Download presentation
Presentation is loading. Please wait.
1
Improving Enterprise Security by utilizing Memory Forensics, Malware Analysis & Digital DNA
2
Air Force Research Labs Dept Homeland Security (HSARPA)
HBGary Background Founded in 2003 Government R&D Solutions: Enterprise Host Intrusion Detection Live Windows Memory Forensics & Incident Response Malicious Code Detection Automated Reverse Engineering R&D Funding Air Force Research Labs Next Generation Software Reverse Engineering Tools Kernel Virtual Machine Host Analyzer Virtual Machine Debugger Dept Homeland Security (HSARPA) Botnet Detection and Mitigation H/W Assisted System Security Monitor Subcontractor to AFCO Systems Development
3
Problems Today
4
Drive-by Download – Legitimate website
5
White-listing on disk doesn’t prevent malware from being in memory
Internet Browsers PDF, Active X, Flash Office Document, Video, etc… DISK FILE IN MEMORY IMAGE Public Attack-kits have used memory-only injection for over 5 years OS Loader White-listing on disk doesn’t prevent malware from being in memory MD5 Checksum is white listed Process is trusted??
6
Physical Memory Forensics
Core Technology Digital DNA (Behavioral Analysis) Engineering Reverse Code Physical Memory Forensics
7
Why Live Memory Forensics?
Detect Malware that Anti-Virus cannot Detect Malware that Host Based IDS/IPS cannot Verify the “Run-Time” integrity of the system Mission-critical systems % availability Anti-forensic techniques used by bad guys Hax0rs, Cyber spies, Cybercriminals Valuable info in RAM cannot be found on disk Passwords, encryption keys Network packets, screen shots Private chat sessions, unencrypted data, unsaved documents, etc.
8
Useful Information in RAM
Processes and Drivers Loaded Modules Network Socket Info Passwords Encryption Keys Decrypted files Order of execution Runtime State Information Rootkits Configuration Information Logged in Users NDIS buffers Open Files Unsaved Documents Live Registry Video Buffers – screen shots BIOS Memory VOIP Phone calls Advanced Malware Instant Messenger chat
9
Why Memory Analysis is Unique
Better Detection Traditional Forensics & Security Software
10
Perform Malware Analysis
This looks suspicious! Understand Malware: Create Signatures Bolster defenses Attribution Computer Network Defense (CND) Identify a binary’s capabilities Recover Command and Control functions Recover passwords and encryption keys View decrypted packets and files Computer Forensics
11
Why Perform Malware Analysis? I have Anti-Virus….
Goes beyond anti-virus applications… Detection and remediation based on signatures for malware is out dated Answer the following questions: What happened? What is being stolen? How did it happen? How do we clean it up? When did the infection occur? Possibly Who is behind it?
12
Offline Physical Memory Analysis
The Core Technology Offline Physical Memory Analysis Rootkit Detection Automated Malware Analysis Digital DNA Alerting & Reporting Offline physical memory analysis: Rebuilding windows without windows All physical to virtual address translations This is The Advantage! Rebuilds underlying undocumented data structures Rebuilds running state of machine “exposes all objects ” Malware cannot hide itself actively
13
The Core Technology Offline Physical Memory Analysis Rootkit Detection
Automated Malware Analysis Digital DNA Alerting & Reporting Offline physical memory analysis: Rebuilding windows without windows All physical to virtual address translations Direct Kernel Object Manipulation Detection Hook Detection IDT/SSDT/Driver Chains These tricks expose themselves by interacting with OS Crossview Based Analysis
14
The Core Technology Offline Physical Memory Analysis Rootkit Detection
Automated Malware Analysis Digital DNA Alerting & Reporting Offline physical memory analysis: Rebuilding windows without windows All physical to virtual address translations Code is Disassembled Integration with Flypaper & RECon Code is extracted from RAM Code Visualization
15
The Core Technology Offline Physical Memory Analysis Rootkit Detection
Automated Malware Analysis Digital DNA Alerting & Reporting Offline physical memory analysis: Rebuilding windows without windows All physical to virtual address translations ALL Memory is Scanned A Threat Score is provided for all code Code Behavior Identification White & Black List Code /Behaviors
16
The Core Technology Offline Physical Memory Analysis Rootkit Detection
Automated Malware Analysis Digital DNA Alerting & Reporting Reports can be sent to Enterprise Console Behavioral Analysis Scan and others Custom Reports in XML, RTF, PDF, other Alert on Suspicious Behaviors and coding tricks
17
Advantages of our approach
Forensic Quality Approach Analysis is 100% offline Like Crash Dump Analysis – No Code Running! Automated Reverse Engineering Engine Digital DNA™ detects zero-day threats 5+ years of reverse engineering technology AUTOMATED! No Reverse Engineering expertise required
18
HBGary Solutions
19
Memory Forensics and Incident Response Products
20
Stand Alone Products 1 Analyst : 1 Machine
Responder Professional Comprehensive physical memory and malware investigation platform Host Intrusion Detection & Incident Response Live Windows Forensics Automated Malware Analysis Computer incident responders, malware analysts, security assessments Digital DNA Responder Field Edition Comprehensive Memory Investigation platform. Geared towards Law Enforcement and computer forensic investigators Basic Malware Analysis
