SlideShare ist ein Scribd-Unternehmen logo

Malware analysis

•
•
X
xabean

Malware Analysis: Collaboration, Automation & Tuning - from Shmoocon 2013

Technologie
1 von 37
Malware Analysis Collaboration Automation Training Richard Harman @ ShmooCon IX
Richard Harman ● Lead Intrusion Analyst @ SRA, Inc SOC ● Started out as a SysAdmin ● Info Sec Analyst for 8 years ● Member of NoVA Hackers group ● Co-Founder of Nova Labs in Reston, VA xabean warewolf richard@richardharman.com
Ingredients ● Intro to Malware Analysis & Tools ● Open Source Virtualization ● VM Efficiency & Consistency ● Light-weight VMs & Automating them ● Training – You're Doing It Wrong
Malware Analysis
Brain Food ● Books: ● Filesystem Forensic Analysis ● Windows Forensics Analysis Toolkit ● Malware Analyst's Cookbook ● Practical Malware Analysis ● Reversing: Secrets of Reverse Engineering ● Training: ● SANS GREM FOR610 ● ... upcoming classes ; )
The Process 1) Baseline System State 2) Monitor & Log System Activity 3) Infect system 4) Suspend, Dump & Terminate Processes 5) Stop Monitoring 6) Review Monitored Activity 7) Compare new state to baseline
The Essentials System Baseline Memory Analysis ● Regshot ● Volatility Framework ● Autoruns General Analysis Logging / Tracing ● OfficeCat ● OllyDbg & Plugins ● FileInsight ● IDA Pro ● Wireshark ● Procmon ● Didier Stevens's Tools ● Capturebat
Front-ends for sweet utilities Two I use most: Procmon & Autoruns ➔ @DaveHull is working on autorunalyzer on github.com/davehull/autorunalyzer – .py is a WIP, .sh version exists ➔ I (@xabean) wrote a Procmon XML processor on github.com/warewolf/Procmon
Virtualization RAM efficiency
512 MB 1 GB 512 MB XLS DOC sample sample
512 MB 1 GB 512 MB STRESS XLS DOC sample sample
DEDUPLICATION 1 GB NO DEDUPLICATON 1 GB
RAM De-dupe (Merging) Support ● Linux/QEMU/KVM – Kernel Samepage Merging ● VMware – Transparent page sharing ● VirtualBox – Page Fusion ● (requires guest support) ● Xen – Memory Sharing (tech preview) ● Unmerging – Host swaps, or Host asks Guest to swap.
Virtualization Consistency & Disk efficiency
Adobe Reader 9 Office XP Adobe Reader 8 Office 2003 Adobe Reader X Office 2007 Procmon Regshot Capturebat Wireshark IDA Pro FileInsight OllyDbg Autoruns OfficeCat Olly Plugins
CLONES
RAW DISK FILE SYSTEMS iSCSI NFS ATAoE GFS FC GLUSTRE
Read Only Copy on Write
Copy on Write is an enabler On shared storage ● Enables live VM migration to another analyst In a RAM disk (tmpfs) ● Snapshots become REALLY FAST. ● About 1 second! (revert/save, 7 shot test) Images are only changes – they're small ● Dead-box forensic analysis anyone?
CoW (Light-Weight) Disk Clones in Virtualization Software ● VMware ● Workstation has “linked clones” ● ESX(i) wants VMWare VCenter ($$) ● Xen ● OSS: ?? Commercial: yes? ● VirtualBox ● Linked Clones ala VMWare Workstation ● Libvirt + QEmu ● Libvirt LVM: No, QEmu QCOW2: yes (manual)
My Malware Environment ● QEmu/KVM (libvirt) ● Windows disk images in LVM, CoW in RAM ● $ qemu-img create -o backing_file=/dev/vg/base -o /tmp/ram/overlay.qcow2 ● RAM drive full? VMs auto-pause self! ● MITM “internet” Linux VM ● Apache, iptables -J REDIRECT, dnsmasq, samba ● Apache vhosts of copies of websites – google, etc ● Connected to malware network & public network
A cluster, not a cluster- FSCK Virtualization: ● QEmu/KVM + libvirt for migration Shared disk access: ● Linux tgtd iSCSI – use gigabit ethernet! – Clustered LVM for base images – GFS for CoW storage ● Note: disable cache in tgtd
Automation
libvirt VM Management Life cycle management: ● Start / Pause / Stop ● Snapshot management ● Dump VM physical memory Provisioning Automation: ● Capture “parent” XML config ● Modify & define new VM
libguestfs for Guest Management Guest Disk FS management: ● Supports scripting / automation ● Download & Upload files to guest file system ● Extract analyst data from a standard dir – C:malwareticket_#* --> upload to IR tracking system Windows Registry Support: ● Change hostname to prevent NetBIOS name conflicts on same network
Provisioning & Automation ● clone-vm.pl – Clone an existing VM, generate unique MAC & UUID, create Copy-On-Write disk image, change hostname in registry. ● insert-zip.pl & extract-zip.pl – Insert and extract data ● peek.pl –Dump physical memory of a VM for analysis ● ksmstat.pl – Monitor KSM efficiency & CPU usage ala vmstat(1)
Collaboration & Training
VM vncreflector (host:1) vncreflector FBS output (host:99) FBS VNC video capture
Screencasting & Playback Screencasting: ● record-vnc.pl to record & screencast Playback: ● rfbproxy -c -p in inetd ● inetd makes rfbproxy multi-client and self-service ● Shell script to feed rfbproxy VNC videos ● Extra credit: rfbproxy can export to PPM stream – PPM -> MPEG2 + instructor audio = Training Video
What do you have now? ● Consistent analysis VMs w/ efficient resource use. ● Multi-participant, interactive, live training sessions. ● Thin-provisioned VM & Acquire analysis data ● Analysis session recorded for future playback ● HQ VNC jukebox (~300MB) ● Medium quality portable MPEG video (~1.5G)
DEMO
Next Steps... ● Diff pre/post infection of RAM and FS ● Identify injected code/new executables ● Dump, generate signatures, scan, detect variants of the same sample ● Make this all a web-app; snapshots, file mgmt, java applet vnc display ● Auto-provision private networks & VMs per analyst & remote (VPN) access
Thank you Jamie! ● @gleeda / http://gleeda.blogspot.com ● Blackbelt in Volatility & EnCase ● Released a Differential EnScript – diff two versions of the same disk & report on 'em
Nova-Labs.org ● Malware Analysis Lab ● Classes on Malware Analysis / Reverse Engineering ● Expected to start in April/May ● $$ not yet set (but expected to be cheap) ● Various Malware samples ● Learn, Teach, pass it on!
How do I .... It's all at: ● warewolf.github.com / thin-provisioning ● Automation Code ● Documentation (still working on it) ● Configs for MITM: – Apache – dnsmasq – iptables config – samba
Malware analysis

