Malware analysis as a hobby - the short story (lightning talk)
•Download as PPTX, PDF•
2 likes•578 views
Michael Boman created the Malware Analyst Research Toolkit (MART) project to automate malware analysis as a hobby. MART uses public and private malware collections, Cuckoo Sandbox for analysis, and VirusTotal for additional results. It stores findings in MongoDB and provides a GUI for analysts. The initial investment was around €1,320 for a computer and license, but ongoing costs after the first year are only around €590 as the system automates most of the workflow. Future goals include expanding automated analysis to additional platforms like Android, OSX, and iOS.
Report
Share
Report
Share
Recommended
Malware Analysis as a Hobby
The document notes that manually analyzing malware can be time consuming and boring. MART was created to automate parts of the process such as sample acquisition, analysis using tools like Cuckoo Sandbox, and reporting. This reduces the time spent by malware analysts and allows them to focus on more complex samples. The system also aims to address limitations of virtual machine-based analysis by integrating additional techniques. Overall, MART streamlines malware analysis as a hobby while cutting costs compared to paying for commercial solutions.
Development of a mechanical maintenance training simulator in OpenSimulator f...
The document describes a virtual training system used by 6 air force trainers across 2 sessions at an air base. The system uses a single script across all objects and decision making is done outside of direct state control. User testing found that trainers, with an average age of 42, found it a useful training tool when paired with a safety checklist, though more detailed procedures and coverage of full operations is needed. Future steps include adding mixed human/AI teams, automated registration by designers instead of engineers, and implementing on an alternative 3D platform.
Unit test and continuous deployment
Unit test & Continuous deployment is a presentation that covers unit testing, continuous deployment, and taking questions. It discusses what unit tests are and how they should isolate components, check single assumptions, and be automated. Continuous deployment is also mentioned regarding building and deploying code. The presentation concludes by taking questions.
Magic and the world of supernatural The tell tale heart the blue bouquet lite...
1. The document discusses the concept of magic including traditional and modern perspectives on magic. Traditionally, magic is viewed as either a result of universal sympathy in the universe or a collaboration with spirits. Modern perspectives view it as an art that allows human control of supernatural forces or nature through techniques like incantations and rituals.
2. The story is told from the perspective of a narrator living with an old man. He insists he has no ill motives but wants to kill the old man because of his eyes. After killing him, he cannot stop hearing the old man's heartbeat and confesses to police.
3. The short story is about a man who encounters a stranger at night who wants his blue eyes for
A haunted house analysis (Virginia Woolf)
The document provides an analysis of Virginia Woolf's short story "A Haunted House". It summarizes the plot, which follows two ghostly figures searching their former home for a buried treasure. It analyzes the story's characters, conflict, point of view, themes and literary devices. The analysis concludes the treasure represents the protagonists' love for one another, rather than a material object.
Analysis Of The Tell Tale Heart.Ppt Rebecca Beach
This is an analysis of Edgar Allen Poe's Tell Tale Heart. Becca used our GLIs to analyze it. It is very well done.
A sound of thunder
Ray Bradbury's short story A Sound of Thunder follows a man named Eckels who travels back in time on a guided safari hunt to shoot dinosaurs. The guides warn Eckles that even small changes to the past could have large effects on the future. After seeing a Tyrannosaurus rex, Eckles decides not to shoot it. However, on the group's return to the future, Eckles discovers he has accidentally stepped on and killed a butterfly, altering the future in unknown ways. An enraged Travis then shoots Eckles, demonstrating the dangers of tampering with the past.
Short Story Analysis
The document summarizes key elements of a short story, including plot, which follows a chain of related events from the exposition through the climax and resolution; characters, which can be main or secondary, protagonist or antagonist, round or flat, dynamic or static; setting, which establishes the time and place; point of view, which can be first person, third person limited, or third person omniscient; and other elements like theme, style, symbolism, and mood.
Recommended
Malware Analysis as a Hobby
The document notes that manually analyzing malware can be time consuming and boring. MART was created to automate parts of the process such as sample acquisition, analysis using tools like Cuckoo Sandbox, and reporting. This reduces the time spent by malware analysts and allows them to focus on more complex samples. The system also aims to address limitations of virtual machine-based analysis by integrating additional techniques. Overall, MART streamlines malware analysis as a hobby while cutting costs compared to paying for commercial solutions.
Development of a mechanical maintenance training simulator in OpenSimulator f...
The document describes a virtual training system used by 6 air force trainers across 2 sessions at an air base. The system uses a single script across all objects and decision making is done outside of direct state control. User testing found that trainers, with an average age of 42, found it a useful training tool when paired with a safety checklist, though more detailed procedures and coverage of full operations is needed. Future steps include adding mixed human/AI teams, automated registration by designers instead of engineers, and implementing on an alternative 3D platform.
Unit test and continuous deployment
Unit test & Continuous deployment is a presentation that covers unit testing, continuous deployment, and taking questions. It discusses what unit tests are and how they should isolate components, check single assumptions, and be automated. Continuous deployment is also mentioned regarding building and deploying code. The presentation concludes by taking questions.
Magic and the world of supernatural The tell tale heart the blue bouquet lite...
1. The document discusses the concept of magic including traditional and modern perspectives on magic. Traditionally, magic is viewed as either a result of universal sympathy in the universe or a collaboration with spirits. Modern perspectives view it as an art that allows human control of supernatural forces or nature through techniques like incantations and rituals.
2. The story is told from the perspective of a narrator living with an old man. He insists he has no ill motives but wants to kill the old man because of his eyes. After killing him, he cannot stop hearing the old man's heartbeat and confesses to police.
