Upload File

malware self protection-matrix

34

Upload: cyphort

Post on 11-Apr-2017

547 views

Category:

Technology


0 download

Report

TRANSCRIPT

Page 1: Malware self protection-matrix
Page 2: Malware self protection-matrix

The Malware Self-Protection Matrix

Marion MarschalekSenior Malware Researcher at Cyphort Labs

Page 3: Malware self protection-matrix

Your speakers today

Marion Marschalek Senior Malware Researcher

Cyphort Labs

Shelendra SharmaProduct Marketing Director

Page 4: Malware self protection-matrix

Agenda

o Malware detection evolutiono Malware self-protectiono Wrap-up and Q&A

Cyph

ort L

abs T

-shi

rt

Page 5: Malware self protection-matrix

Threat Monitoring & Research team

________24X7 monitoring for

malware events

________Assist customers with

their Forensics and Incident Response

We enhance malware detection accuracy

________False positives/negatives

________Deep-dive research

We work with the security ecosystem

________Contribute to and learn

from malware KB

________Best of 3rd Party threat

data

Page 6: Malware self protection-matrix

HOW DO YOU FIND WHAT YOU CAN‘T SEE?

http://1ms.net/

Page 7: Malware self protection-matrix

A Digital Threat History

http://www.hdbackgroundpoint.com

VIRUS

EXPLOITWORM

TROJAN

MULTI-COMPONENTMALWARE

ADWARE ROOTKIT

SPYWAREAPT

TARGETED THREAT

SURVEILLANCESOFTWARE

INSIDETHREAT

Page 8: Malware self protection-matrix

A THREAT DETECTION HISTORY

Page 9: Malware self protection-matrix

www.crane.com

Your signature update.

Page 10: Malware self protection-matrix

Checksums

Byte Patterns

Behavior Patterns

Static / Dynamic Heuristics

Whitelisting

Anomalies

Network Streams

Cloud Protection

2015

And many, many more!

Page 11: Malware self protection-matrix

Endpoint

VirusDetectionSignatureProductComputerServer

THINGS HAVE CHANGEDThreat

Prevention

DefinitionSolution

Cloud

Page 12: Malware self protection-matrix

12

Malware Self-Protection

DebuggingDisassembly

StaticEmulation

SandboxingReputationAnomalies

Debugger detection, sub-processes, thread injection Obfuscation Packer and crypter Emulator detection, time based evasion VM detection, modular malware Binary updates, targeted malware Binary padding, use of legitimate tools

Page 13: Malware self protection-matrix

Gladly, most threats make mistakes themselves.

Page 14: Malware self protection-matrix
Page 15: Malware self protection-matrix

ZEUS why can‘t detection work

%APP%\Uwirpa 10.12.2013 23:50

%APP%\Woyxhi 10.12.2013 23:50

%APP%\Hibyo 19.12.2013 00:10

%APP%\Nezah 19.12.2013 00:10

%APP%\Afqag 19.12.2013 23:29

%APP%\Zasi 19.12.2013 23:29

%APP%\Eqzauf 20.12.2013 22:23

%APP%\Ubapo 20.12.2013 22:23

%APP%\Ydgowa 20.12.2013 22:23

%APP%\Olosu 20.12.2013 23:03

%APP%\Taal 20.12.2013 23:03

%APP%\Taosep 20.12.2013 23:03

%APP%\Wokyco 16.01.2014 13:22

%APP%\Semi 17.01.2014 16:34

%APP%\Uheh 17.01.2014 16:34

Page 16: Malware self protection-matrix

16

Sandbox Detection

Page 17: Malware self protection-matrix

Persistence Mechanisms

File Names

Network ConnectionBig Picture Detection & Combination Static/Dynamic Features

SILVER BULLET ...?