Empfohlen

Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware AnalysisAlbert Hui
 
Malware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineeringMalware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineeringbartblaze
 
Malware analysis
Malware analysisMalware analysis
Malware analysisPrakashchand Suthar
 
Spo2 t19 spo2-t19
Spo2 t19 spo2-t19Spo2 t19 spo2-t19
Spo2 t19 spo2-t19SelectedPresentations
 
Sans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleSans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleMichel Coene
 
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Lane Huff
 
Fileless Malware Infections
Fileless Malware InfectionsFileless Malware Infections
Fileless Malware InfectionsRamon
 
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...grecsl
 

Empfohlen

Basic Malware Analysis
Basic Malware AnalysisBasic Malware Analysis
Basic Malware AnalysisAlbert Hui
 
Malware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineeringMalware analysis, threat intelligence and reverse engineering
Malware analysis, threat intelligence and reverse engineeringbartblaze
 
Malware analysis
Malware analysisMalware analysis
Malware analysisPrakashchand Suthar
 
Spo2 t19 spo2-t19
Spo2 t19 spo2-t19Spo2 t19 spo2-t19
Spo2 t19 spo2-t19SelectedPresentations
 
Sans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleSans london april sans at night - tearing apart a fileless malware sample
Sans london april sans at night - tearing apart a fileless malware sampleMichel Coene
 
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"
Introduction to Dynamic Malware Analysis ...Or am I "Cuckoo for Malware?"Lane Huff
 
Fileless Malware Infections
Fileless Malware InfectionsFileless Malware Infections
Fileless Malware InfectionsRamon
 
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...
Malware Analysis 101 - N00b to Ninja in 60 Minutes at BSidesLV on August 5, ...grecsl
 
Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacksBalaji Rajasekaran
 
Basic malware analysis
Basic malware analysisBasic malware analysis
Basic malware analysissecurityxploded
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware AnalysisAndrew McNicol
 
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...CODE BLUE
 
Automating Malware Analysis
Automating Malware AnalysisAutomating Malware Analysis
Automating Malware Analysissecurityxploded
 
Ch0 1
Ch0 1Ch0 1
Ch0 1TylerDerdun
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threatINSIGHT FORENSIC
 
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detectionAnti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detectionNeel Pathak
 
Hack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration TestingHack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration TestingSteve Phillips
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memorysecurityxploded
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemRoss Wolf
 
Metasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner ClassMetasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner ClassGeorgia Weidman
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisAntonio Parata
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezEC-Council
 
Malware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersTazdrumm3r
 
Metasploit for Web Workshop
Metasploit for Web WorkshopMetasploit for Web Workshop
Metasploit for Web WorkshopDennis Maldonado
 
Taking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryTaking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryJoe Desimone
 
Hunting For Exploit Kits
Hunting For Exploit KitsHunting For Exploit Kits
Hunting For Exploit KitsJoe Desimone
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made SimplePaul Melson
 
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki ChidaIDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki ChidaCODE BLUE
 
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012Lance Albertson
 
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit FrameworkUnmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Frameworkegypt
 

Weitere ähnliche Inhalte

Was ist angesagt?

Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware AnalysisAndrew McNicol
 
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...CODE BLUE
 
Automating Malware Analysis
Automating Malware AnalysisAutomating Malware Analysis
Automating Malware Analysissecurityxploded
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threatINSIGHT FORENSIC
 
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detectionAnti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detectionNeel Pathak
 
Hack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration TestingHack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration TestingSteve Phillips
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memorysecurityxploded
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemRoss Wolf
 
Metasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner ClassMetasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner ClassGeorgia Weidman
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisAntonio Parata
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezEC-Council
 
Malware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersTazdrumm3r
 
Metasploit for Web Workshop
Metasploit for Web WorkshopMetasploit for Web Workshop
Metasploit for Web WorkshopDennis Maldonado
 
Taking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryTaking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryJoe Desimone
 
Hunting For Exploit Kits
Hunting For Exploit KitsHunting For Exploit Kits
Hunting For Exploit KitsJoe Desimone
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made SimplePaul Melson
 
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki ChidaIDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki ChidaCODE BLUE
 

Was ist angesagt? (20)

Catching fileless attacks
Catching fileless attacksCatching fileless attacks
Catching fileless attacks
 
Basic malware analysis
Basic malware analysisBasic malware analysis
Basic malware analysis
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
 
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
Revealing the Attack Operations Targeting Japan by Shusei Tomonaga & Yuu Nak...
 
