Analyzing Malware Behavior

Analyzing Malware Behavior
The Secret to a More secure World

Fact Malware is the single greatest threat to enterprise security today Existing security isn’t stopping it Over 80% of corporate intellectual property is stored online, digitally

Scale Over 100,000 malware are released daily
Automated malware infrastructure Signature-based security solutions simply can’t keep up The peculiar thing about signatures is that they are strongly coupled to an individual malware sample More malware was released in the last year than all malware combined previous XXXX million unique samples in 2009

Economy Russian Mafia made more money in online banking fraud last year than the drug cartels made selling cocaine An entire industry has cropped up to support the theft of digital information with players in all aspects of the marketplace

Espionage Nation states are actively targeting one another
China gets the most press, because they get caught the most Corporations participate in industrial espionage as well TODO, reference some recent incidents

Not an antivirus problem
Malware isn’t released until it bypasses all the AV products Testing against AV is part of the QA process AV doesn’t address the actual threat – the human who is targeting you AV has been shown as nearly useless in stopping the threat AV has been diminished to a regulatory checkbox – it’s not even managed by the security organization, it’s an IT problem

The True Threat Malware is a human issue
Bad guys are targeting your digital information, intellectual property, and personal identity Malware is only a vehicle for intent Theft of Intellectual Property Business Intelligence for Competitive Advantage Identity Theft for Online Fraud

The human is continuous and evolving
If you detect a malware that is part of an targeted operation and you remove it from the computer, the risk has not been eliminated – the bad guys are still operating Tomorrow the bad guy will be back again You have not shut down the operation Remember hot staging modules

Anatomy of an Operation
You must understand that an ongoing operation is underway – this involves one or more primary actors, and potentially many secondary actors TODO elaborate on this, diagram?

Example Operation Bad Guy is using (SE) whalephishing to gain a foothold into a specific physical network Bad Guy is using SE to track dissidents TODO add example of outlook guid attack

Risk Intelligence

Risk Intelligence Who is targeting you? What are they after?
Have they succeeded? How long have they been succeeding? What have I lost so far? What can I do to counter their methods? Are there legal actions I can take?

Risk Intelligence (II)
Requires that you combine many small facts into a big picture More information means better analysis I refer to specific attackers as “threats” – information regarding a specific attack is called “threat intelligence”

Threat Intelligence within Enterprise
Locations where threat intel can be gathered Endpoint, physical memory snapshot Multiple endpoints will be involved, need to view them as a group Endpoint, live-state forensics, ongoing monitoring Message Archives Netflow / Packet Archives

Threat Intelligence External to Enterprise
Locations where intel can be gathered Dropsite where IP is being dropped Command and Control Server Designed to survive takedowns Hot staged failovers likely Exploit Pack Server Large Traffic Gateways Possible subscriptions to various intel feeds available Cooperation likely

Attribution Challenges
Lack of gov. intervention No consequences Russia is a crime state China turns a blind eye

Attribution Challenges
Lack of global LE cooperation No sharing of data ICANN and Registrar slow to respond to takedown requests A lot of good data is classified and not available for commercial consumption

Primary – what is the target?
What is being targeted IP, identity, logins to google? File searches for source code? XLS documents? Who C-level execs? Developers? Falun Gong?

Primary – Who is running to op?
Country of origin Is the bot designed for use by certain nationality Geolocation of IP is NOT a strong indicator However, there are notable examples Is the IP in a network that is very unlikely to have a third-party proxy installed? For example, it lies within a government installation

C&C servers C&C servers are not usually designed to proxy route through infected end-nodes The IP geolocation is more useful in this case Netblock lookups are a decent starting point If the C&C leads to a broadband consumer network in the US, this is more likely to be an exploited machine that performs proxy routing – IP geolocation is not useful It may be possible to get LE or the broadband provider to help ‘trace back’ in this case (multihop will become a problem)