3. The short story is about a man who encounters a stranger at night who wants his blue eyes for
A haunted house analysis (Virginia Woolf)
The document provides an analysis of Virginia Woolf's short story "A Haunted House". It summarizes the plot, which follows two ghostly figures searching their former home for a buried treasure. It analyzes the story's characters, conflict, point of view, themes and literary devices. The analysis concludes the treasure represents the protagonists' love for one another, rather than a material object.
Analysis Of The Tell Tale Heart.Ppt Rebecca Beach
This is an analysis of Edgar Allen Poe's Tell Tale Heart. Becca used our GLIs to analyze it. It is very well done.
A sound of thunder
Ray Bradbury's short story A Sound of Thunder follows a man named Eckels who travels back in time on a guided safari hunt to shoot dinosaurs. The guides warn Eckles that even small changes to the past could have large effects on the future. After seeing a Tyrannosaurus rex, Eckles decides not to shoot it. However, on the group's return to the future, Eckles discovers he has accidentally stepped on and killed a butterfly, altering the future in unknown ways. An enraged Travis then shoots Eckles, demonstrating the dangers of tampering with the past.
Short Story Analysis
The document summarizes key elements of a short story, including plot, which follows a chain of related events from the exposition through the climax and resolution; characters, which can be main or secondary, protagonist or antagonist, round or flat, dynamic or static; setting, which establishes the time and place; point of view, which can be first person, third person limited, or third person omniscient; and other elements like theme, style, symbolism, and mood.
Malware Analysis on a Shoestring Budget
How can you build a infrastructure using mainly free and open source software to analyze potential malicious code. How you can leverage free public services together with in-house systems to compete against expensive commercial solutions which makes it cost-prohibible for many researchers.
Malware Analysis as a Hobby - 44CON 2012
Michael Boman and Siavosh Zarrasvand present Malware Analysis as a Hobby at 44CON 2012 in London, September 2012.
Watching Somebody Else's Computer: Cloud Native Observability
You’ve probably heard the statement that there is no cloud, there’s just somebody else’s computer. How can we monitor what we don’t own?
Developers and operations teams are increasingly relying on cloud providers to manage and operate their infrastructure. While this can offer many benefits, it also presents new challenges when it comes to observability. In this talk, we’ll explore the unique challenges of observability in a cloud-native environment, and discuss some best practices for ensuring that you can effectively monitor and troubleshoot your applications, even when you don’t have direct access to the underlying infrastructure.
We’ll begin by discussing the basic principles of observability in a cloud-native context, including the importance of monitoring not just the application itself, but also the underlying infrastructure and the interactions between different components. We’ll then explore some common challenges that can arise when it comes to observability in a cloud-native environment, including issues with data access and the need to deal with large volumes of data from multiple sources.
We’ll also discuss some practical strategies for addressing these challenges, including the use of cloud-native observability tools such as Kubernetes metrics and logging frameworks, as well as best practices for configuring and deploying these tools effectively. We’ll also explore the role of observability in incident response and how it can help teams quickly diagnose and resolve issues in a cloud-native environment.
Whether you’re just getting started with cloud-native observability or you’re looking to take your observability practices to the next level, this talk will provide valuable insights and practical tips for ensuring that you can effectively monitor and troubleshoot your applications, even when they’re running on somebody else’s computer.
Malware analysis as a hobby (Owasp Göteborg)
This document discusses Michael Boman's hobby of analyzing malware samples. It describes how he initially analyzed samples manually in a virtual environment but found it time consuming. He then created the Malware Analysis Research Toolkit (MART) project to automate the process. MART uses tools like Cuckoo Sandbox to analyze samples in virtual machines. It also includes components for sample acquisition, analysis, reporting, and data mining. The document discusses challenges with virtual machine analysis and ways to iterate the automation, such as doing brief static analysis on samples. It provides an overview of the hardware used in Boman's malware lab and discusses next steps for the project.
Debugging
This document provides an overview of various concepts in software engineering, including implementation, testing, debugging, development rules, and sayings around software development. It discusses principles like debugging and maintenance taking more time than implementation, data structures being more important than codes/algorithms, avoiding premature optimization, and releasing software often for early feedback. It also covers topics such as unit testing, avoiding obese code, intellectual property, management approaches, software development methodologies, and different types of testing.
Testing & should i do it
Testing code is important to avoid bugs but many PhD students do not rigorously test their code. This document discusses why testing is important and provides tips for effective testing strategies. It recommends having a testing plan, using unit tests, and test-driven development. Automated testing helps ensure code works as intended before and after changes. Rigorous testing adds confidence and allows code to be reused with less risk.
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
From ATT&CKcon 3.0
By Brian Donohue, Red Canary
This presentation will highlight the Atomic Red Team project's efforts to define and increase the test coverage of MITRE ATT&CK techniques. We'll describe the challenges we encountered in defining what "coverage" means in the context of an ATT&CK-based framework, and how to use that definition to improve an open source project that's used by a diverse audience of practitioners to satisfy an equally diverse array of needs. The audience will learn how the Atomic Red Team maintainers standardize and categorize atomic tests, perform gap analysis to achieve deep technique-level coverage and broad matrix-level coverage, and quickly fill those gaps with new tests.
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.
Instructor: Sam Bowne
Class website: https://samsclass.info/126/126_S17.shtml
Debugging a .NET program after crash (Post-mortem debugging)
A journey on debugging issues on production enviroment, how to isolate and fix problems such as crashes, deadlocks, performance / memory issues
CNIT 126: Ch 2 & 3
Practical Malware Analysis
2: Malware Analysis in Virtual Machines
3: Basic Dynamic Analysis
More info: https://samsclass.info/126/126_S21.shtml#schedule
Cinci ug-january2011-anti-patterns
The document discusses anti-patterns and worst practices in software development. Some examples covered include static cling pattern, flags over objects, premature optimization, copy-paste-compile, and reinventing the wheel. It also shares lessons learned from experiences, such as being mindful of date times across time zones, avoiding building SQL from untrusted inputs, and not being too cute with test data. Overall, the document aims to help developers learn from the mistakes of others and adopt better practices.
