Company Overview

HBGary Background Government Services Founded in 2003 Solutions: Host Intrusion Detection & Incident Response Live Windows Memory Forensics Malicious Code Detection Automated Reverse Engineering Products: HBGary Responder Enterprise (to be announced March 9th, 2009) McAfee ePO (HBSS) Integration HBGary Responder Professional Stand alone application Services & Training Incident Response Malware Analysis 2

Air Force Research Labs Dept Homeland Security (HSARPA) HBGary R&D Funding Air Force Research Labs Next Generation Software Reverse Engineering Tools (Phases I and II) Kernel Virtual Machine Host Analyzer (Phases I and II) Virtual Machine Debugger (Phase I) Dept Homeland Security (HSARPA) Botnet Detection and Mitigation (Phases I and II) H/W Assisted System Security Monitor (Phases I and II) Subcontractor to AFCO Systems Development Small Business Innovative Research (SBIR) Program 3

Growing Cybercrime Problem Sophisticated targeted attacks Criminal and state sponsored Motivated, well funded adversaries Any cyber defense can and will be defeated

We process almost 5,000 malware every 24 hours

Bots Rootkits Process Injectors All infecting Enterprises RIGHT NOW

Anti-virus Shortcomings Source: “Eighty percent of new malware defeats antivirus”, ZDNet Australia, July 19, 2006 Top 3 AV companies don’t detect 80% of new malware The sheer volume and complexity of computer viruses being released on the Internet today has the anti-virus industry on the defensive, experts say, underscoring the need for consumers to avoid relying on anti-virus software alone to keep their…computers safe and secure. Source: “Anti-Virus Firms Scrambling to Keep Up ”, The Washington Post, March 19, 2008 7

What you don’t see can hurt you.

HBGary’s Approach Detect, Diagnose, Respond Host-centric approach Find the bad guy on computers and tell you what he is doing Host-centric approach Physical memory (RAM) analysis Binary analysis Detection with Digital DNA Enterprise endpoint detection and visibility

Benefits Enterprise detection of compromised hosts Visibility of remote hosts Lowers the skill bar for incident response Better cyber defense

HBGary Software Products HBGary Responder Enterprise Enterprise host intrusion detection system Integrated with McAfee ePolicy Orchestrator HBGary Responder Professional Investigator’s tool for computer incident response

Ranking Software Modules by Threat Severity Software Behavioral Traits Digital DNA Ranking Software Modules by Threat Severity Software Behavioral Traits

Why Digital DNA? Detect New and Advanced Threats Malware Variants Polymorphic code Memory-Resident Code Rootkits Complements Anti-Virus

Successful Technology Transition HBGary Responder Customers Customer Type DoD Civilian Agencies Government Contractors Fortune 500 Foreign Governments Universities No. of Customers 18 17 5 12 4

Strategic Partners McAfee Guidance Software (Encase) Agilex

Offline Physical Memory Analysis The Core Technology Offline Physical Memory Analysis Rootkit Detection Automated Malware Analysis DNA Digital Alerting & Reporting Offline physical memory analysis: Rebuilding windows without windows All physical to virtual address translations This is The Advantage! Rebuilds underlying undocumented data structures Rebuilds running state of machine “exposes all objects ” Malware cannot hide itself actively

The Core Technology Hook Detection IDT/SSDT/Driver Chains Offline Physical Memory Analysis Rootkit Detection Automated Malware Analysis DNA Digital Alerting & Reporting Offline physical memory analysis: Rebuilding windows without windows All physical to virtual address translations Direct Kernel Object Manipulation Detection Hook Detection IDT/SSDT/Driver Chains These tricks expose themselves by interacting with OS Crossview Based Analysis

The Core Technology Suspicious Code is extracted from RAM Offline Physical Memory Analysis Rootkit Detection Malware Analysis Automated DNA Digital Alerting & Reporting Offline physical memory analysis: Rebuilding windows without windows All physical to virtual address translations Code is Disassembled, broken apart, and analyzed Integration with Flypaper & Flypaper Pro Suspicious Code is extracted from RAM Code Control Flow Graphing

The Core Technology DDNA created for all executable code Offline Physical Memory Analysis Rootkit Detection Automated Malware Analysis DNA Digital Alerting & Reporting Offline physical memory analysis: Rebuilding windows without windows All physical to virtual address translations DDNA created for all executable code A Threat Score is provided for all code Identifies executable code behaviors White & Black List Code /Behaviors

The Core Technology Custom Reports in XML, RTF, PDF, other Offline Physical Memory Analysis Rootkit Detection Automated Malware Analysis DNA Digital Alerting & Reporting Reports can be sent to Enterprise Console Behavioral Analysis Scan and others Custom Reports in XML, RTF, PDF, other Alert on Suspicious Behaviors and coding tricks

Responder Professional v1.3 The only comprehensive memory analysis platform on the market Host Intrusion Detection, Incident Response, Live Windows Forensics, Automated Malware Analysis Enterprise Responder v1.0 - McAfee EPO 4.0 Integration Enterprise Malware & Rootkit Detection & Reporting HBGary / EnCase Enterprise Integration Enterprise solution for remote physical memory analysis Remotely Scan physical memory for suspicious items Advanced Malware & Rootkit Detection

Fastdump Pro v1.3 Flypaper Pro v1.0 Physical Memory Acquisition tool 32 and 64 bit Windows Operating Systems Supports systems with more than 4GB RAM Process Probe Feature Flypaper Pro v1.0 Log Viewer with enhanced logging File system Registry Network Activity Memory Tar Pit

Threat Assessment Engines Integration with McAfee ePO GA March Phase Two Threat Assessment Engines HBGary Portal ePO Console Responder Workstation ePO Server ePO Agents (Endpoints) Schedule HBGary Evidence Server SQL Events HBG Extension HBG WPMA WPMA = Windows Physical Memory Analysis

Fuzzy Search

Behavioral Traits DDNA Trait codes are like this: 04 0F 51 Weight / Control flags Unique hash code Description is held in a database

DDNA Sequences 02 82 78 02 D6 F7 07 CD E3 05 51 87 05 A8 F1 02 FB 99 02 45 5B 02 7C 9A 02 AC CF 00 9F… This is a series of 3 octet trait codes Each trait can have a weight from -15 to +15. + means suspicious – means trusted The entire sequence is weighted by summing the weights of each trait. Discrete weight decay algorithm The summing of weights is performed using an algorithm known as the This algorithm will decay the effects of a repeated weight value over time. +40 points or more in weight = Suspicious or potentially “Evil”

Digital DNA Screenshot