Forensic Marks left by Actors
Forensic marks occur at all points where software development occurs They also occur in less obvious places All points where binary is translated into new forms (parsed, packed, packaged, etc) These forensic marks may identify the original developer of the software Obviously, only certain actors leave marks

The Global Theatre of Malware Actors
Follow the Money, Follow the Motive

A Global Theatre There are thousands of actors involved in the theft of information, from technology developers to money launderers Over the last decade, an underground economy has grown to support espionage and fraud This “malware ecosystem” supports both Crimeware and e-Espionage

Payment system developer
$500+ Implant Vendor $1,000+ Exploit Pack Vendor $10,000+ for 0-day Exploit Developer $10,000+ for 0-day Rootkit Developer Rogueware Developer Back Office Developer $1000+ Wizard Bot Vendor eGold ~4% of bank customers Payment system developer Country that doesn’t co-op w/ LE Secondary atm Keep 10% Victims Small Transfers A single operator here may recruit 100’s of mules per week $5,000 incrm. Drop Man Account Buyer Affiliate Botmaster ID Thief Endpoint Exploiters Keep 50% $ per 1000 infections PPI Forger Cashier / Mule Bank Broker Sells accounts in bulk Country where account is physically located $5.00 per $50 Keep 10%

Cash is not the only motive
State sponsored (economic power) Stealing of state secrets (intelligence & advantage) Stealing of IP (competitive / strategic advantage – longer term) Infrastructure & SCADA (wartime strike capable) Info on people (not economic) i.e., Chinese dissidents

TODO – image of nation states that have cyber capabilities
Not as much detail available on this

TODO – image of nation states that use malware to spy on their own citizens, both domestic and abroad China ref: GhostNET Ref: openNET

Crimeware and the State
Using crimeware collected from the underground makes it harder to attribute the attack, since it looks like every other criminal attack There is no custom code that can be fingerprinted

Chinese Cyber Blackwater
Citizen cyber soldiers Hackers being directed at specific targets & missions by the government Because this model does not have much structure and oversight, Chinese attacks are somewhat sloppy No use of cutouts – direct C&C to China Use of poorly coded bot systems (i.e., GhostNET)

Crimeware Affiliate Networks
Grown out of older adware business models TODO – some more focused research on current c.a.n.’s

Pay-per-install.org

InstallsCash Pays per 1000 infections
*

YA!Bucks 75% profit share Bi-weekly payouts
*

Earning4u Pays per 1,000 infections
*

CaaS TODO: Crimeware as a Service

Fingerprinting Actors within the Theatre

Digital Fingerprints Several actors in the underground economy will leave digital fingerprints What is represented digitally Distribution system Exploitation capability Command and Control Payload (what does it do once its in)

Same malware compiled in three different ways
DISK FILE IN MEMORY IMAGE Same malware compiled in three different ways OS Loader MD5 Checksums all different Code idioms remains consistent

In-memory analysis tends to defeat packers
IN MEMORY IMAGE Packer #1 Packer #2 Decrypted Original OS Loader In-memory analysis tends to defeat packers Starting Malware Packed Malware Unpacked portions remains consistent

Toolkits and developer signatures can be detected
IN MEMORY IMAGE OS Loader Toolkits and developer signatures can be detected Malware Tookit Different Malware Authors Using Same Toolkit Toolkit Marks Detected Packed

Language Native language of the software, expected keyboard layout, etc – intended for use by a specific nationality Be aware some technologies have multiple language support

Actor: Endpoint Exploiter
Endpoint Exploiters $ per 1000 infections The exploiter of the end nodes, sets up the XSS or javascript injections to force redirects Newcomers can learns various attack methods from their PPI affiliate site (mini-training) These are generally recruited hackers from forums (social space) The malware will have an affiliate ID “somesite.com/something?aflid=23857  look for potential ID’s – this ID’s the individual endpoint exploiter

Link Analysis URL artifact Unique Affiliate ID’s Codenamed Botmaster
C&C Fingerprint Endpoints Link Analysis