Automating Malware Analysis
Automating Malware AnalysisAutomating Malware Analysis
Automating Malware Analysis
 
Ch0 1
Ch0 1Ch0 1
Ch0 1
 
(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat(130119) #fitalk apt, cyber espionage threat
(130119) #fitalk apt, cyber espionage threat
 
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detectionAnti-virus Mechanisms and Various Ways to Bypass Antivirus detection
Anti-virus Mechanisms and Various Ways to Bypass Antivirus detection
 
Hack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration TestingHack Attack! An Introduction to Penetration Testing
Hack Attack! An Introduction to Penetration Testing
 
Hunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of MemoryHunting Rootkit From the Dark Corners Of Memory
Hunting Rootkit From the Dark Corners Of Memory
 
Fantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find ThemFantastic Red Team Attacks and How to Find Them
Fantastic Red Team Attacks and How to Find Them
 
Metasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner ClassMetasploit for Penetration Testing: Beginner Class
Metasploit for Penetration Testing: Beginner Class
 
HackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware AnalysisHackInBo2k16 - Threat Intelligence and Malware Analysis
HackInBo2k16 - Threat Intelligence and Malware Analysis
 
Hunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul AlvarezHunting Layered Malware by Raul Alvarez
Hunting Layered Malware by Raul Alvarez
 
Malware analysis - What to learn from your invaders
Malware analysis - What to learn from your invadersMalware analysis - What to learn from your invaders
Malware analysis - What to learn from your invaders
 
Metasploit for Web Workshop
Metasploit for Web WorkshopMetasploit for Web Workshop
Metasploit for Web Workshop
 
Taking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in MemoryTaking Hunting to the Next Level: Hunting in Memory
Taking Hunting to the Next Level: Hunting in Memory
 
Hunting For Exploit Kits
Hunting For Exploit KitsHunting For Exploit Kits
Hunting For Exploit Kits
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
 
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki ChidaIDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
IDA Vulnerabilities and Bug Bounty　 by Masaaki Chida
 

Ähnlich wie Malware analysis

Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012Lance Albertson
 
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit FrameworkUnmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Frameworkegypt
 
A3Sec Advanced Deployment System
A3Sec Advanced Deployment SystemA3Sec Advanced Deployment System
A3Sec Advanced Deployment Systema3sec
 
CodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest 2013. Mosesohn M. — Automating environments with CobblerCodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest 2013. Mosesohn M. — Automating environments with CobblerCodeFest
 
Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Lightweight Virtualization with Linux Containers and Docker I YaC 2013Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Lightweight Virtualization with Linux Containers and Docker I YaC 2013Docker, Inc.
 
Lightweight Virtualization with Linux Containers and Docker | YaC 2013
Lightweight Virtualization with Linux Containers and Docker | YaC 2013Lightweight Virtualization with Linux Containers and Docker | YaC 2013
Lightweight Virtualization with Linux Containers and Docker | YaC 2013dotCloud
 
Let's Containerize New York with Docker!
Let's Containerize New York with Docker!Let's Containerize New York with Docker!
Let's Containerize New York with Docker!Jérôme Petazzoni
 
Docker 0.11 at MaxCDN meetup in Los Angeles
Docker 0.11 at MaxCDN meetup in Los AngelesDocker 0.11 at MaxCDN meetup in Los Angeles
Docker 0.11 at MaxCDN meetup in Los AngelesJérôme Petazzoni
 
Cobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale EnvironmentsCobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale EnvironmentsMichael Zhang
 
Backing up Wikipedia Databases
Backing up Wikipedia DatabasesBacking up Wikipedia Databases
Backing up Wikipedia DatabasesJaime Crespo
 
QEMU Disk IO Which performs Better: Native or threads?
QEMU Disk IO Which performs Better: Native or threads?QEMU Disk IO Which performs Better: Native or threads?
QEMU Disk IO Which performs Better: Native or threads?Pradeep Kumar
 
Varnish http accelerator
Varnish http acceleratorVarnish http accelerator
Varnish http acceleratorno no
 
The Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldThe Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldDevOps.com
 
GoSF Jan 2016 - Go Write a Plugin for Snap!
GoSF Jan 2016 - Go Write a Plugin for Snap!GoSF Jan 2016 - Go Write a Plugin for Snap!
GoSF Jan 2016 - Go Write a Plugin for Snap!Matthew Broberg
 
