!
 
Docker 0.11 at MaxCDN meetup in Los Angeles
Docker 0.11 at MaxCDN meetup in Los AngelesDocker 0.11 at MaxCDN meetup in Los Angeles
Docker 0.11 at MaxCDN meetup in Los Angeles
 
Kvm optimizations
Kvm optimizationsKvm optimizations
Kvm optimizations
 
Cobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale EnvironmentsCobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale Environments
 
Cobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale EnvironmentsCobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale Environments
 
Backing up Wikipedia Databases
Backing up Wikipedia DatabasesBacking up Wikipedia Databases
Backing up Wikipedia Databases
 
QEMU Disk IO Which performs Better: Native or threads?
QEMU Disk IO Which performs Better: Native or threads?QEMU Disk IO Which performs Better: Native or threads?
QEMU Disk IO Which performs Better: Native or threads?
 
Varnish http accelerator
Varnish http acceleratorVarnish http accelerator
Varnish http accelerator
 
The Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldThe Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote World
 
GoSF Jan 2016 - Go Write a Plugin for Snap!
GoSF Jan 2016 - Go Write a Plugin for Snap!GoSF Jan 2016 - Go Write a Plugin for Snap!
GoSF Jan 2016 - Go Write a Plugin for Snap!
 
OpenStack Cinder Best Practices - Meet Up
OpenStack Cinder Best Practices - Meet UpOpenStack Cinder Best Practices - Meet Up
OpenStack Cinder Best Practices - Meet Up
 
Linux Server Deep Dives (DrupalCon Amsterdam)
Linux Server Deep Dives (DrupalCon Amsterdam)Linux Server Deep Dives (DrupalCon Amsterdam)
Linux Server Deep Dives (DrupalCon Amsterdam)
 
Docker bdxio
Docker bdxioDocker bdxio
Docker bdxio
 
(phpconftw2012) PHP as a Middleware in Embedded Systems
(phpconftw2012) PHP as a Middleware in Embedded Systems(phpconftw2012) PHP as a Middleware in Embedded Systems
(phpconftw2012) PHP as a Middleware in Embedded Systems
 

Dernier

DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
UiPathCommunity
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Jeffrey Haguewood
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Victor Rentea
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Victor Rentea
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
WSO2
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Orbitshub
 

Dernier (20)

Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
Platformless Horizons for Digital Adaptability
Platformless Horizons for Digital AdaptabilityPlatformless Horizons for Digital Adaptability
Platformless Horizons for Digital Adaptability
 
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
Apidays New York 2024 - APIs in 2030: The Risk of Technological Sleepwalk by ...
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Vector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptxVector Search -An Introduction in Oracle Database 23ai.pptx
Vector Search -An Introduction in Oracle Database 23ai.pptx
 
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...
 
WSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering DevelopersWSO2's API Vision: Unifying Control, Empowering Developers
WSO2's API Vision: Unifying Control, Empowering Developers
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 