Actor: Bot Master Owns the box that accepts inbound infection requests, pays out by ID Pays for numbers of collected credentials Collect stolen identities and resell Accounting system for all successful infections Pay-per-infection business model This implies a social space Configuration settings on server will be reflected in client infections (additional resolution to differentiate multiple actors using the same bot technology) Version of bot system offers more resolution, and potential indicator of when it was stood up The Bot Master will have a preference for a particular bot control system – can be softlinked to this actor

Actor: Account Buyer Buy stolen creds from the collectors
Use stolen credentials to move money out of victim bank accounts These guys touch the victim accounts Source IP of transaction, Use of TOR / HackTOR, Use of botnet to redirect, etc. This part is audited in your network logs, so … Multiple attacks by the same person are likely to be cross-referenced Not a very strong fingerprint

Actor: Mules & Cashiers
Accept stolen money into accounts in the native country of the subverted bank and redirect that money back out into foreign accounts These transactions must stay below trigger levels $5,000 or less These actors do not leave forensic marks on the malware chain Banking records only

Actor: Wizards Move E-Gold into ATM accounts that can be withdrawn in the masters home country Will take a percentage of the money for himself This actor does not leave a forensic mark on the malware chain Banking records typically don’t even work here, as the transaction has already been processed thru e-Gold

Actor: Developers Sell bot systems for four figures
$4,000 - $8,000 with complete C&C and SQL backend Sell advanced rootkits for low five figures Possibly integrated into a bot system Possibly used as a custom extension to a bot, integrated by a botmaster, $10,000 or more easily for this All of this development is strongly fingerprinted in the malware chain

The developer != operator
The developer may not have any relation to those who operate the malware The operation is what’s important We need to form a complete picture of the ‘operation’ – who is running the operation that targets you and what their intent is

Link Analysis We want to find a connection here C&C Fingerprint
Botmaster URL artifact Affiliate ID Developer Protocol Fingerprint Endpoints Developer C&C products Link Analysis

Softlinking into the Social Space
Where is it sold, does that location have a social space? If it has a social space, then this can be targeted Forum, IRC, instant messaging Using link-analysis, softlink can be created between the developer of a malware product and anyone else in the social space Slightly harder link if the two have communicated directly If someone asks for tech support, indicates they have purchased If someone queries price, etc, then possibly they have purchased

Link Analysis Software Author Software Author Social Space

Working back the timeline
Who sells it, when did that capability first emerge? Requires ongoing monitoring of all open-source intelligence, presence within underground marketplaces Requires budget for acquisition of emerging malware products

Software Author Social Space i.e., Technical Support Query made AFTER version 1.4 Release Use of timeline to differentiate links Link Analysis

Actor: Vuln Researchers
Paid well into the five figures for a good, reliable exploit $20,000 or more for a dependable IE exploit on latest version Injection vector & activation point can be fingerprinted Method for heap grooming, etc Delivery vehicle

Fingerprinting Malware Distribution Systems

Malware Distribution Systems
, Instant Message, and Exploited Web Boobytrapped documents Rogueware & trojan downloads Clientside exploits Injected javascript Command and Control server

Freed Memory (endpoint)
Freed memory will still contain evidence Blocks of obfuscated javascript that can be tied to specific exploit packs (redirectors) Leftover HTML remnants of subverted websites URL paths to the exploit server itself These are key to identification TODO: put a few examples here

Spearphishes Email archives may contain boobytrapped documents
These can be detonated with a deep tracer attached (packet sniffer at a minimum, REcon if you’re really hard core, CW sandbox & Norman also options)

Detonate & Trace Getting the exploit to detonate allows you to observe the secondary download step Malware payload will be sent to you, command and control IP will be established, communication with exploit server and C&C can be sniffed

Boobytrapped Documents
This is the current trend NOT COMPLETE

Spear-phishing / Whaling
Single most effective attack today Focused attacks Human is involved in crafting the text .DOC Tell stories about Penny