OpenStack Cinder Best Practices - Meet Up
OpenStack Cinder Best Practices - Meet UpOpenStack Cinder Best Practices - Meet Up
OpenStack Cinder Best Practices - Meet UpAaron Delp
 
Linux Server Deep Dives (DrupalCon Amsterdam)
Linux Server Deep Dives (DrupalCon Amsterdam)Linux Server Deep Dives (DrupalCon Amsterdam)
Linux Server Deep Dives (DrupalCon Amsterdam)Amin Astaneh
 
(phpconftw2012) PHP as a Middleware in Embedded Systems
(phpconftw2012) PHP as a Middleware in Embedded Systems(phpconftw2012) PHP as a Middleware in Embedded Systems
(phpconftw2012) PHP as a Middleware in Embedded Systemssosorry
 

Ähnlich wie Malware analysis (20)

Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
Hands on Virtualization with Ganeti (part 1) - LinuxCon 2012
 
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit FrameworkUnmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
 
A3Sec Advanced Deployment System
A3Sec Advanced Deployment SystemA3Sec Advanced Deployment System
A3Sec Advanced Deployment System
 
CodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest 2013. Mosesohn M. — Automating environments with CobblerCodeFest 2013. Mosesohn M. — Automating environments with Cobbler
CodeFest 2013. Mosesohn M. — Automating environments with Cobbler
 
Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Lightweight Virtualization with Linux Containers and Docker I YaC 2013Lightweight Virtualization with Linux Containers and Docker I YaC 2013
Lightweight Virtualization with Linux Containers and Docker I YaC 2013
 
Lightweight Virtualization with Linux Containers and Docker | YaC 2013
Lightweight Virtualization with Linux Containers and Docker | YaC 2013Lightweight Virtualization with Linux Containers and Docker | YaC 2013
Lightweight Virtualization with Linux Containers and Docker | YaC 2013
 
Let's Containerize New York with Docker!
Let's Containerize New York with Docker!Let's Containerize New York with Docker!
Let's Containerize New York with Docker!
 
Docker 0.11 at MaxCDN meetup in Los Angeles
Docker 0.11 at MaxCDN meetup in Los AngelesDocker 0.11 at MaxCDN meetup in Los Angeles
Docker 0.11 at MaxCDN meetup in Los Angeles
 
Kvm optimizations
Kvm optimizationsKvm optimizations
Kvm optimizations
 
Cobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale EnvironmentsCobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale Environments
 
Cobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale EnvironmentsCobbler, Func and Puppet: Tools for Large Scale Environments
Cobbler, Func and Puppet: Tools for Large Scale Environments
 
Backing up Wikipedia Databases
Backing up Wikipedia DatabasesBacking up Wikipedia Databases
Backing up Wikipedia Databases
 
QEMU Disk IO Which performs Better: Native or threads?
QEMU Disk IO Which performs Better: Native or threads?QEMU Disk IO Which performs Better: Native or threads?
QEMU Disk IO Which performs Better: Native or threads?
 
Varnish http accelerator
Varnish http acceleratorVarnish http accelerator
Varnish http accelerator
 
The Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote WorldThe Future of Security and Productivity in Our Newly Remote World
The Future of Security and Productivity in Our Newly Remote World
 
GoSF Jan 2016 - Go Write a Plugin for Snap!
GoSF Jan 2016 - Go Write a Plugin for Snap!GoSF Jan 2016 - Go Write a Plugin for Snap!
GoSF Jan 2016 - Go Write a Plugin for Snap!
 