Page 18: Malware self protection-matrix

ARMOURINGhttp://hdwallpapersimage.com/

Page 19: Malware self protection-matrix

SAZOORA being picky

Page 20: Malware self protection-matrix

20

Code Obfuscation

Page 21: Malware self protection-matrix

Virtual Machine Code Execution

handler13:ExitProcHresult...

handler14:ExitProc...

handler15:ExitProcI2...

... FC C8 13 76 ...

Page 22: Malware self protection-matrix

Various packer layers – no static detection

Static detection won‘t work

Reputation & Metadata Features

SILVER BULLET ...?

Page 23: Malware self protection-matrix

EXPLOITATION

http://themovieandme.blogspot.com/

Page 24: Malware self protection-matrix

Endpoint protection built to detect repetitive patterns of evil.

Exploit = system corruption

Exploit vs. vulnerability

http://www.wikipedia.com/

Page 25: Malware self protection-matrix

TYPICAL DRIVE-BY INFECTION

o hxxp://www.insertyourwebsitehere.com/js/responsive/min/main-b87ba20746a80e1104da210172b634c4.min.js

o hxxp://stat.litecsys.com/d2.php?ds=true&dr=2711950755o hxxp://vstat.feared.eu/pop2.php?acc=%7E%BE%CE%F5%01%8D%AC

%B2%26%C6%DC%5B%E7n4%D0%16%A3L%99%03%BB%D8%08&nrk=5992423910

o hxxp://g12z4pj3k4k9y4wd517-ll6.dienami.ru/f/1398361080/5/x007cf6b534e520804090407000700080150050f0304045106565601;1;5

o BOOM.

Page 26: Malware self protection-matrix

hxxp://www.insertyourwebsitehere.com/js/responsive/min/main-

b87ba20746a80e1104da210172b634c4.min.js

TYPICAL DRIVE-BY INFECTION

Page 27: Malware self protection-matrix

hxxp://stat.litecsys.com/d2.php?ds=true&dr=2711950755

TYPICAL DRIVE-BY INFECTION

Page 28: Malware self protection-matrix

hxxp://vstat.feared.eu/pop2.php?acc=%7E%BE%CE%F5%01%8D%AC%B2%26%C6%DC%5B%E7n4%D0%16%A3L%99%03%BB%D8%08&

nrk=5992423910

IE 6, 7, 8 or 9, 10, 11

TYPICAL DRIVE-BY INFECTION

Page 29: Malware self protection-matrix

hxxp://g12z4pj3k4k9y4wd517-ll6.dienami.ru/f/1398361080/5/

x007cf6b534e520804090407000700080150050f0304045106565601;1;5

TYPICAL DRIVE-BY INFECTION

Page 30: Malware self protection-matrix

(There is none.)

Patching, patching and more patching

An exploit will seldom come alone!

SILVER BULLET ...?

Page 31: Malware self protection-matrix

VISIBILITY – KNOW HOW – ACTIONABILITY

LURE

EXPLOIT

INFECTCALL HOME

STEAL DATA

Follow the kill chain

Page 32: Malware self protection-matrix

Q&A

Page 33: Malware self protection-matrix

Thank You!

Page 34: Malware self protection-matrix

Parallelization of Machine Learning Applied to Call Graphs ...wkillian/latest/... · crafted malware detection rules with a self-tuning malware detection engine that adapts its detection

Implementing the Self-Sufficiency Matrix

› download › pdf › 81977689.pdf On Self-Adjoint Matrix Polynomials With Constant …On Self-Adjoint Matrix Polynomials With Constant Signature And-6 Ran Vrije Uniljer-siteit

Matrix COSEC Employee Self Service - Nutech...Matrix COSEC Employee Self Service 1 . Why Employee Self Service 2 . 3 Why Employee Self Service Productivity Issues due to Lesser Transparency

Rapid Rehousing Self Sufficiency Matrix User Guide...Oct 04, 2019  · Rapid Rehousing Self Sufficiency Matrix User Guide Medicaid, etc.) Self Sufficiency Matrix Scale Individual Category