Enabling effective hunt teaming and incident response
This document provides an overview of enabling effective hunt teaming and incident response with limited resources. It defines hunt teaming as proactively assuming compromise, finding compromised hosts, determining how they were compromised through forensics, and implementing preventative and detective controls. Incident response is defined as reactively noticing an incident, stopping any active threats, and learning from the incident to implement improved controls. The document discusses how most attacks actually occur based on data from breaches, and provides examples of low-cost tools and techniques that can be used for persistence and program execution tracking, centralized logging, and data exfiltration detection.
Showing How Security Has (And Hasn't) Improved, After Ten Years Of Trying
The document discusses the results of fuzz testing software from 2000-2010 to analyze how software security has improved over the last decade. The testing involved fuzzing four file formats (Office, PDF, etc.) across 18 programs from different years. This resulted in over 175,000 crashes. Analysis found over 900 unique bugs. Later versions had fewer exploitable bugs, indicating improving code quality. The results provide a potential "fuzzmark" metric for software security improvements, though comparisons across formats require more controls. The testing process and challenges ensuring data integrity are also outlined.
Why Software Test Performance Matters
Test faster, release faster, get to market faster. Automated testing is the future of software development but all too often the performance and longevity of the tests themselves are an after thought. This lightning talk discusses why they shouldn't be.
Alexey Ostapov: Distributed Video Management and Security Systems: Tips and T...
This document discusses testing techniques for complex security video systems. It begins with an introduction of the presenter, Alexey Ostapov, as a tester with experience in security systems. It then covers challenges in testing such systems due to their complexity involving multiple integrated components. The document outlines strategies like risk-based and mixed approaches for prioritizing tests. Specific techniques discussed include equivalence partitioning, decision tables, smoke and regression testing. Bug hunting and reproduction tips are provided along with examples of issues found through critical-to-quality duration testing.
Unit testing for the TYPO3 4.x core
This document discusses unit testing for the TYPO3 4.x core. It notes that unit testing is faster than manual testing and can catch regressions. Over 2400 tests were written for the Seminar Manager extension that take less than 90 seconds to run. The document encourages writing unit tests to learn how parts of the core work, before fixing bugs or refactoring code. A diploma thesis is underway to write unit tests for TCEmain and other parts of the core over 6 months, which will provide more knowledge about bugs and flaws. The document concludes by asking if anyone has any questions.
TxJS 2011
This document provides an overview of building mobile applications using PhoneGap. It discusses how PhoneGap works by instantiating a chromeless browser and implementing a bridge to allow calling native device APIs from JavaScript. It also covers topics like plugins, debugging mobile apps, performance considerations, and the PhoneGap API for accessing device features like the camera, contacts, and geolocation. The document advocates for a mobile-first approach using modern web standards and technologies when building apps with PhoneGap.
Chaos Engineering Talk at DevOps Days Austin
Chaos engineering is the discipline of experimenting on a distributed system to build confidence in how it withstands turbulent conditions in production. It involves intentionally introducing failures or unpredictable conditions to test a system's resilience. Some key aspects of chaos engineering include starting with questions about possible failure cases, having tools and means to test ideas and measure outcomes, ensuring observability of experiments, learning from results, and conducting dedicated "game days" with teams. The overall goal is to amplify feedback and continually learn and improve a system's reliability through principled experimentation.
The "Evils" of Optimization
The document discusses the concept of premature optimization and how it can be counterproductive. It defines optimization as procedures used to make a system as effective as possible, especially mathematical techniques. While optimization is important, prematurely optimizing code before identifying bottlenecks can introduce bugs, waste time, and negatively impact design. The document recommends optimizing during design when possible and only optimizing code proven to be bottlenecks based on measurements. Premature optimization is identified as an anti-pattern that should generally be avoided 97% of the time.
Test-Driven Development In Action
This document provides an overview of test driven development (TDD), including what TDD is, an example unit test, the TDD process, benefits of TDD such as more maintainable code and fewer bugs, and resources for learning and practicing TDD such as books and training courses. TDD involves writing automated tests before implementation code to help ensure code quality and catch errors early. The process involves writing a test, seeing it fail, then writing just enough code to make it pass and refactoring as needed.
How to drive a malware analyst crazy
This document discusses techniques that malware authors use to frustrate malware analysts, including inserting breakpoints, manipulating timing functions, exploiting Windows internals like debug flags and objects, anti-dumping methods, VM detection, and debugger-specific tricks. The author also announces a public malware repository and API called VXCage for sharing samples.
Indicators of compromise: From malware analysis to eradication
This document discusses detecting and analyzing indicators of compromise from a malware infection. It describes collecting data from firewalls, IDS/IPS, proxies, DNS logs, and system logs to detect suspicious activity. Once a potential malware sample is acquired, static and dynamic analysis techniques are used to analyze its behavior and identify indicators that can be used to detect infected machines, like created files, registry keys, and network traffic. These indicators are expressed using tools like Yara rules and Snort signatures to enable detection of the compromise across an environment.
More Related Content
Similar to Malware analysis as a hobby - the short story (lightning talk)
Malware Analysis on a Shoestring Budget
How can you build a infrastructure using mainly free and open source software to analyze potential malicious code. How you can leverage free public services together with in-house systems to compete against expensive commercial solutions which makes it cost-prohibible for many researchers.
Malware Analysis as a Hobby - 44CON 2012
Michael Boman and Siavosh Zarrasvand present Malware Analysis as a Hobby at 44CON 2012 in London, September 2012.
