HBGary :: Blogs

Inside the Malware Matrix: Understanding the Complexity of Today's Malware

Inside the Malware Matrix: Understanding the Complexity of Today's Malware

by Kathy Wang

As a malware researcher, I have been studying malware for over 10 years. A lot has changed in the malware landscape within the last decade, but one thing remains constant: we are still dealing with the challenge of detecting and responding to malware. Our detection heuristics (i.e., experience-based techniques for problem solving, learning, and discovery) may have shifted from mostly signature-based to anomaly-based to dynamic system inspection; but fundamentally, we are still not able to detect at rates near 100%.

What is it about the ever-evolving malware landscape that makes malware detection challenging? Besides the fact that we’re essentially working against adversaries that are engaging in an arms race, there are solid technical reasons why malware detection is not an exact science. The human factor could be a whole separate discussion, as could software vulnerability mitigation, so we will focus on the technical issues of detection.

The delay of signature/heuristics development combined with the hundreds of thousands of new variants of malware introduced each and every day underscores why malware detection is such a daunting task. Malware aimed at evading technological detection makes a malware analyst’s job extremely difficult. As a result, the process of signature and/or heuristic development is slowed, adversely affecting the efficacy of the detection engine.

As we discuss these challenges, we will begin by examining a few malware types that specifically aim to evade detection:

· Temporal malware waits an arbitrary amount of time before execution. This “set time” can be pre-programmed, or automatically generated in such a way that it is still known to the attacker. Although the obvious technique on the detection side is to advance the target system time, this is not as straightforward as it might seem. For example, some malware will require advancing system time by an absurdly lengthy period, which will also make it easier for the malware to sense an abrupt change in system time, in addition to possibly missing some behaviors that can only take place during certain time durations. There has been some research conducted in this area, but the fundamental problem remains that there is no perfect solution, so the approach taken by most vendors is to detect the largest number of malware classes possible.

· User-interaction malware will not execute unless there is an indication that an actual target user is “activating” the malware. Malware researchers striving to identify and characterize user interaction-based malware will hit roadblocks while attempting to get the malware to execute. There are methods for detection engines to interface with system kernels and detect signals indicating a “wait” for user interaction, and execute accordingly. This method, however, is not perfect and can result in missed detection.

There is another tangential user interaction case. If we encounter a “drive by” malware download, the malware may assess whether our web browser is compatible. For example, if the malware is targeting the Internet Explorer (IE) browser, the malcode will check whether the JavaScript environment is IE’s proprietary JavaScript engine, or if the JavaScript engine is an open-source one. The latter is likely to be deployed by malware researchers. In this scenario, the malware researcher will just get served benign content.

· Lastly, VM-aware malware is coded to abort within a known virtual machine system. From a defensive perspective, this can be a fringe benefit. As our infrastructures become increasingly virtualized, this type of malware can be marginalized. Sadly, our adversaries have also realized this, and VM-aware malware is few and far between. Even so, researchers are always interested in detecting as much malware as possible. Technical approaches to detecting VM-aware malware have included heuristics to detect malware that assess the environment (e.g., scanning for certain Dynamic Link Libraries, or DLLs) to determine whether it is a virtual machine environment. Some approaches have even included the creation of custom hypervisors, that malware fail to detect due to their proprietary nature.

I am often asked, “How can I protect my infrastructure as best as possible?” I recommend taking the common sense approach, and deploying multiple layers of security. What a network perimeter-based device cannot detect, a host-based device may catch, and vice versa. Do not rely on one class of products to protect your entire infrastructure. Although user training is often suggested, research has shown that this is not as effective as we’d like to believe. Try to structure your network to allow as few decisions to be made by end users as possible on whether to execute potentially malicious document files and URLs.

Design and build your security controls with the assumption that the infrastructure has already been compromised. That way, you are focusing on solutions and plans that rapidly detect and remediate the breaches, rather than simply assuming flawless security. Worst case, you will have the resources and plans to deal with an eventual breach; best case, you will be pleasantly surprised if no breach has occurred… yet.