OpenStack Cinder Best Practices - Meet Up
OpenStack Cinder Best Practices - Meet UpOpenStack Cinder Best Practices - Meet Up
OpenStack Cinder Best Practices - Meet Up
 
Linux Server Deep Dives (DrupalCon Amsterdam)
Linux Server Deep Dives (DrupalCon Amsterdam)Linux Server Deep Dives (DrupalCon Amsterdam)
Linux Server Deep Dives (DrupalCon Amsterdam)
 
Docker bdxio
Docker bdxioDocker bdxio
Docker bdxio
 
(phpconftw2012) PHP as a Middleware in Embedded Systems
(phpconftw2012) PHP as a Middleware in Embedded Systems(phpconftw2012) PHP as a Middleware in Embedded Systems
(phpconftw2012) PHP as a Middleware in Embedded Systems
 

Kürzlich hochgeladen

What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024Stephanie Beckett
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationSlibray Presentation
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyAlfredo García Lavilla
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brandgvaughan
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsSergiu Bodiu
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek SchlawackFwdays
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxLoriGlavin3
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenHervé Boutemy
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 3652toLead Limited
 

Kürzlich hochgeladen (20)

What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024What's New in Teams Calling, Meetings and Devices March 2024
What's New in Teams Calling, Meetings and Devices March 2024
 
Connect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck PresentationConnect Wave/ connectwave Pitch Deck Presentation
Connect Wave/ connectwave Pitch Deck Presentation
 
Commit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easyCommit 2024 - Secret Management made easy
Commit 2024 - Secret Management made easy
 
WordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your BrandWordPress Websites for Engineers: Elevate Your Brand
WordPress Websites for Engineers: Elevate Your Brand
 
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxThe Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptx
 
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptxDigital Identity is Under Attack: FIDO Paris Seminar.pptx
Digital Identity is Under Attack: FIDO Paris Seminar.pptx
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
DevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platformsDevEX - reference for building teams, processes, and platforms
DevEX - reference for building teams, processes, and platforms
 
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
"Subclassing and Composition – A Pythonic Tour of Trade-Offs", Hynek Schlawack
 
Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!Nell’iperspazio con Rocket: il Framework Web di Rust!
Nell’iperspazio con Rocket: il Framework Web di Rust!
 
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024
 
Unraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdfUnraveling Multimodality with Large Language Models.pdf
Unraveling Multimodality with Large Language Models.pdf
 
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptx
 
DevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache MavenDevoxxFR 2024 Reproducible Builds with Apache Maven
DevoxxFR 2024 Reproducible Builds with Apache Maven
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 
SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024SIP trunking in Janus @ Kamailio World 2024
SIP trunking in Janus @ Kamailio World 2024
 
Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365Ensuring Technical Readiness For Copilot in Microsoft 365
Ensuring Technical Readiness For Copilot in Microsoft 365
 