Watching Somebody Else's Computer: Cloud Native Observability
You’ve probably heard the statement that there is no cloud, there’s just somebody else’s computer. How can we monitor what we don’t own?
Developers and operations teams are increasingly relying on cloud providers to manage and operate their infrastructure. While this can offer many benefits, it also presents new challenges when it comes to observability. In this talk, we’ll explore the unique challenges of observability in a cloud-native environment, and discuss some best practices for ensuring that you can effectively monitor and troubleshoot your applications, even when you don’t have direct access to the underlying infrastructure.
We’ll begin by discussing the basic principles of observability in a cloud-native context, including the importance of monitoring not just the application itself, but also the underlying infrastructure and the interactions between different components. We’ll then explore some common challenges that can arise when it comes to observability in a cloud-native environment, including issues with data access and the need to deal with large volumes of data from multiple sources.
We’ll also discuss some practical strategies for addressing these challenges, including the use of cloud-native observability tools such as Kubernetes metrics and logging frameworks, as well as best practices for configuring and deploying these tools effectively. We’ll also explore the role of observability in incident response and how it can help teams quickly diagnose and resolve issues in a cloud-native environment.
Whether you’re just getting started with cloud-native observability or you’re looking to take your observability practices to the next level, this talk will provide valuable insights and practical tips for ensuring that you can effectively monitor and troubleshoot your applications, even when they’re running on somebody else’s computer.
Malware analysis as a hobby (Owasp Göteborg)
This document discusses Michael Boman's hobby of analyzing malware samples. It describes how he initially analyzed samples manually in a virtual environment but found it time consuming. He then created the Malware Analysis Research Toolkit (MART) project to automate the process. MART uses tools like Cuckoo Sandbox to analyze samples in virtual machines. It also includes components for sample acquisition, analysis, reporting, and data mining. The document discusses challenges with virtual machine analysis and ways to iterate the automation, such as doing brief static analysis on samples. It provides an overview of the hardware used in Boman's malware lab and discusses next steps for the project.
Debugging
This document provides an overview of various concepts in software engineering, including implementation, testing, debugging, development rules, and sayings around software development. It discusses principles like debugging and maintenance taking more time than implementation, data structures being more important than codes/algorithms, avoiding premature optimization, and releasing software often for early feedback. It also covers topics such as unit testing, avoiding obese code, intellectual property, management approaches, software development methodologies, and different types of testing.
Testing & should i do it
Testing code is important to avoid bugs but many PhD students do not rigorously test their code. This document discusses why testing is important and provides tips for effective testing strategies. It recommends having a testing plan, using unit tests, and test-driven development. Automated testing helps ensure code works as intended before and after changes. Rigorous testing adds confidence and allows code to be reused with less risk.
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
From ATT&CKcon 3.0
By Brian Donohue, Red Canary
This presentation will highlight the Atomic Red Team project's efforts to define and increase the test coverage of MITRE ATT&CK techniques. We'll describe the challenges we encountered in defining what "coverage" means in the context of an ATT&CK-based framework, and how to use that definition to improve an open source project that's used by a diverse audience of practitioners to satisfy an equally diverse array of needs. The audience will learn how the Atomic Red Team maintainers standardize and categorize atomic tests, perform gap analysis to achieve deep technique-level coverage and broad matrix-level coverage, and quickly fill those gaps with new tests.
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
Slides for a college course at City College San Francisco. Based on "Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software", by Michael Sikorski and Andrew Honig; ISBN-10: 1593272901.
Instructor: Sam Bowne
Class website: https://samsclass.info/126/126_S17.shtml
Debugging a .NET program after crash (Post-mortem debugging)
A journey on debugging issues on production enviroment, how to isolate and fix problems such as crashes, deadlocks, performance / memory issues
CNIT 126: Ch 2 & 3
Practical Malware Analysis
2: Malware Analysis in Virtual Machines
3: Basic Dynamic Analysis
More info: https://samsclass.info/126/126_S21.shtml#schedule
Cinci ug-january2011-anti-patterns
The document discusses anti-patterns and worst practices in software development. Some examples covered include static cling pattern, flags over objects, premature optimization, copy-paste-compile, and reinventing the wheel. It also shares lessons learned from experiences, such as being mindful of date times across time zones, avoiding building SQL from untrusted inputs, and not being too cute with test data. Overall, the document aims to help developers learn from the mistakes of others and adopt better practices.
Enabling effective hunt teaming and incident response
This document provides an overview of enabling effective hunt teaming and incident response with limited resources. It defines hunt teaming as proactively assuming compromise, finding compromised hosts, determining how they were compromised through forensics, and implementing preventative and detective controls. Incident response is defined as reactively noticing an incident, stopping any active threats, and learning from the incident to implement improved controls. The document discusses how most attacks actually occur based on data from breaches, and provides examples of low-cost tools and techniques that can be used for persistence and program execution tracking, centralized logging, and data exfiltration detection.
Showing How Security Has (And Hasn't) Improved, After Ten Years Of Trying
The document discusses the results of fuzz testing software from 2000-2010 to analyze how software security has improved over the last decade. The testing involved fuzzing four file formats (Office, PDF, etc.) across 18 programs from different years. This resulted in over 175,000 crashes. Analysis found over 900 unique bugs. Later versions had fewer exploitable bugs, indicating improving code quality. The results provide a potential "fuzzmark" metric for software security improvements, though comparisons across formats require more controls. The testing process and challenges ensuring data integrity are also outlined.
Why Software Test Performance Matters
Test faster, release faster, get to market faster. Automated testing is the future of software development but all too often the performance and longevity of the tests themselves are an after thought. This lightning talk discusses why they shouldn't be.
