“Enterprise Malware Detection” “Detect, Diagnose, & Respond with superior intelligence” Advanced Memory Analysis, Automated Code Reversing and Digital DNA 1

Air Force Research Labs Dept Homeland Security (HSARPA) HBGary Background Founded in 2003 Government R&D Solutions: Enterprise Host Intrusion Detection Live Windows Memory Forensics & Incident Response Malicious Code Detection Automated Reverse Engineering HBGary R&D Funding Air Force Research Labs Next Generation Software Reverse Engineering Tools Kernel Virtual Machine Host Analyzer Virtual Machine Debugger Dept Homeland Security (HSARPA) Botnet Detection and Mitigation H/W Assisted System Security Monitor Subcontractor to AFCO Systems Development 2

Strategic Partners Preferred Services Partner: Agilex HBGary Solutions Implementation HBGary Digital DNA Configuration and Management Information Assurance Services HBGary Solutions Integration McAfee Guidance Software

HBGary APPROACH DETECT: DIAGNOSE: RESPOND: Live Physical Memory Forensics Acquire Live – Analyze Offline = This is the advantage We rebuild the underlying data structures No code is executing to “actively” fool our analysis Rootkit Detection becomes easier with offline memory analysis DIAGNOSE: Code Reverse Engineering - Digital DNA - Malware Analysis Identify a binary’s capabilities and authors intent Does it steal my data? Where is my data being sent? How does it install itself? RESPOND: Respond with Actionable Intelligence Block URL’s and IP addresses at the gateway Determine Scope of breach Search & Remediate the malicious code artifacts (Encase Enterprise IA Suite) Create Signatures for IDS/IPS 4

Malware Growth 1987 - 2008 2000 New Malware Per Day in 2007 4000 New Malware Per Day in 2008 http://www.darkgovernment.com/news/the-online-shadow-economy-of-malware/ Source: “Eighty percent of new malware defeats antivirus”, ZDNet Australia, July 19, 2006 Top 3 AV companies don’t detect 80% of new malware

Modern Malware Anti Detection Defeat Anti-Virus & IDS Obfuscate code – pack code – encrypt code Almost unlimited permutations Anti Forensics In-memory only payloads – minimizes the footprint on disk Anti-Reverse Engineering Function level decryption, Packing, Encryption, Polymorphism Rootkit Techniques IDT, SSDT, IRP Hooking, DKOM, File System Hooks, Registry, Firmware Covert Channel Stealth Inject evil traffic into legitimate web browsing

State of malicious code

Why our approach is unique? Memory & Pagefile are analyzed offline malware cannot hide itself actively All code and data that is in use MUST exist in physical memory or Pagefile therefore we have access to it The OS points us to the running rootkit or malware by virtue that the malware interacts with the OS

The 3 Technologies of HBGary Digital DNA (Behavioral Analysis) Engineering Reverse Code Physical Memory Forensics

1. Physical Memory Analysis Can Identify executable code hidden from Antivirus Can overcome many of the advanced tricks posed by advanced malware Can detect modifications to the system Is the only way to detect some of the latest threats

2. Automated Reverse Engineering Once you detect suspicious or unknown code you need to identify if it’s malicious or not… Automated Reverse Engineering provides critical intelligence: How malware installs itself How to identify other compromised hosts How to clean it up How and to whom it communicates over the network What information it steals How it remains undetected….

3. Goals Digital DNA Rapidly identify: Identify traits of the malware Malicious behaviors inside of running applications in memory Identify traits of the malware There are thousands of traits Can be broadly grouped into six behavioral categories (“factors” )

Why Digital DNA is unique? The disassembled malware has code and data that reveals behavior Digital DNA is an abbreviated code for detected behaviors Behaviors can be “good” or “bad” Each behavior has a weight and when combined into a DDNA sequence, a sequence has a weight

Creating Digital DNA HBGary receives 4000+ malware samples per day The Overbeast is an ESX Server; it performs runtime analysis on 100 malware per hour Overbeast is part of the DDNA creation process Overbeast runs 40 Virtual Machines simultaneously Automatically runs malware with flypaper…

DDNA Building Blocks: Traits Trait codes look like this: 04 0F 51 Weight / Control flags Unique hash code Description is held in a database

Digital DNA Sequences This is a series of 3 octet trait codes 02 82 78 02 D6 F7 07 CD E3 05 51 87 05 A8 F1 02 FB 99 02 45 5B 02 7C 9A 02 AC CF 00 9F… This is a series of 3 octet trait codes Each trait can have a weight from -15 to +15. + means suspicious. – means trusted. The entire sequence is weighted by summing the weights of each trait. The summing of weights is performed using an algorithm known as the “discrete weight decay algorithm”. This algorithm will decay the effects of a repeated weight value over time. A malicious binary will usually score +40 points or more in weight.

Ranking Software Modules by Threat Severity Software Behavioral Traits Digital DNA Ranking Software Modules by Threat Severity Software Behavioral Traits

Digital DNA Screenshot

Client Testimonial 1 of the Largest Pharmaceutical companies Under attack every day Uses Responder and also one of the largest antivirus companies Responder provides immediate critical intelligence to secure the network and mitigate the threat to the data

Point Solutions Responder Professional v1.4 – Comprehensive physical memory and malware investigation platform Host Intrusion Detection & Incident Response Live Windows Forensics Automated Malware Analysis Digital DNA Responder Field Edition v1.4 – Comprehensive Memory Investigation platform. Geared towards Law Enforcement and computer forensic investigators

Enterprise Solutions Enterprise Responder – McAfee EPO 4.0 Integration Enterprise Malware/Rootkit Detection & Reporting Distributed Physical Memory Analysis with Digital DNA Enterprise Responder – Guidance Software Encase Enterprise Enterprise solution for remote suspicious behavior detection

McAfee ePO Integration

Thank you www.hbgary.com John Edwards Rich Cummings John.edwards@agilex.com 703-889-3939 Rich Cummings rich@hbgary.com 301-652-8885 x112 www.hbgary.com