Malware analysis

  • 1.
  • 2. Malware Analysis Collaboration Automation Training Richard Harman @ ShmooCon IX
  • 3. Richard Harman ● Lead Intrusion Analyst @ SRA, Inc SOC ● Started out as a SysAdmin ● Info Sec Analyst for 8 years ● Member of NoVA Hackers group ● Co-Founder of Nova Labs in Reston, VA xabean warewolf richard@richardharman.com
  • 4. Ingredients ● Intro to Malware Analysis & Tools ● Open Source Virtualization ● VM Efficiency & Consistency ● Light-weight VMs & Automating them ● Training – You're Doing It Wrong
  • 6. Brain Food ● Books: ● Filesystem Forensic Analysis ● Windows Forensics Analysis Toolkit ● Malware Analyst's Cookbook ● Practical Malware Analysis ● Reversing: Secrets of Reverse Engineering ● Training: ● SANS GREM FOR610 ● ... upcoming classes ; )
  • 7. The Process 1) Baseline System State 2) Monitor & Log System Activity 3) Infect system 4) Suspend, Dump & Terminate Processes 5) Stop Monitoring 6) Review Monitored Activity 7) Compare new state to baseline
  • 8. The Essentials System Baseline Memory Analysis ● Regshot ● Volatility Framework ● Autoruns General Analysis Logging / Tracing ● OfficeCat ● OllyDbg & Plugins ● FileInsight ● IDA Pro ● Wireshark ● Procmon ● Didier Stevens's Tools ● Capturebat
  • 9. Front-ends for sweet utilities Two I use most: Procmon & Autoruns ➔ @DaveHull is working on autorunalyzer on github.com/davehull/autorunalyzer – .py is a WIP, .sh version exists ➔ I (@xabean) wrote a Procmon XML processor on github.com/warewolf/Procmon
  • 11. 512 MB 1 GB 512 MB XLS DOC sample sample
  • 12. 512 MB 1 GB 512 MB STRESS XLS DOC sample sample
  • 13. DEDUPLICATION 1 GB NO DEDUPLICATON 1 GB
  • 14. RAM De-dupe (Merging) Support ● Linux/QEMU/KVM – Kernel Samepage Merging ● VMware – Transparent page sharing ● VirtualBox – Page Fusion ● (requires guest support) ● Xen – Memory Sharing (tech preview) ● Unmerging – Host swaps, or Host asks Guest to swap.
  • 16. Adobe Reader 9 Office XP Adobe Reader 8 Office 2003 Adobe Reader X Office 2007 Procmon Regshot Capturebat Wireshark IDA Pro FileInsight OllyDbg Autoruns OfficeCat Olly Plugins
  • 18. RAW DISK FILE SYSTEMS iSCSI NFS ATAoE GFS FC GLUSTRE
  • 19. Read Only Copy on Write
  • 20. Copy on Write is an enabler On shared storage ● Enables live VM migration to another analyst In a RAM disk (tmpfs) ● Snapshots become REALLY FAST. ● About 1 second! (revert/save, 7 shot test) Images are only changes – they're small ● Dead-box forensic analysis anyone?
  • 21. CoW (Light-Weight) Disk Clones in Virtualization Software ● VMware ● Workstation has “linked clones” ● ESX(i) wants VMWare VCenter ($$) ● Xen ● OSS: ?? Commercial: yes? ● VirtualBox ● Linked Clones ala VMWare Workstation ● Libvirt + QEmu ● Libvirt LVM: No, QEmu QCOW2: yes (manual)
  • 22. My Malware Environment ● QEmu/KVM (libvirt) ● Windows disk images in LVM, CoW in RAM ● $ qemu-img create -o backing_file=/dev/vg/base -o /tmp/ram/overlay.qcow2 ● RAM drive full? VMs auto-pause self! ● MITM “internet” Linux VM ● Apache, iptables -J REDIRECT, dnsmasq, samba ● Apache vhosts of copies of websites – google, etc ● Connected to malware network & public network