Alexey Ostapov: Distributed Video Management and Security Systems: Tips and T...
This document discusses testing techniques for complex security video systems. It begins with an introduction of the presenter, Alexey Ostapov, as a tester with experience in security systems. It then covers challenges in testing such systems due to their complexity involving multiple integrated components. The document outlines strategies like risk-based and mixed approaches for prioritizing tests. Specific techniques discussed include equivalence partitioning, decision tables, smoke and regression testing. Bug hunting and reproduction tips are provided along with examples of issues found through critical-to-quality duration testing.
Unit testing for the TYPO3 4.x core
This document discusses unit testing for the TYPO3 4.x core. It notes that unit testing is faster than manual testing and can catch regressions. Over 2400 tests were written for the Seminar Manager extension that take less than 90 seconds to run. The document encourages writing unit tests to learn how parts of the core work, before fixing bugs or refactoring code. A diploma thesis is underway to write unit tests for TCEmain and other parts of the core over 6 months, which will provide more knowledge about bugs and flaws. The document concludes by asking if anyone has any questions.
TxJS 2011
This document provides an overview of building mobile applications using PhoneGap. It discusses how PhoneGap works by instantiating a chromeless browser and implementing a bridge to allow calling native device APIs from JavaScript. It also covers topics like plugins, debugging mobile apps, performance considerations, and the PhoneGap API for accessing device features like the camera, contacts, and geolocation. The document advocates for a mobile-first approach using modern web standards and technologies when building apps with PhoneGap.
Chaos Engineering Talk at DevOps Days Austin
Chaos engineering is the discipline of experimenting on a distributed system to build confidence in how it withstands turbulent conditions in production. It involves intentionally introducing failures or unpredictable conditions to test a system's resilience. Some key aspects of chaos engineering include starting with questions about possible failure cases, having tools and means to test ideas and measure outcomes, ensuring observability of experiments, learning from results, and conducting dedicated "game days" with teams. The overall goal is to amplify feedback and continually learn and improve a system's reliability through principled experimentation.
The "Evils" of Optimization
The document discusses the concept of premature optimization and how it can be counterproductive. It defines optimization as procedures used to make a system as effective as possible, especially mathematical techniques. While optimization is important, prematurely optimizing code before identifying bottlenecks can introduce bugs, waste time, and negatively impact design. The document recommends optimizing during design when possible and only optimizing code proven to be bottlenecks based on measurements. Premature optimization is identified as an anti-pattern that should generally be avoided 97% of the time.
Test-Driven Development In Action
This document provides an overview of test driven development (TDD), including what TDD is, an example unit test, the TDD process, benefits of TDD such as more maintainable code and fewer bugs, and resources for learning and practicing TDD such as books and training courses. TDD involves writing automated tests before implementation code to help ensure code quality and catch errors early. The process involves writing a test, seeing it fail, then writing just enough code to make it pass and refactoring as needed.
Similar to Malware analysis as a hobby - the short story (lightning talk) (20)
Watching Somebody Else's Computer: Cloud Native Observability
Watching Somebody Else's Computer: Cloud Native Observability
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
CNIT 126 2: Malware Analysis in Virtual Machines & 3: Basic Dynamic Analysis
Debugging a .NET program after crash (Post-mortem debugging)
Debugging a .NET program after crash (Post-mortem debugging)
Enabling effective hunt teaming and incident response
Enabling effective hunt teaming and incident response
Showing How Security Has (And Hasn't) Improved, After Ten Years Of Trying
Showing How Security Has (And Hasn't) Improved, After Ten Years Of Trying
Alexey Ostapov: Distributed Video Management and Security Systems: Tips and T...
Alexey Ostapov: Distributed Video Management and Security Systems: Tips and T...
More from Michael Boman
How to drive a malware analyst crazy
This document discusses techniques that malware authors use to frustrate malware analysts, including inserting breakpoints, manipulating timing functions, exploiting Windows internals like debug flags and objects, anti-dumping methods, VM detection, and debugger-specific tricks. The author also announces a public malware repository and API called VXCage for sharing samples.
Indicators of compromise: From malware analysis to eradication
This document discusses detecting and analyzing indicators of compromise from a malware infection. It describes collecting data from firewalls, IDS/IPS, proxies, DNS logs, and system logs to detect suspicious activity. Once a potential malware sample is acquired, static and dynamic analysis techniques are used to analyze its behavior and identify indicators that can be used to detect infected machines, like created files, registry keys, and network traffic. These indicators are expressed using tools like Yara rules and Snort signatures to enable detection of the compromise across an environment.
44CON 2014: Using hadoop for malware, network, forensics and log analysis
The number of new malware samples are over a hundred thousand a day, network speeds are measured in multiple of ten gigabits per second, computer systems have terabytes of storage and the log files are just piling up. By using Hadoop you can tackle these problems in a whole different way, and “Too Much Data to Process” will be a thing of the past.
DEEPSEC 2013: Malware Datamining And Attribution
Greg Hoglund explained at BlackHat 2010 that the development environments that malware authors use leaves traces in the code which can be used to attribute malware to a individual or a group of individuals. Not with the precision of name, date of birth and address but with evidence that a arrested suspects computer can be analysed and compared with the "tool marks" on the collected malware sample.
44CON 2013 - Controlling a PC using Arduino
Slides from the workshop "Controlling a PC using Arduino" conducted at 44CON 2013 in London. It goes through hardware and software used to remotely control a PC (power/reset). Future developments will be including a telnet/rs232 and environment variables.
Sans och vett på Internet
Presentation on how to protect your digital identity for teens in Swedish. Presented at Sunnerby high school.
Blackhat USA 2011 - Cesar Cerrudo - Easy and quick vulnerability hunting in W...