Malware analysis

  • 1.
  • 2. Malware Analysis Collaboration Automation Training Richard Harman @ ShmooCon IX
  • 3. Richard Harman ● Lead Intrusion Analyst @ SRA, Inc SOC ● Started out as a SysAdmin ● Info Sec Analyst for 8 years ● Member of NoVA Hackers group ● Co-Founder of Nova Labs in Reston, VA xabean warewolf richard@richardharman.com
  • 4. Ingredients ● Intro to Malware Analysis & Tools ● Open Source Virtualization ● VM Efficiency & Consistency ● Light-weight VMs & Automating them ● Training – You're Doing It Wrong
  • 6. Brain Food ● Books: ● Filesystem Forensic Analysis ● Windows Forensics Analysis Toolkit ● Malware Analyst's Cookbook ● Practical Malware Analysis ● Reversing: Secrets of Reverse Engineering ● Training: ● SANS GREM FOR610 ● ... upcoming classes ; )
  • 7. The Process 1) Baseline System State 2) Monitor & Log System Activity 3) Infect system 4) Suspend, Dump & Terminate Processes 5) Stop Monitoring 6) Review Monitored Activity 7) Compare new state to baseline
  • 8. The Essentials System Baseline Memory Analysis ● Regshot ● Volatility Framework ● Autoruns General Analysis Logging / Tracing ● OfficeCat ● OllyDbg & Plugins ● FileInsight ● IDA Pro ● Wireshark ● Procmon ● Didier Stevens's Tools ● Capturebat
  • 9. Front-ends for sweet utilities Two I use most: Procmon & Autoruns ➔ @DaveHull is working on autorunalyzer on github.com/davehull/autorunalyzer – .py is a WIP, .sh version exists ➔ I (@xabean) wrote a Procmon XML processor on github.com/warewolf/Procmon
  • 11. 512 MB 1 GB 512 MB XLS DOC sample sample
  • 12. 512 MB 1 GB 512 MB STRESS XLS DOC sample sample
  • 13. DEDUPLICATION 1 GB NO DEDUPLICATON 1 GB
  • 14. RAM De-dupe (Merging) Support ● Linux/QEMU/KVM – Kernel Samepage Merging ● VMware – Transparent page sharing ● VirtualBox – Page Fusion ● (requires guest support) ● Xen – Memory Sharing (tech preview) ● Unmerging – Host swaps, or Host asks Guest to swap.
  • 16. Adobe Reader 9 Office XP Adobe Reader 8 Office 2003 Adobe Reader X Office 2007 Procmon Regshot Capturebat Wireshark IDA Pro FileInsight OllyDbg Autoruns OfficeCat Olly Plugins
  • 18. RAW DISK FILE SYSTEMS iSCSI NFS ATAoE GFS FC GLUSTRE
  • 19. Read Only Copy on Write
  • 20. Copy on Write is an enabler On shared storage ● Enables live VM migration to another analyst In a RAM disk (tmpfs) ● Snapshots become REALLY FAST. ● About 1 second! (revert/save, 7 shot test) Images are only changes – they're small ● Dead-box forensic analysis anyone?
  • 21. CoW (Light-Weight) Disk Clones in Virtualization Software ● VMware ● Workstation has “linked clones” ● ESX(i) wants VMWare VCenter ($$) ● Xen ● OSS: ?? Commercial: yes? ● VirtualBox ● Linked Clones ala VMWare Workstation ● Libvirt + QEmu ● Libvirt LVM: No, QEmu QCOW2: yes (manual)
  • 22. My Malware Environment ● QEmu/KVM (libvirt) ● Windows disk images in LVM, CoW in RAM ● $ qemu-img create -o backing_file=/dev/vg/base -o /tmp/ram/overlay.qcow2 ● RAM drive full? VMs auto-pause self! ● MITM “internet” Linux VM ● Apache, iptables -J REDIRECT, dnsmasq, samba ● Apache vhosts of copies of websites – google, etc ● Connected to malware network & public network
  • 23. A cluster, not a cluster- FSCK Virtualization: ● QEmu/KVM + libvirt for migration Shared disk access: ● Linux tgtd iSCSI – use gigabit ethernet! – Clustered LVM for base images – GFS for CoW storage ● Note: disable cache in tgtd
  • 25. libvirt VM Management Life cycle management: ● Start / Pause / Stop ● Snapshot management ● Dump VM physical memory Provisioning Automation: ● Capture “parent” XML config ● Modify & define new VM
  • 26. libguestfs for Guest Management Guest Disk FS management: ● Supports scripting / automation ● Download & Upload files to guest file system ● Extract analyst data from a standard dir – C:malwareticket_#* --> upload to IR tracking system Windows Registry Support: ● Change hostname to prevent NetBIOS name conflicts on same network
  • 27. Provisioning & Automation ● clone-vm.pl – Clone an existing VM, generate unique MAC & UUID, create Copy-On-Write disk image, change hostname in registry. ● insert-zip.pl & extract-zip.pl – Insert and extract data ● peek.pl –Dump physical memory of a VM for analysis ● ksmstat.pl – Monitor KSM efficiency & CPU usage ala vmstat(1)
  • 28. Collaboration & Training
  • 29. VM vncreflector (host:1) vncreflector FBS output (host:99) FBS VNC video capture
  • 30. Screencasting & Playback Screencasting: ● record-vnc.pl to record & screencast Playback: ● rfbproxy -c -p in inetd ● inetd makes rfbproxy multi-client and self-service ● Shell script to feed rfbproxy VNC videos ● Extra credit: rfbproxy can export to PPM stream – PPM -> MPEG2 + instructor audio = Training Video
  • 31. What do you have now? ● Consistent analysis VMs w/ efficient resource use. ● Multi-participant, interactive, live training sessions. ● Thin-provisioned VM & Acquire analysis data ● Analysis session recorded for future playback ● HQ VNC jukebox (~300MB) ● Medium quality portable MPEG video (~1.5G)
  • 32. DEMO
  • 33. Next Steps... ● Diff pre/post infection of RAM and FS ● Identify injected code/new executables ● Dump, generate signatures, scan, detect variants of the same sample ● Make this all a web-app; snapshots, file mgmt, java applet vnc display ● Auto-provision private networks & VMs per analyst & remote (VPN) access
  • 34. Thank you Jamie! ● @gleeda / http://gleeda.blogspot.com ● Blackbelt in Volatility & EnCase ● Released a Differential EnScript – diff two versions of the same disk & report on 'em
  • 35. Nova-Labs.org ● Malware Analysis Lab ● Classes on Malware Analysis / Reverse Engineering ● Expected to start in April/May ● $$ not yet set (but expected to be cheap) ● Various Malware samples ● Learn, Teach, pass it on!
  • 36. How do I .... It's all at: ● warewolf.github.com / thin-provisioning ● Automation Code ● Documentation (still working on it) ● Configs for MITM: – Apache – dnsmasq – iptables config – samba