  • 23. A cluster, not a cluster- FSCK Virtualization: ● QEmu/KVM + libvirt for migration Shared disk access: ● Linux tgtd iSCSI – use gigabit ethernet! – Clustered LVM for base images – GFS for CoW storage ● Note: disable cache in tgtd
  • 25. libvirt VM Management Life cycle management: ● Start / Pause / Stop ● Snapshot management ● Dump VM physical memory Provisioning Automation: ● Capture “parent” XML config ● Modify & define new VM
  • 26. libguestfs for Guest Management Guest Disk FS management: ● Supports scripting / automation ● Download & Upload files to guest file system ● Extract analyst data from a standard dir – C:malwareticket_#* --> upload to IR tracking system Windows Registry Support: ● Change hostname to prevent NetBIOS name conflicts on same network
  • 27. Provisioning & Automation ● clone-vm.pl – Clone an existing VM, generate unique MAC & UUID, create Copy-On-Write disk image, change hostname in registry. ● insert-zip.pl & extract-zip.pl – Insert and extract data ● peek.pl –Dump physical memory of a VM for analysis ● ksmstat.pl – Monitor KSM efficiency & CPU usage ala vmstat(1)
  • 28. Collaboration & Training
  • 29. VM vncreflector (host:1) vncreflector FBS output (host:99) FBS VNC video capture
  • 30. Screencasting & Playback Screencasting: ● record-vnc.pl to record & screencast Playback: ● rfbproxy -c -p in inetd ● inetd makes rfbproxy multi-client and self-service ● Shell script to feed rfbproxy VNC videos ● Extra credit: rfbproxy can export to PPM stream – PPM -> MPEG2 + instructor audio = Training Video
  • 31. What do you have now? ● Consistent analysis VMs w/ efficient resource use. ● Multi-participant, interactive, live training sessions. ● Thin-provisioned VM & Acquire analysis data ● Analysis session recorded for future playback ● HQ VNC jukebox (~300MB) ● Medium quality portable MPEG video (~1.5G)
  • 32. DEMO
  • 33. Next Steps... ● Diff pre/post infection of RAM and FS ● Identify injected code/new executables ● Dump, generate signatures, scan, detect variants of the same sample ● Make this all a web-app; snapshots, file mgmt, java applet vnc display ● Auto-provision private networks & VMs per analyst & remote (VPN) access
  • 34. Thank you Jamie! ● @gleeda / http://gleeda.blogspot.com ● Blackbelt in Volatility & EnCase ● Released a Differential EnScript – diff two versions of the same disk & report on 'em
  • 35. Nova-Labs.org ● Malware Analysis Lab ● Classes on Malware Analysis / Reverse Engineering ● Expected to start in April/May ● $$ not yet set (but expected to be cheap) ● Various Malware samples ● Learn, Teach, pass it on!
  • 36. How do I .... It's all at: ● warewolf.github.com / thin-provisioning ● Automation Code ● Documentation (still working on it) ● Configs for MITM: – Apache – dnsmasq – iptables config – samba