This short workshop will teach attendees how to easily and quickly find vulnerabilities in Windows applications by using some easy to use tools. I will detail step by step some simple techniques that can be used by experts and non experts. While the techniques are simple the results can be great. Learning these easy and fast techniques will allow attendees to do quick audits on Windows applications to determine how secure they are. I will show how to spot vulnerabilities with just a couple of clicks or with very simple and short debugging sessions. The techniques I will be showing are the same that allowed me to find dozen of vulnerabilities in Windows applications, I'm sure that after the workshop attendees will be able to do the same.
OWASP AppSec Research 2010 - The State of SSL in the World
The document discusses the results of a large scale scan of HTTPS servers to analyze SSL/TLS configuration trends. Over 500,000 servers were scanned, including the Alexa Top 10,000 and Fortune 500 domains. Key findings included that Fortune 500 domains were more likely to enable HTTPS and use secure configurations compared to popular domains. Factors like industry sector did not strongly correlate with security level, but domains providing internet-facing services tended to use HTTPS more securely. Further investigation of the Swedish market was planned.
Privacy In Wireless Networks Keeping Your Private Data Private 2008-08-08
This document summarizes threats to privacy when using wireless networks and provides technical solutions for keeping private data secure. It discusses attacks like data interception and man-in-the-middle attacks that can be used by individuals, corporations, and governments. The document recommends using SSL-enabled websites, VPN tunnels, and TOR networks to protect data and privacy. It also suggests using personal firewalls, antivirus software, and anti-spyware programs.
USB (In)Security 2008-08-22
How USB can be abused to steal data from the organization or plant backdoors, and how it can be avoided. Original broadcast date: 2008-08-22
Automatic Malware Analysis 2008-09-19
How to automatically analyze potential malware using free services. Original broadcast date: 2008-09-19
Overcoming USB (In)Security
This is the slides I used for my "Overcoming USB (In)Security" presentation at NextGen CyberCrime conference in Singapore
Privacy in Wireless Networks
This document discusses threats to privacy when using wireless networks, such as data interception and man-in-the-middle attacks. It recommends using SSL-enabled websites, VPN tunnels, and TOR networks to protect private data from individuals, corporations, and governments. Basic protections like personal firewalls, antivirus software, and anti-spyware are also advised. The presentation covers technical solutions for keeping wireless data private and maintaining anonymity online.
Network Security Monitoring - Theory and Practice
Network Security Monitoring: Theory and Practice presentation for EUSecWest '06 conference 2006/02/21
Introduction To Linux Security
This document provides an introduction to Linux security. It covers turning off unnecessary servers and services, limiting access to needed servers using IPTables, updating the system regularly, and reading Linux log files. The document recommends keeping daemons and services disabled or bound to localhost when possible, using tools like netstat, IPTables, and log checking utilities to monitor open ports and system activity. It concludes with a question and answer section and recommends additional security resources.
Snort
- Snort is an open source network intrusion detection system (IDS) that was created in 1998 and has continued to evolve, with a focus on detection capacity, speed and output plugin functionality.
- Snort examines packet flows and compares them to configured rule sets, utilizing variables, preprocessors and output plugins. Common preprocessors perform functions like stream reassembly and portscan detection.
- Output is configured through plugins to perform actions like logging to files or databases. Signatures use a standardized language to define common network attacks and anomalies.
- Unified log files were created to offload alerting from Snort to other applications, improving performance for detection. Compatible spool readers like Barnyard and Mudpit can
SoHo Honeypot (LUGS)
This document summarizes the SOHO Honeynet Project which aims to use inexpensive consumer routers to expand honeynet networks. The project uses Linksys WRT54G or WRT54GS routers running customized OpenWRT firmware to establish a VPN to a central honeynet and redirect traffic that would normally be dropped by the firewall. The document provides an overview of the project goals, hardware choices, hacking the stock firmware, installing custom firmware, and software required as well as calling for developers, testers, and documentation authors to participate in the project.
Sguil
The document introduces Network Security Analysis with SGUIL, which uses Snort for intrusion detection and SGUIL for analysis. It covers the benefits of the system, how alerts flow from sensors to the SGUIL console, the different components, and how an analyst can use SGUIL to analyze alerts, collect session data, and categorize events. It also demonstrates SGUIL and discusses some future plans.
More from Michael Boman (20)
Indicators of compromise: From malware analysis to eradication
Indicators of compromise: From malware analysis to eradication
44CON 2014: Using hadoop for malware, network, forensics and log analysis
44CON 2014: Using hadoop for malware, network, forensics and log analysis
Blackhat USA 2011 - Cesar Cerrudo - Easy and quick vulnerability hunting in W...
Blackhat USA 2011 - Cesar Cerrudo - Easy and quick vulnerability hunting in W...
OWASP AppSec Research 2010 - The State of SSL in the World
OWASP AppSec Research 2010 - The State of SSL in the World
Privacy In Wireless Networks Keeping Your Private Data Private 2008-08-08
Privacy In Wireless Networks Keeping Your Private Data Private 2008-08-08
Recently uploaded
ISO/IEC 27001, ISO/IEC 42001, and GDPR: Best Practices for Implementation and...
Denis is a dynamic and results-driven Chief Information Officer (CIO) with a distinguished career spanning information systems analysis and technical project management. With a proven track record of spearheading the design and delivery of cutting-edge Information Management solutions, he has consistently elevated business operations, streamlined reporting functions, and maximized process efficiency.
Certified as an ISO/IEC 27001: Information Security Management Systems (ISMS) Lead Implementer, Data Protection Officer, and Cyber Risks Analyst, Denis brings a heightened focus on data security, privacy, and cyber resilience to every endeavor.