Kathy Wang is the Director of Research and Development within ManTech's Cyber Defense Solutions Group. Kathy is an internationally-recognized malware expert, who has researched, developed, evaluated, and operationalized various solutions for detecting and preventing client-side attacks used by advanced persistent threats (APT), as they target common platforms (e.g., browser, email, mobile phones). She is a frequent speaker and panelist at conferences, including DEFCON, RSA, RAID, GFIRST, ShmooCon, AusCERT, and is a co-author of a book (Beautiful Security).

Posted by HBGary Blogger on March 20, 2013 at 8:30am

SCADA Security: If it was easy, it would already be done…

I’ve had the pleasure of working with the editors and several of the contributors of the Handbook of SCADA/Control Systems Security for over four years, and in that time have had many enlightening and intellectual discussions about the challenge of securing industrial control systems. The cast of characters with an interest in tackling this problem run the gamut from elected officials during congressional hearings all the way down to the plant operator whose purpose in life is to keep the gauges between the green and red lines. The topic of SCADA security has received a great deal of press within the past few years, specifically following the discovery of Stuxnet. I used the word “discovery” and not detection to underscore an important point: it came to light after it’s payload had already begun to impact operations within its intended target. Research may have demonstrated the “How”; speculation abounds regarding “Who” and “Why”, and the “When” could be summed up “as needed”.

With all of the FUD (Fear, Uncertainty, Doubt) being circulated with respect to critical infrastructure, the idea for a book rooted in reality began to take shape. Bob and Jake volunteered to spearhead the project and shaped the content of the book into what it would eventually be published as. What this book offers the reader is a glimpse from inside the industry through the lens of a plant technician. I can remember one of my first conversations with Jake Brodsky in which he described that water could not be stopped, that it was merely being directed and everything they had in place was to manage the movement. Moving enough water to flood Georgetown, one might imagine the reliability and safety built into these systems. Simplistic in design and heavy on redundancy. In the book the reader will be astonished to learn the Operating Systems still in use in plant operations today. They may read it and say, “Well, therein lies the problem!!!” and they would be partially correct. This is where the book will help the reader see the complexities of the challenge and perhaps even begin to look past the world of vulnerabilities, patches, upgrades and the like.

You may be asking yourself at this point, “Why would a Malware/Forensic guy be blogging about a book on SCADA Security?!” Aside from thinking it is a good read, I jumped at the chance when asked by the editors to write the chapter entitled Threat Vectors. HBGary sees our fair share of malware, everything from drive-by scrapers to triple obfuscated covert channels. While I may not be intimately familiar with the code of a historian server, I am pretty confident it rides atop an operating system that I am familiar with and have seen countless payloads for. Our perceptions about things are based upon our own experience. With respect to control systems, having experienced incident response/malware analysis within a refinery, an electric generation plant, and a water treatment facility, my perception is that of fragility. As long as it is not touched, it won’t break. In the connected world we now live in, however, systems we’d never imagine being accessible do indeed answer SYN-ACK. When these legacy systems do, the art of the possible is left to intention.

If you’re looking for a book that dives into the MODBUS protocol, explains the ladder logic of a PLC, outlines how remote terminal units function, or what applications are used for plant operations, this is not your book. If you are looking to be enlightened about SCADA security, grab the book and read the chapters written by people who are not of your chosen profession. IT Security folks can stand to learn from Process Control Engineers; Process Control Engineers can stand to learn from a Malware/Forensic guy; Malware/Forensic guy can stand to learn about Instrumentation and Metrics. Hmmm, TLDR…

Jim Butterworth is the CISO of HBGary

Posted by HBGary Blogger on March 8, 2013 at 4:27pm

Digital DNA: Mapping the Malware Genome

Duqu, Flame, Red October — all high-profile cyber threats, all targeting extremely sensitive systems and data, and all responsible for damages in the millions or billions of dollars. But that’s not all they have in common.

All of them could be detected by HBGary Digital DNA -- the automated reverse engineering and behavioral analysis technology that detects unknown threats within physical memory, without signatures, and powers HBGary Active Defense and Responder Pro.

Translation: Digital DNA is so good at detecting malware that it catches the most advanced threats before the rest of the world is even aware of them. In fact, there hasn’t been a notable piece of malware since the release of Digital DNA in 2009 that it hasn’t uncovered.