Hinweis der Redaktion

  1. ========== WHO AM I
  2. ======== OVERVIEW
  3. Target Audience Something for everyone Students and instructors Beginner – getting started Intermediate – working efficiently Advanced – training your peers =========== QUICK SHOW OF HANDS
  4. Show of hands How many never done malware analysis want training been to training taught training =========== LEARNING RESOURCES
  5. Learning resources – Food for your Brain Reversing – Good ASM overview FS Forensics – NTFS chapter really helpful Rest – grab bag of goodness ========== HOW TO GET STARTED
  6. Snapshot known good – app level - not VM snapshot Begin monitoring activity Infect Save volatile info Stop logging Review logs Compare ========== TOOLS
  7. FileInsight – Select & Transform - Inflate JS in PDFs Volatility – Office Doc – nothing dropped, but beaconed! connscan explorer.exe injected ============
  8. I'm a Systems Integrator - Write scripts to speed up processes
  9. Unless necessary, memory generally isn't deduplicated.
  10. Expense of CPU overhead – fit more simliar VMS. GREAT for clones!
  11. KSM – also used in Cyanogenmod Android – not VMs only =========== RAM unmerging – RAM will go into swap.
  12. Unique VM setups Difficult to help each other – they don't understand =================== CLONES.
  13. Centralize VM image Everybody run this image Run Clones NETWORK PROTOCOLS ================= CPU offload benefits R/W STOMPS! HOW TO FIX
  14. Same centralized disk as before, except read only * Export those images to analysts as before * Write changes & snaphots to CoW files * Not just snapshots – a separate file =============== ENABLING PROCESS
  15. Libvirt – I scripted it VMWare Workstation – based on snapshots – parent cna be a “template” VMWare ESXi – can be done, but requires import/export, hand edit of config Xen- ??? =============== MY SETUP
  16. Websites -google, checkip.dyndns.org Samba – IE, flash, java, acrobat QEMU pauses if QCOW2 can't be written to – not a problem for ram drive
  17. ENTIRELY OPTIONAL ============== AUTOMATION Making life easier
  18. Bindings: C/C++, Erlang, Java, OCaml, Perl, Python, Ruby. Hivex for Registry manipulation – kinda sucks. XP hostname hack works through Win8.
  19. More than one person controlling the mouse/keyboard – Paired Reversing =========== TRAINING
  20. VM clones – exactly the same, minimal overhead
  21. Cd demo Screen Split Run ksmstat