His expertise extends across a diverse spectrum of reporting, database, and web development applications, underpinned by an exceptional grasp of data storage and virtualization technologies. His proficiency in application testing, database administration, and data cleansing ensures seamless execution of complex projects.
What sets Denis apart is his comprehensive understanding of Business and Systems Analysis technologies, honed through involvement in all phases of the Software Development Lifecycle (SDLC). From meticulous requirements gathering to precise analysis, innovative design, rigorous development, thorough testing, and successful implementation, he has consistently delivered exceptional results.
Throughout his career, he has taken on multifaceted roles, from leading technical project management teams to owning solutions that drive operational excellence. His conscientious and proactive approach is unwavering, whether he is working independently or collaboratively within a team. His ability to connect with colleagues on a personal level underscores his commitment to fostering a harmonious and productive workplace environment.
Date: May 29, 2024
Tags: Information Security, ISO/IEC 27001, ISO/IEC 42001, Artificial Intelligence, GDPR
-------------------------------------------------------------------------------
Find out more about ISO training and certification services
Training: ISO/IEC 27001 Information Security Management System - EN | PECB
ISO/IEC 42001 Artificial Intelligence Management System - EN | PECB
General Data Protection Regulation (GDPR) - Training Courses - EN | PECB
Webinars: https://pecb.com/webinars
Article: https://pecb.com/article
-------------------------------------------------------------------------------
For more information about PECB:
Website: https://pecb.com/
LinkedIn: https://www.linkedin.com/company/pecb/
Facebook: https://www.facebook.com/PECBInternational/
Slideshare: http://www.slideshare.net/PECBCERTIFICATION
BÀI TẬP DẠY THÊM TIẾNG ANH LỚP 7 CẢ NĂM FRIENDS PLUS SÁCH CHÂN TRỜI SÁNG TẠO ...
BÀI TẬP DẠY THÊM TIẾNG ANH LỚP 7 CẢ NĂM FRIENDS PLUS SÁCH CHÂN TRỜI SÁNG TẠO ...Nguyen Thanh Tu Collection
https://app.box.com/s/qhtvq32h4ybf9t49ku85x0n3xl4jhr15Benner "Expanding Pathways to Publishing Careers"
This presentation was provided by Rebecca Benner, Ph.D., of the American Society of Anesthesiologists, for the second session of NISO's 2024 Training Series "DEIA in the Scholarly Landscape." Session Two: 'Expanding Pathways to Publishing Careers,' was held June 13, 2024.
Elevate Your Nonprofit's Online Presence_ A Guide to Effective SEO Strategies...
Whether you're new to SEO or looking to refine your existing strategies, this webinar will provide you with actionable insights and practical tips to elevate your nonprofit's online presence.
Stack Memory Organization of 8086 Microprocessor
The stack memory organization of 8086 microprocessor.
Chapter wise All Notes of First year Basic Civil Engineering.pptx
Chapter wise All Notes of First year Basic Civil Engineering
Syllabus
Chapter-1
Introduction to objective, scope and outcome the subject
Chapter 2
Introduction: Scope and Specialization of Civil Engineering, Role of civil Engineer in Society, Impact of infrastructural development on economy of country.
Chapter 3
Surveying: Object Principles & Types of Surveying; Site Plans, Plans & Maps; Scales & Unit of different Measurements.
Linear Measurements: Instruments used. Linear Measurement by Tape, Ranging out Survey Lines and overcoming Obstructions; Measurements on sloping ground; Tape corrections, conventional symbols. Angular Measurements: Instruments used; Introduction to Compass Surveying, Bearings and Longitude & Latitude of a Line, Introduction to total station.
Levelling: Instrument used Object of levelling, Methods of levelling in brief, and Contour maps.
Chapter 4
Buildings: Selection of site for Buildings, Layout of Building Plan, Types of buildings, Plinth area, carpet area, floor space index, Introduction to building byelaws, concept of sun light & ventilation. Components of Buildings & their functions, Basic concept of R.C.C., Introduction to types of foundation
Chapter 5
Transportation: Introduction to Transportation Engineering; Traffic and Road Safety: Types and Characteristics of Various Modes of Transportation; Various Road Traffic Signs, Causes of Accidents and Road Safety Measures.
Chapter 6
Environmental Engineering: Environmental Pollution, Environmental Acts and Regulations, Functional Concepts of Ecology, Basics of Species, Biodiversity, Ecosystem, Hydrological Cycle; Chemical Cycles: Carbon, Nitrogen & Phosphorus; Energy Flow in Ecosystems.
Water Pollution: Water Quality standards, Introduction to Treatment & Disposal of Waste Water. Reuse and Saving of Water, Rain Water Harvesting. Solid Waste Management: Classification of Solid Waste, Collection, Transportation and Disposal of Solid. Recycling of Solid Waste: Energy Recovery, Sanitary Landfill, On-Site Sanitation. Air & Noise Pollution: Primary and Secondary air pollutants, Harmful effects of Air Pollution, Control of Air Pollution. . Noise Pollution Harmful Effects of noise pollution, control of noise pollution, Global warming & Climate Change, Ozone depletion, Greenhouse effect
Text Books:
1. Palancharmy, Basic Civil Engineering, McGraw Hill publishers.
2. Satheesh Gopi, Basic Civil Engineering, Pearson Publishers.
3. Ketki Rangwala Dalal, Essentials of Civil Engineering, Charotar Publishing House.
4. BCP, Surveying volume 1
How Barcodes Can Be Leveraged Within Odoo 17
In this presentation, we will explore how barcodes can be leveraged within Odoo 17 to streamline our manufacturing processes. We will cover the configuration steps, how to utilize barcodes in different manufacturing scenarios, and the overall benefits of implementing this technology.
