Automating the discovery and processing of commodity malware allows security researchers to focus on more important tasks. This talk introduces a simple way of obtaining malicious emails by using freely available disposable mailbox services. We'll share our results and introduce two tools: MailRunner, a modular tool for obtaining and analyzing email, and LacedMail.com, a free api-centric disposable email service that is meant to be used for security research.

1. 1
Brad Antoniewicz
Disposable Mailboxes for Research!
Cisco Umbrella, formally OpenDNS

2. 2
Hi,
I’m @brad_anton

3. 33© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
40%
Businesses affected
in the last year
$1B
Gross Revenue in
2016
128%
Growth in new
samples
Ransomware SucksCommodity malware distracts researchers from cooler stuff

4. 4
Email Distribution
To: Brad Antoniewicz <somedude@someplace.com>
From: Barbara Almond <barabara.almond.01@cisco.com>
Received: from mail.mailexpress.com …
Subject: Invoice #0299301
Attachment: invoice01.zip
Body:
Brad,
Attached is the invoice you requested.
Thanks,
Barbara
Domain Analysis
Pattern Analysis
Natural Language Website Crawling
@brad_anton

5. 5
Not good for research

6. 6

7. 7
MailRunner
Identifying ransomware and commodity malware
Bait Mailboxes
Block
Dewey
Classification
Engine
@brad_anton
Convict, then pass
on email attributes

8. 8

9. 9
Architecture
Fetch, Process,
and Store
Check and
Categorize
Sandbox
Analyzer
Block

10. 10
Detections
(One mailbox)
7.4k Malicious Emails
15k Unique Domains
@brad_anton

11. 11

12. 12@brad_anton

13. 13

14. 14

15. 15@brad_anton

16. 1616
Takeaways
1. Commodity malware ruins it
2. Disposable mailboxes FTW
3. LacedMail.com
4. MailRunner opensource soon!

17. 1717© 2016 Cisco and/or its affiliates. All rights reserved. Cisco Confidential
Thanks!
-@brad_anton