Maintaining a Malware Collection

Loading...

Flash Player 9 (or above) is needed to view presentations.
We have detected that you do not have it on your computer. To install it, go here.

0 comments

Post a comment

    Post a comment
    Embed Video
    Edit your comment Cancel

    Favorites, Groups & Events

    Maintaining a Malware Collection - Presentation Transcript

    1. Maintaining a Malware Collection Dr. Vesselin Bontchev, anti–virus researcher FRISK Software International Thverholt 18, IS-105 Reykjavik, ICELAND National Laboratory of Computer Virology Bulgarian Academy of Sciences Acad. G. Bontchev Str., Bl. 2, 1113, BULGARIA E–mail: [email_address]
    2. Introduction
      • The Naïve Idea of AV Product Testing
        • Get a large set of files from somewhere
        • Call it a “virus collection”
        • It’s good if most scanners report most of the files as “something”
        • It’s even better if some files are not reported by some or all of the popular scanners as anything
        • Run an on-demand scanner on the set
        • Classify the results by some criteria (e.g., number of detected objects) and publish them
    3. Let’s Concentrate on the “Collection” Part
      • Face It:
        • Most of the collections you can get easily consist mostly of crap (Vx)
        • Even the good collections contain some crap (AV)
        • Or are inadequate (WLO)
      • So
        • Analyze the contents and remove the crap
        • Replicate the viruses
        • And only then use the result for testing!
    4. Analyzing the Contents
      • Unpack the Archives
        • Needs LOTS of disk space!
        • Sometimes there are nested archives
        • And/or encrypted ones (“infected”, “virus”, etc.)
        • The file extensions are misleading! (Or non-existent. Morons.)
        • Some files need decoding
        • Basically – look at the damn things! Do not assume
    5. More Analyzing
      • Remove the Duplicates
        • Of which there are LOTS! Both in the same collection and across collections
        • You need a duplicate file locator
          • The commercial ones are crap! Big, slow, unreliable and inadequate
          • So, write your own
          • Beware: with the huge number of files in the contemporary collections, CRC-32 is not adequate as a hash function (due to collisions). Use MD4 (not MD5, MD2 or SHA, because MD4 is faster and is secure enough)
    6. Even More Analyzing
      • Remove the Corrupted Files
        • Zapped beginnings
        • Entry points going nowhere
        • Partially disinfected stuff
        • Breakpoints in the code
        • Just random garbage
        • Basically – stuff that doesn’t work
        • If you don’t know what the above means or how to detect its presence, you’re not qualified to test AV products – find a different job, or learn it first
        • Unfortunately, if you do know, that still doesn’t necessarily mean that you’re qualified to test AV products!
    7. Still More Analyzing
      • Remove the Envelopes
        • “Immunizations”
        • Packers
          • Sometimes you MUST NOT remove these!
          • So, how do you know when to remove them?
        • Sandwiches
    8. And Even More Analyzing
      • Remove the Non-Malware
        • Utilities
        • Legitimate tools used by malware
        • Simulators
        • False positives
        • Buggy programs
        • Just text files and pictures
        • Build a database of unwanted crap, because you’ll keep receiving it over and over! The TRASHBIN tool
        • Mike will tell you more on this subject
    9. And Finally…
      • Separate the Viruses from the Non-Viral Malware
        • Trojan Horses
        • Dialers
        • Password stealers
        • Exploits
        • Kits
        • Germs
        • Injectors
        • Intended
    10. Basic Rules of Thumb
      • Know what you’re doing!
      • Look at everything personally!
      • Don’t put a file in your collection, unless you can explain why you have done so
      • “A scanner reports it” or “Found it in a virus collection” are NOT good explanations!
    11. And Now – the Real Work Begins
      • Replicate All the Viruses Yourselves!
        • Yes, all of them!
        • Yes, yourselves!
        • If you cannot replicate something, either figure out why not and then replicate it, or don’t put it in the virus collection!
        • Yes, this requires multiple environments (OSes and devices), a lot of knowledge and a lot of work
        • Did I ever say that maintaining a malware collection was easy ?!
    12. More About Replication
      • Viruses Fail to Replicate for Various Reasons
        • CPU dependency
        • OS dependency
        • Memory dependency
        • Date/time dependency
        • File system dependency
        • There are many others!
        • Basically – analyze the damn thing and figure it out when/if it replicates
        • If you cannot, you are not qualified to do AV product testing!
    13. Order the Collection
      • Separate by Malware Type
      • Group by Malware Family
      • Separate by Malware Variant
      • Rules of Thumb:
        • If two samples contain the same malware, they should be in the same directory
        • If two samples contain two different malware programs, they should be in two different directories
        • You need to be able to tell if two samples contain the same malware or not. Obvious, isn’t it?
        • Scanners can help but are by far not sufficient
    14. Testing
      • With a Collection, You Can Test:
        • Detection
        • Heuristic detection (Careful!)
        • Disinfection
        • Memory scanning (does anybody do that?)
        • Identification (Difficult!)
        • On-demand and on-access
        • Test on various platforms
        • Scanning speed? (Ooops! Never!!!)
        • Forget the WLO/ItW crap!
      • That’s All, Folks
      • Simple, Isn’t It?
      • Just Some Common Sense
        • Which is so uncommon nowadays
      • A Lot of Knowledge and Experience
      • And Work, Work, Work!
      • Questions?
      Conclusion

    + frisksoftwarefrisksoftware, 3 years ago

    custom

    1779 views, 0 favs, 2 embeds more stats

    Presented at the International Antivirus Testing Wo more

    More info about this document

    © All Rights Reserved

    Go to text version

    • Total Views 1779
      • 1729 on SlideShare
      • 50 from embeds
    • Comments 0
    • Favorites 0
    • Downloads 472
    Most viewed embeds
    • 49 views on http://www.f-prot.com
    • 1 views on http://rogerspeaking.com

    more

    All embeds
    • 49 views on http://www.f-prot.com
    • 1 views on http://rogerspeaking.com

    less

    Flagged as inappropriate Flag as inappropriate
    Flag as inappropriate

    Select your reason for flagging this presentation as inappropriate. If needed, use the feedback form to let us know more details.

    Cancel
    File a copyright complaint
    Having problems? Go to our helpdesk?

    Categories