HYPERTENSION - SLIDE SHARE PRESENTATION.
IT WILL BE HELPFULL FOR THE NUSING STUDENTS
IT FOCUSED ON MEDICAL MANAGEMENT AND NURSING MANAGEMENT.
HIGHLIGHTS ON HEALTH EDUCATION.
How to deliver Powerpoint Presentations.pptx
"How to make and deliver dynamic presentations by making it more interactive to captivate your audience attention"
BIOLOGY NATIONAL EXAMINATION COUNCIL (NECO) 2024 PRACTICAL MANUAL.pptx
Practical manual for National Examination Council, Nigeria.
Contains guides on answering questions on the specimens provided
How to Setup Warehouse & Location in Odoo 17 Inventory
In this slide, we'll explore how to set up warehouses and locations in Odoo 17 Inventory. This will help us manage our stock effectively, track inventory levels, and streamline warehouse operations.
Level 3 NCEA - NZ: A Nation In the Making 1872 - 1900 SML.ppt
The History of NZ 1870-1900.
Making of a Nation.
From the NZ Wars to Liberals,
Richard Seddon, George Grey,
Social Laboratory, New Zealand,
Confiscations, Kotahitanga, Kingitanga, Parliament, Suffrage, Repudiation, Economic Change, Agriculture, Gold Mining, Timber, Flax, Sheep, Dairying,
Mule event processing models | MuleSoft Mysore Meetup #47
Mule event processing models | MuleSoft Mysore Meetup #47
Event Link:- https://meetups.mulesoft.com/events/details/mulesoft-mysore-presents-mule-event-processing-models/
Agenda
● What is event processing in MuleSoft?
● Types of event processing models in Mule 4
● Distinction between the reactive, parallel, blocking & non-blocking processing
For Upcoming Meetups Join Mysore Meetup Group - https://meetups.mulesoft.com/mysore/YouTube:- youtube.com/@mulesoftmysore
Mysore WhatsApp group:- https://chat.whatsapp.com/EhqtHtCC75vCAX7gaO842N
Speaker:-
Shivani Yasaswi - https://www.linkedin.com/in/shivaniyasaswi/
Organizers:-
Shubham Chaurasia - https://www.linkedin.com/in/shubhamchaurasia1/
Giridhar Meka - https://www.linkedin.com/in/giridharmeka
Priya Shaw - https://www.linkedin.com/in/priya-shaw
Recently uploaded (20)
ISO/IEC 27001, ISO/IEC 42001, and GDPR: Best Practices for Implementation and...
ISO/IEC 27001, ISO/IEC 42001, and GDPR: Best Practices for Implementation and...
BÀI TẬP DẠY THÊM TIẾNG ANH LỚP 7 CẢ NĂM FRIENDS PLUS SÁCH CHÂN TRỜI SÁNG TẠO ...
BÀI TẬP DẠY THÊM TIẾNG ANH LỚP 7 CẢ NĂM FRIENDS PLUS SÁCH CHÂN TRỜI SÁNG TẠO ...
Elevate Your Nonprofit's Online Presence_ A Guide to Effective SEO Strategies...
Elevate Your Nonprofit's Online Presence_ A Guide to Effective SEO Strategies...
REASIGNACION 2024 UGEL CHUPACA 2024 UGEL CHUPACA.pdf
REASIGNACION 2024 UGEL CHUPACA 2024 UGEL CHUPACA.pdf
Chapter wise All Notes of First year Basic Civil Engineering.pptx
Chapter wise All Notes of First year Basic Civil Engineering.pptx
BIOLOGY NATIONAL EXAMINATION COUNCIL (NECO) 2024 PRACTICAL MANUAL.pptx
BIOLOGY NATIONAL EXAMINATION COUNCIL (NECO) 2024 PRACTICAL MANUAL.pptx
Juneteenth Freedom Day 2024 David Douglas School District
Juneteenth Freedom Day 2024 David Douglas School District
How to Setup Warehouse & Location in Odoo 17 Inventory
How to Setup Warehouse & Location in Odoo 17 Inventory
Level 3 NCEA - NZ: A Nation In the Making 1872 - 1900 SML.ppt
Level 3 NCEA - NZ: A Nation In the Making 1872 - 1900 SML.ppt
Mule event processing models | MuleSoft Mysore Meetup #47
Mule event processing models | MuleSoft Mysore Meetup #47
Malware analysis as a hobby - the short story (lightning talk)
- 1. Malware Analysis as a Hobby - the short story Michael Boman - Security Consultant/Researcher, Father of 5
- 3. Drawbacks Time consuming Boring in the long run (not all malware are created equal)
- 4. Choose any two…. Cheap Good Fast
- 5. I can do it cheaply (hardware and license cost-wise). Human time not Choose any two? Why included. not all of them? I can do it quickly (I spend up to 3 Cheap hours a day doing this, at average even less). I get pretty good results (quality). Where the system lacks I can compensate for its shortcomings. Good Fast
- 6. Automate everything! Automate Engineer yourself out of the workflow
- 7. Birth of the MART Project Malware Analyst Research Toolkit
- 8. Components
- 10. Sample Acquisition • Public & Private Collections • Exchange with other malware analysts • Finding and collecting malware yourself
- 11. Sample Analysis • Cuckoo Sandbox • VirusTotal
- 12. DEMO: Submit sample for analysis
- 14. Sample Reporting • Results are stored in MongoDB (optional) • Accessed using a analyst GUI
- 19. Budget Computer: €520 MSDN License: €800 (€590 renewal) Year 1: €1320 Year N: €590 Money saved from stopped smoking (yearly): €2040
- 20. Next steps • Barebone on-the-iron malware analysis • Android platform support • OSX platform support • iOS patform support
- 21. Questions?