Downloaded 32 times
![Existing barebone implementations
• BareBox
• BareBox: Efficient Malware Analysis on Bare-Metal
• Dhilung Kirat, Giovanni Vigna, Christopher Kruegel
• ACSAC 2011
• No code has been released
• NVMTrace
• Entrapment: Tricking Malware with Transparent,
Scalable Malware Analysis
• Paul Royal
• Blackhat 2012 EUROPE
• Requires special hardware (Intelligent Platform
Management Interface [IPMI])](https://image.slidesharecdn.com/martpresentation-deepsec-121219042336-phpapp02/75/Malware-Analysis-on-a-Shoestring-Budget-39-2048.jpg)
Uploaded byMichael Boman
Malware Analysis on a Shoestring Budget
The document discusses budget-friendly strategies for malware analysis, emphasizing automation and efficient use of resources to achieve quality results quickly. It introduces the MART project, a malware analysis toolkit that includes components for sample acquisition and analysis, and highlights common challenges in virtual machine analysis. Key recommendations include investing in hardware that supports multiple virtual machines and leveraging community resources for malware collection and exchange.
More Related Content
Similar to Malware Analysis on a Shoestring Budget
Malware Analysis on a Shoestring Budget
- 1. Malware Analysis ona shoe- string budget Michael Boman - Security Consultant/Researcher, Father of 5
- 2. Why the strange hobby?
- 3. Start virtual environment The manual way Start logging Analyze logs facilities Stop logging Execute facilities sample
- 4. Drawbacks • Time consuming • Boring in the long run • not all malware are created equal
- 5. I don’t have timefor this… I need a (better) system!
- 6. Choose any two…. Cheap Good Fast
- 7. I can doit cheaply (hardware and license cost-wise) - Human time not Choose any two? included. Why not all of them? I can do it quickly (I spend up to 3 Cheap hours a day doing this, at average even less). An analysis is done in less then 5 minutes… I get pretty good results (quality). Where the system lacks I can compensate for its shortcomings. Good Fast
- 8. Automate everything! Automate Engineer yourself out of the workflow
- 9. Birth of the MARTProject Malware Analyst Research Toolkit
- 10.
- 12. Sample Acquisition • Public& Private Collections • Clean MX • Malware.lu • Etc. • Exchange with other malware analysts • You know who you are • Finding and collecting malware yourself • Download files from the web • Grab attachments from email • Feed BrowserSpider with links from your SPAM-folder
- 13. BrowserSpider • Written inPython • Using the Selenium framework to control REAL browsers • Flash, PDFs, Java applets etc. executes as per normal • All the browser bugs exists for real • Spiders and follows all links seen
- 14. Sample Analysis • Cuckoo Sandbox • VirusTotal
- 15. DEMO: Submit samplefor analysis
- 16. A days workfor a Cuckoo Fetch a task Process and Prepare the create reports analysis Launch analyzer Store the result in virtual machine Complete the Execute an analysis analysis package
- 18. Sample Reporting Results arestored in MongoDB (optional, highly recommended) Accessed using a analyst GUI
- 22.
- 23. Malware attribution Black HatUSA 2010: Greg Hoglund: Malware attribution and fingerprinting
- 24. Where Virtual Machine analysis fails And what to do about it
- 25. Problems • User-detection • Sleepingmalware • Multi-stage attacks
- 26. Problems • VM or Sandbox detection • The guest OS might not be sufficient enough
- 27. Iterating automatiation Sort out clearly Devide the non-malicious and Do brief static samples into obviosly malicious analysis categories samples Known Known Good Bad Unknown
- 28. Iterating automatiation Sort out clearly Devide the non-malicious and Do brief static samples into obviosly malicious analysis categories samples • Does not do anything • Detects environment • Encrypted segments • Failed execution
- 29. Iterating automatiation Sort out clearly Devide the non-malicious and Do brief static samples into obviosly malicious analysis categories samples • Run longer • Envirnoment customization
- 31. Budget • Computer: €520 • MSDN License: €800 (€590 renewal) • Year 1 (2012): €1320 • Year N (2013…): €590 • Money saved from stopped smoking (yearly): €2040
- 32.
- 33.
- 34.
- 35. The need forspeed • Original setup couldn’t run more then 2 virtual machines simultaneously • Disk I/O couldn’t keep up
- 36. MART Hardware (HDD) Transfer speed: 72-144 Mb/s Access time: 13.6 ms
- 37. MART Hardware (SSD) Transfer speed: 2x 270-280 Mb/s Access time: 0.2 ms 68x Running 3-4 machines simultaneously
- 38. Next steps 1. Bareboneon-the-iron malware analysis 2. Android platform support 3. OSX platform support 4. iOS patform support
- 39. Existing barebone implementations • BareBox • BareBox: Efficient Malware Analysis on Bare-Metal • Dhilung Kirat, Giovanni Vigna, Christopher Kruegel • ACSAC 2011 • No code has been released • NVMTrace • Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis • Paul Royal • Blackhat 2012 EUROPE • Requires special hardware (Intelligent Platform Management Interface [IPMI])
- 40. Proof of Concepthardware Prototype Shield Arduino 4-Channel Relay Shield 300 SEK (€~30) Arduino Ethernet Shield Duemilanove
- 41. Questions? Michael Boman Michael Boman michael.boman@2secure.se michael@michaelboman.org http://michaelboman.org http://www.2secure.se @mboman