Social Networking Space
Joe Social Networking Space Injected Javascript credentials X:URL POST RBN NOT COMPLETE

Trap Postings TODO

Injected IFrames TODO

Subverted Websites TODO

Subverted Download Sites
TODO

Rogueware 35 million computers infected every month with rogueware*
Many victims pay for these programs, $50-$70, and stats show bad guys are making upwards of $34 million dollars a month with this scam* Many are fake anti-virus scanners *

WinAntivirusPro

SaveKeep

Exploit Packs… No skill needed, buy and use auto-exploiter systems
Highly effective These types of systems are extremely dangerous Consider that Islamic Terrorists, who until now haven’t had strong technical abilities in cyber, can now just buy an attack kit for $1000

Eleonore (exploit pack)

Tornado (exploit pack)

Neosploit (exploit pack)

Napoleon (exploit pack)

Siberia (exploit pack)
Note: a different version of Napoleon

Advanced Pack (exploit pack)

Fingerprinting Command and Control

TODO: Njinx web server

IRC C&C IRC control channel for a DDOS botnet
Most of the C&C has moved to the web.

Triad (botnet)

ZeuS (botnet)

Fragus (botnet)

Fingerprinting Malware Implants

TODO: be sure to mention server-side polymorphism

Social Networking Space
Joe Social Networking Space Steve’s BLOG Fred X:URL RBN NOT COMPLETE POST

NOT COMPLETE Joe Fred BIGCHEMICAL, INC. Outlook Email Password
Generic stored passwords NOT COMPLETE

Drop-point is in Reston, VA in the AOL netblock
NOT COMPLETE

All the file types that are exfiltrated
NOT COMPLETE

NOT COMPLETE $ RBN Joe Fred BIGCHEMICAL, INC. Covert Channel
SOURCE COMPUTER USERNAME VICTIM IP ADMIN? How big? How many systems per day? HD SERIAL NUMBER OS VERSION TIMESTAMP DIRECTORY WHERE FILE WAS FOUND NOT COMPLETE FILE (COMPRESSED)

NOT COMPLETE Legit HTTP $ “AdClick” ?? Some Webpage Internet Explorer
Fred INJECTED CODE $ Completely effective at exfiltrating data without detection “AdClick” ?? NOT COMPLETE

Staged reinfection server
Machine that gots the APT, in memory, on disk Infector machine in the same network, memory resident only Just re-infects the endnode This machine has no on-disk code

Poison Ivy (implant)

CRUM (protector)

Advanced Persistent Threat

Difference between APT and Banking Malware
Banking malware targets stored digital identity and authentication tokens Bank transaction systems (internal, funds transfers) A lot of money is leaving the banks Manipulate trades on the markets Manipulate the digits on the trading boards

Polymer Materials Group
Joe BIGCHEMICAL, INC. Fulfillment Fred BadGuy Polymer Materials Group Sally Bob Adam Waits for Fred to be AFK NOT COMPLETE

Polymer Materials Group
Joe RBN Fred BIGCHEMICAL, INC. Polymer Materials Group Sally Bob Adam Priceless $ NOT COMPLETE

APT Operational Analysis
These info ops have a fingerprint Bad guys have a specific way they write code They have specific targets in mind Stealing XLS or PDF files Preference for a particular bot framework These fingerprints will be specific to an operation

Each individual fingerprint, when viewed alone, may only identify the original developer of the software When all fingerprints are viewed together, a more complete picture forms about the ‘operation’ – who is running the operation that targets you

Do they pack their software Do they rename DLL’s to hide in plain site? Which toolkit do they use Did they bypass the accounting department and go straight for the developers? What triggers a malware to wake up? How was the payload delivered? Spearphish attachment?

Conclusions

Analyzing Malware Behavior

Similar presentations

Presentation on theme: "Analyzing Malware Behavior"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Analyzing Malware Behavior

Similar presentations

Presentation on theme: "Analyzing Malware Behavior"— Presentation transcript:

Similar presentations

About project

Feedback