WIRELESS CHANNEL MODELING AND MALWARE DETECTION … · information decreases when an endpoint is compromised by a self-propagating malware. These two types of perturbations are used

Self-Expressive Decompositions for Matrix Approximation ... · Self-Expressive Decompositions for Matrix Approximation and Clustering Eva L. Dyer, Member, IEEE, Tom A. Goldstein,

Self-Healing Polymer Matrix Composite Matrix Materials

Malware Architecture COEN 250. Malware Types Self-replicating malware Creates new instances of itself In contrast to passive replication Population

Early Intervention Maturity Matrix: Self-Assessment Tool

Three-dimensional self-assembling nanofiber matrix

Robust Self-calibration and Fundamental Matrix Estimation ... · Robust Self-calibration and Fundamental Matrix Estimation in 3D Computer Vision by Houman Rastgar Thesis submitted

Functional Metal Matrix Composites: Self-lubricating, Self ... · PDF fileFunctional Metal Matrix Composites: Self-lubricating, Self-healing, and Nanocomposites-An Outlook AFSANEH

Wireless Solution Product Matrix - · PDF fileOur Infrastructure wireless offering, formerly Meru Net- ... IPS, anti-malware, VPN, WAN optimization, ... Wireless Product Matrix

Graph-based Malware Detection Using Dynamic Analysis · Malware frequently uses self-protection measures to thwart debugging and analysis. Ether uses a tactic of zero modification

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Behavior Classification based Self-learning Mobile … · Behavior Classification based Self-learning Mobile Malware Detection ... simulation results showed that those Naïve

SELF-sufficiency & Well-Being Matrixmedia.wpc.wa.gov/media/WPC/adm/grants/UWPC Self...UWPC Self-Sufficiency & Well-Being Matrix 6 Welcome to “The Matrix”! To employ a movie analogy,

A composite demineralized bone matrix - Self assembling peptide

Fluidic Self Assembly For Active Matrix Displays Alien Technology Corporation

Perinatal Mental Health Matrix: improving NHS Perinatal ... · Perinatal Mental Health Matrix: improving NHS Perinatal Mental Health Services An online self-assessment Matrix was

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Robust Self-calibration and Fundamental Matrix Estimation in 3D … · 2017-01-31 · Robust Self-calibration and Fundamental Matrix Estimation in 3D Computer Vision by Houman Rastgar

Let your CSIRT do malware analysis, Recruit-CSIRT has … · Let your CSIRT do malware analysis, ... Self-introduction ... Advantages -「Capable of analyzing huge malware 」 •

Implementing the Self-Sufficiency Matrix Updated 8/1/2011

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Self-sensing of Matrix Damage using Mechanophore-based

Eureka: A Framework for Enabling Static Malware … - A...Eureka: A Framework for Enabling Static Malware Analysis 485 malware binary, allowing it to self-decrypt its malicious payload

Malware & Anti-Malware

YARDI Matrix - WhatCountsmedia.whatcounts.com/.../Matrix-Self-Storage-2PG-8.5x11.pdf · 2018-09-14 · YARDI ® Matrix YARDI Matrix Yardi ® Matrix, an industry-leading multifamily

Behavior-based Methods for Automated, Scalable Malware ... · Behavior-based Methods for Automated, Scalable Malware Analysis ... code (self-similar, written as test of skill,

Malware Incident Handling & Forensics. Malware Types Viruses. A virus self-replicates by inserting copies of itself into host programs or data files

Self-Sufficiency Matrix

A Brief Rundown on Malware · A Brief Rundown on Malware 3 Viruses are the type of malware of which most people became aware first. A virus is self-replicating and is always imbedded

BabaYaga - The Self Healing WordPress Malware Contents · BabaYaga - The Self Healing WordPress Malware ... our Premium customers. Our free customers will receive it in a maximum