At RSA Conference 2013, we will unveil a new poster that illustrates how Digital DNA breaks down malicious behaviors of the ZeroAccess rootkit. Please visit us at HBGary booth #2650 to pick up a copy of the poster or, for a sneak peek, download it here.

Posted by HBGary Blogger on February 22, 2013 at 11:21am

Be Alert, Be Watchful, Be Vigilant

Be Alert, Be Watchful, Be Vigilant

by Marc Washington

As a Cyber Security Operations Chief, I see that organizations are targeted daily by internal and external national and foreign entities who want to steal proprietary information. These attackers are not looking for your banking information; they are trying to get sensitive information about your organization. No matter what safeguards and defenses are in place, there is one source they can count on getting what they want—and that’s you, the employee.

One method adversaries use to access your organizations’ sensitive data is through a method called spear-phishing. Spear-phishing is an e-mail spoofing fraud attempt that targets people and organizations, seeking unauthorized access to confidential data. Since spear-phishing targets the individual your organization needs your help to mitigate this threat that technology is having a challenge protecting against.

Cyber attackers are extremely persistent. Even when facing substantial defenses, attackers can always use spear-phishing to attempt to get around them. Spear-phishers gather information about your job, social networks, often publicly available information, and even stolen data from other infected computers. Armed with this information, attackers can create remarkably authentic-looking e-mails to trick you into clicking on a link or opening an attachment that can instantly get them around our defenses and grant access to all of your organization’s data. On the subject of social networking, one piece of advice – please don’t post anything that you wouldn’t want everyone in the world to see. Just because they don’t, doesn’t mean they can’t.

So why should you care? Obviously, you don’t want anyone going through your personal data and, of course, you want to protect your company’s data. But we must look at the bigger picture. Nation state sponsored attackers don’t just try to steal information from you and your company. They steal data from hundreds and thousands of other people, and dozens of companies, defense contractors and government agencies. These cyber-enemies can then aggregate all this Sensitive But Unclassified (SBU) and For Official Use Only (FOUO) data, reconstruct entire projects (for example, sensitive military research and development data), and then plot to neutralize or thwart our strategies and technologies.

Armed with the information they have harvested through you and others, these enemies can now accelerate or replicate U.S. projects in weeks rather than spending years of arduous and expensive research to create their own technologies. They are not only doing damage to your organization, but with your unintentional help, they can use this data to pose a threat to national security.

By learning to recognize spear-phishing e-mails, you can help fight this threat even when they appear to be from someone you trust and relate to a subject that applies directly to you.

Here is an example of what a spear-phishing e-mail might look like:

Here are clues you can look for:

· Misspellings and bad grammar

· Beware of links in e-mail – DO NOT OPEN THEM!

· E-mail with a sense of urgency

· E-mail attachment was not expected – DO NOT OPEN IT!

· Work related e-mail from a Yahoo or Gmail account

· Time the e-mail sent (e.g. people working during non-work hours)

If you receive an e-mail that you suspect to be bogus, do not click on any links or open any attachments. Although an icon may look innocent, it may be disguised and by clicking it, you could execute a program in your computer’s background that sends information from your computer to an undisclosed recipient without your knowledge. A good technique to determine where a link will take you is to first hover over the link itself before you click it – it will show true destination for that link. If it looks suspicious and you are on your home computer, delete the e-mail immediately. If you are at work, contact your organization’s IT department for assistance.

It is good practice to visually scan every e-mail before you read it, looking for clues that will help you determine whether it is a valid e-mail deserving your attention or not. We all need to be vigilant when it comes to our e-mail inboxes: remotely (i.e, laptops, iPhones, smartphones, any mobile device), at home, and at the office.

Marc Washington is currently ManTech's SOC chief and has built a successful 14 year career by developing and deploying enterprise-wide cyber security strategies for effectively managing and deploying Security Operation Centers (SOCs) and Computer Incident Response Teams (CIRTs) for the federal government and private corporations. His technical expertise is also called upon to develop the Computer Network Defense (CND) strategies and resolve problems in existing cyber security programs.

Posted by HBGary Blogger on February 20, 2013 at 9:00am