1. Dealing with Malware By: Brandon Payne Image source: TechTips.com

2. What is Malware? Malicious Software Viruses Worms Trojans Spyware/Adware Over 1 million known unique malware

3. Antivirus Software Widespread Purpose to make us safe Two main parts – Detection – Removal

4. Detection Use of honeypots Signature based Family signature Heuristics Human involvement

5. Honeypots Numerous networked together virtual systems Limited protection – no firewall Can run any OS Allowed to talk freely on virtual network Protocols: – HTTP – FTP – IRC – DNS – Drive sharing – Email and packet routing

6. Honeypots, cont. Virtual machine runs custom monitoring and control software Snapshot at creation Physical machine runs DHCP server, collects data from monitoring software

7. Signatures Based on string – Machine Code Bytes Sometimes behavior based Stored in database – Stored in order of area affected (e.g. boot sector or.EXE) Sent to users as updates

8. Family Signatures “Families” of malware – Malware tweaked slightly and sent on its way Similar or the same signature Often add padding for confusion

9. Heuristics Looks for instructions and commands within programs that are not usually found in applications Two methods: – Weight-based – Rule-based

10. Weight-Based Antiquated, not used much anymore Assigns a weight to processes depending on potential security threat If a certain weight is reached, sounds an alarm

11. Rule-Based Extracts certain ‘rules’ from programs Compares these to rules in database known to cause issues If a match is found, alarm triggered Capable of detecting encrypted viruses by looking for specific behavior – Initializing a counter – Memory reads which depend on a pointer

12. Human Involvement Users Researchers – Software can’t solve on its own – Requires intimate knowledge of programming languages and OS

13. Removal Puts detection to use Updates sent out daily, weekly, etc. Requires scanning

14. Scanning Needs to check EVERYWHERE Several techniques to optimize – Location specific i.e. boot sector or macros – File location Signature only consists of a part of code which has a usual location

15. Questions?