Notes de l'éditeur

  1. ========== WHO AM I
  2. ======== OVERVIEW
  3. Target Audience Something for everyone Students and instructors Beginner – getting started Intermediate – working efficiently Advanced – training your peers =========== QUICK SHOW OF HANDS
  4. Show of hands How many never done malware analysis want training been to training taught training =========== LEARNING RESOURCES
  5. Learning resources – Food for your Brain Reversing – Good ASM overview FS Forensics – NTFS chapter really helpful Rest – grab bag of goodness ========== HOW TO GET STARTED
  6. Snapshot known good – app level - not VM snapshot Begin monitoring activity Infect Save volatile info Stop logging Review logs Compare ========== TOOLS
  7. FileInsight – Select & Transform - Inflate JS in PDFs Volatility – Office Doc – nothing dropped, but beaconed! connscan explorer.exe injected ============
  8. I'm a Systems Integrator - Write scripts to speed up processes
  9. Unless necessary, memory generally isn't deduplicated.
  10. Expense of CPU overhead – fit more simliar VMS. GREAT for clones!
  11. KSM – also used in Cyanogenmod Android – not VMs only =========== RAM unmerging – RAM will go into swap.
  12. Unique VM setups Difficult to help each other – they don't understand =================== CLONES.
  13. Centralize VM image Everybody run this image Run Clones NETWORK PROTOCOLS ================= CPU offload benefits R/W STOMPS! HOW TO FIX
  14. Same centralized disk as before, except read only * Export those images to analysts as before * Write changes & snaphots to CoW files * Not just snapshots – a separate file =============== ENABLING PROCESS
  15. Libvirt – I scripted it VMWare Workstation – based on snapshots – parent cna be a “template” VMWare ESXi – can be done, but requires import/export, hand edit of config Xen- ??? =============== MY SETUP
  16. Websites -google, checkip.dyndns.org Samba – IE, flash, java, acrobat QEMU pauses if QCOW2 can't be written to – not a problem for ram drive
  17. ENTIRELY OPTIONAL ============== AUTOMATION Making life easier
  18. Bindings: C/C++, Erlang, Java, OCaml, Perl, Python, Ruby. Hivex for Registry manipulation – kinda sucks. XP hostname hack works through Win8.
  19. More than one person controlling the mouse/keyboard – Paired Reversing =========== TRAINING
  20. VM clones – exactly the same, minimal overhead
  21. Cd demo Screen Split Run ksmstat