Upload File

extracting the malware signal from internet noise

18
Extracting the Malware Signal from Internet Noise Andrew Morris, Researcher 1

Upload: ashwini-almad

Post on 17-Jan-2017

168 views

Category:

Technology


2 download

Report

TRANSCRIPT

Page 1: Extracting the Malware Signal from Internet Noise

Extracting the Malware Signal from Internet Noise

Andrew Morris, Researcher

1

Page 2: Extracting the Malware Signal from Internet Noise

# whoami• Andrew Morris

• Background in offense

• R&D @ Endgame

2

Page 3: Extracting the Malware Signal from Internet Noise

Tactical Insights from Global Trends• My network is being scanned/attacked

– Am I being targeted specifically?– Are other people seeing this as well?

• A vulnerability has been disclosed– Is anyone probing for this vulnerability?– Is anyone exploiting this vulnerability?

3

Page 4: Extracting the Malware Signal from Internet Noise

4

FaradayA Global Network of Sensors

Untargeted Malware

Geographically & Logically Dispersed

Omnidirectional Internet Traffic for Collection &

Analysis

If something is *not* in Faraday, it is likely targeted

Page 5: Extracting the Malware Signal from Internet Noise

CapabilitiesIptables HTTPTelnetFTPSSHStrategic Packet CaptureCustom sensors

5

Page 6: Extracting the Malware Signal from Internet Noise

Faraday Architecture

6

Page 7: Extracting the Malware Signal from Internet Noise

Four Kinds of Traffic on Your Network

The difference between these can be hundreds of thousands of $$ in incident response

Worm, Mass Exploit

Campaign

Regular Web User

Advanced Persistent

Threat

Search Engines (e.g.

Google)

Mal

iciou

sBe

nign

Omnidirectional Targeted

7

Page 8: Extracting the Malware Signal from Internet Noise

My Network is Being AttackedOmnidirectional Malicious

$ faraday --ip 123.123.123.123 | wc -l

42013

Targeted Malicious

$ faraday --ip 1.2.3.4| wc -l

0

8

Page 9: Extracting the Malware Signal from Internet Noise

A Vulnerability Has Been Disclosed• Is anyone probing for this vulnerability?• Is anyone massively exploiting this

vulnerability?

9

Page 10: Extracting the Malware Signal from Internet Noise

Cisco CVE-2016-1287Cisco ASA Software IKEv1

and IKEv2 Buffer Overflow Vulnerability

• Critical

• Disclosed Feb 10, 2016 • Affects all Cisco ASAs 8-Fe

b-16

9-Feb-16

10-Feb-16

0500

10001500200025003000

Faraday Port 500

Faraday Port 500

10

Page 11: Extracting the Malware Signal from Internet Noise

Cisco CVE-2016-1287The spike and diversity of IP addresses over time implies:

• People are not just probing, but actively targeting it

• Where they are coming from

• Who may have known about the vulnerability prior to public disclosure

• It is not (yet) being massively exploited11

Page 12: Extracting the Malware Signal from Internet Noise

Redis CVE-2015-4335• Remote code execution vulnerability

in Redis– Built and deployed a custom Redis

sensor less than 24 hours after the vulnerability was published

– Observed attacker behavior– Recorded attacker IP addresses

12

Page 13: Extracting the Malware Signal from Internet Noise

CVE-????-????• Traffic observed targeted unknown

devices• No known vulnerabilities on services

running on those ports

13

Page 14: Extracting the Malware Signal from Internet Noise

Fun Stuff• Data Science Early Warning Applications• Dangling DNS• Bandwidth budget calculation• Worm tracking• Search engine spoofing• Reflected DDOS attacks• Provider threat model

14

Page 15: Extracting the Malware Signal from Internet Noise

Really Fun Stuff• Integration into Endgame cyber operations

platform– Visibility into novel attacker techniques– Ability to collect new malware samples– Input into reputation services– Situational awareness

Page 16: Extracting the Malware Signal from Internet Noise

Conclusion• Whether an attack is targeted or not • Derive Internet-wide vulnerability

exploitation attempts

• Collect omnidirectionally targeted malware samples

16

Page 17: Extracting the Malware Signal from Internet Noise

17

Questions?

Page 18: Extracting the Malware Signal from Internet Noise

Thank [email protected]

@andrew___morris

18


Extracting Randomness

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Workflow Design: Extracting Signal From the Noise - ChefConf 2015

Extracting the signal from the noise - GitHub Pages

Workflow Design - Extracting Signal from the Noise

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Extracting Green’s functions from random noise and vibrationsacoustics.mit.edu/dyerparty/dyer_kuperman.pdf · from random noise and vibrations ... 2007 W. A. Kuperman Scripps Institution

AUTOVAC: Towards Automatically Extracting …faculty.cs.tamu.edu/guofei/paper/Autovac_ICDCS13.pdfUse Case of Vaccines As a complementary technique to existing malware defense, vaccines

Extracting Monomers

How Extracting Information from Data Highpass Filters its Additive Noise Victor S. Reinhardt Raytheon Space and Airborne Systems El Segundo, CA, USA PTTI

Extracting Data

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Intrusion Detection and Malware Analysis - Malware collection

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Extracting User Interests from Log using Long-Period Extracting Algorithm

PowerPoint Presentation - REcon€¢CryptoHunt • • findcrypt2-with-mmx • FindCrypt • • Finding and Extracting Crypto Routines from Malware

Extracting Minerals.pdf

Extracting Certainty from Uncertainty: Transductive …papers.nips.cc/paper/5607-extracting-certainty-from...Extracting Certainty from Uncertainty: Transductive Pairwise Classification

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

casablanca.pkcasablanca.pk/surgical/dental.pdf · DENTAL CATALOGUE 2009-2010 CASABLANCA . Extracting Forceps CASABLANCA Er.sh Patten . Extracting Forceps ... Wisdom Teeth Extracting

Extracting Meaningful Data: Distinguishing Signal from Noise in Climate Change Q. Steven Hu School of Natural Resources University of Nebraska-Lincoln

Perfumes Extracting

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Practical Malware Analysis: Ch 11: Malware Behavior

Malware & Anti-Malware

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Extracting Context

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Android Malware Exposed-Evolution of Android Malware

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Windows Malware Firewall: Remove Windows Malware Firewall

Extracting low signal-to-noise ratio events with the Hough ...projects.knmi.nl/...al_geophysics_houghtransform.pdf · in exploration seismology to detect microseismic activity in