21
HBGary Enterprise Malware Detection
22
Enterprise Solutions 1 Analyst : N machines
Enterprise Digital DNA – McAfee EPO & Verdasys Enterprise Malware/Rootkit Detection & Reporting Distributed Physical Memory Analysis with Digital DNA Rapid Response Policy Lockdown Enterprise Responder – Guidance Software Encase Enterprise Solution Suspicious & Malicious Code Detection
23
Integration with McAfee ePO
Available Now! ePO Agents (Endpoints) Digital DNA Module Server SQL HBGary Server Module ePO Console Responder Workstation Schedule Events HBGary Portal WPMA = Windows Physical Memory Analysis
24
Digital DNA™ for Enterprise Malware Detection, Diagnosis and Response
25
Design Goals of Digital DNA
Rapidly predict and identify: Malicious behaviors inside of running applications in memory and the pagefile Identify DNA (traits) of the malware There are 2500 traits currently Grouped into six behavioral categories
26
Ranking Software Modules by Threat Severity Software Behavioral Traits
Digital DNA Ranking Software Modules by Threat Severity 0B 8A C2 05 0F F B ED C D 8A C2 0F 51 0F 64 Software Behavioral Traits
27
B[00 24 73 ??]k ANDS[>004] C”QueueAPC”{arg0:0A,arg}
What’s in a Trait? 04 0F 51 B[ ??]k ANDS[>004] C”QueueAPC”{arg0:0A,arg} The rule is a specified like a regular expression, it matches against automatically reverse engineered details and contains Boolean logic. These rules are considered intellectual property and not shown to the user. Unique hash code Weight / Control flags The trait, description, and underlying rule are held in a database
![B[ ]k ANDS[>004] C QueueAPC {arg0:0A,arg}](http://slideplayer.com./slide/12045781/69/images/27/B%5B+%5Dk+ANDS%5B%3E004%5D+C+QueueAPC+%7Barg0%3A0A%2Carg%7D.jpg "What’s in a Trait 04 0F 51. B[ ]k ANDS[>004] C QueueAPC {arg0:0A,arg} The rule is a specified like a regular expression, it matches against automatically reverse engineered details and contains Boolean logic. These rules are considered intellectual property and not shown to the user. Unique hash code. Weight / Control flags. The trait, description, and underlying rule are held in a database.")
28
Digital DNA goes beyond MD5
In memory, once executing, a file is represented in a new way that cannot be easily be back referenced to a file checksum Digital DNA™ does not change, even if the underlying file does Digital DNA is calculated from what the software DOES (it’s behavior), not how it was compiled or packaged
29
In memory, traditional checksums don’t work
DISK FILE IN MEMORY IMAGE 100% dynamic Copied in full Copied in part OS Loader In memory, traditional checksums don’t work MD5 Checksum is not consistent Digital DNA remains consistent MD5 Checksum reliable
30
Same malware compiled in three different ways
DISK FILE IN MEMORY IMAGE Same malware compiled in three different ways OS Loader MD5 Checksums all different Digital DNA remains consistent
31
Digital DNA defeats packers
IN MEMORY IMAGE Packer #1 Packer #2 Decrypted Original OS Loader Digital DNA defeats packers Starting Malware Packed Malware Digital DNA remains consistent
32
Digital DNA detects toolkits
IN MEMORY IMAGE OS Loader Digital DNA detects toolkits Malware Tookit Different Malware Authors Using Same Toolkit Toolkit DNA Detected Packed
33
Digital DNA Screenshot
35
Fuzzy Search
36
5,000 Malware is sequenced every 24 hours
37
Over 2,500 Traits are categorized into Factor, Group, and Subgroup.
This is our “Genome” We expect to have 10,000 Traits by end of year
38
Demo Tonight “Tigger” Last week stole $500,000 from one of our financial customers
39
Client Testimonials
40
Client Testimonial 1 of the Largest Pharmaceutical Co’s
Under attack every day Uses Enterprise Anti Virus Sends malware to vendor Waits for signature 1-8 hours - Uses Responder Pro – Responder provides immediate critical intelligence to secure the network and mitigate the threat to the data
41
Client Testimonial 2 1 of the largest Entertainment Co’s
Under attack every day & Uses Enterprise Anti Virus When a machine is compromised, they perform various levels of remediation with their antivirus vendor signatures. Once the machine is determined clean by the AntiVirus software, they use our technology to verify the machine is no longer infected… Findings: about 50% of machines are still infected…
42
Conclusion Improve Enterprise Security Posture With
Memory Forensics & Malware Analysis Memory Forensics can detect malicious code that nothing else can… Memory Forensics is not only for Incident Response Memory Forensics can be used during Security Assessments too Malware Analysis should be brought in house Malware Analysis can help you… minimize costs and impact. identify the “Scope of Breach” mitigate the threat before you have a anti-virus signature
43
Future at HBGary Development Initiatives Webinar Series Partnerships
Recon – Kernel Debugger for tracing malware at runtime Ease of Use – Responder Pro Digital DNA - mapping malware genome Webinar Series Memory Forensics Responder Pro with Digital DNA Rapid Malware Analysis to mi Partnerships Guidance Software McAfee Verdasys F-Response Access Data some others announced soon!
44
Questions? Thank you very much
Similar presentations
