Upload File

focus on your malware, not infrastructure!...omri segev moyal @gelossnake focus on your malware,not...

  • Home
  • Documents
  • FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING
23
OMRI SEGEV MOYAL @GelosSnake FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!

Upload: others

Post on 24-Apr-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

OMRI SEGEV MOYAL@GelosSnake

FOCUS ON YOUR MALWARE, NOT

INFRASTRUCTURE!

Page 2: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 2Omri Segev Moyal @GelosSnake

WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING A NEW APPLICATION?

Based on twitter survey - http://bit.ly/2MPAyyY

42%

17%

20%

21%

TIME CONSTRAINTS

PROPER TASK DEFINITION

SETTING UP INFRASTRUCTURE

DEVELOPMENT SKILLS

Page 3: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

PRESENTATIONAGENDA

Modern Research Practices

Serverless Introduction &Security Considerations

Current Usage& Pioneers

Hands-On Example

Live Demo

01

02

04

05

03

Page 4: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 4Omri Segev Moyal @GelosSnake

OMRI SEGEV MOYAL

Malware, APT, CryptoMiners, OSINT, Exploit Kits…

RESEARCHER

Private ConsultantCo-Founder @ Minerva LabsStrategic Advisor @ ClearSky Cyber Security

ENTREPRENEUR

Founder of world’s largest and most active Malware Research Group with over 700 members world wide. Join us! https://malware-research.org/slackAdmin, 9723 Defcon Chapter

COMMUNITY ADVOCATE

Maccabi Haifa sport club fan.Born into it, never left.

MHFC ULTRA FAN

https://malware-research.org/slack
Page 5: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

OMRI SEGEV MOYAL@GelosSnake

#OSDFCON #SERVERLESS@GELOSSNAKE

Page 6: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Omri Segev Moyal @GelosSnake Focus on Your Malware, Not Infrastructure! 6

SECURITY RESEARCH TODAYHow do we build our research apps today?

PLANNING & BUDGETING

DEPLOY OUR CODE

MONITOR OUR APP

SET UP INFRASTRUCTURE

Page 7: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 7Omri Segev Moyal @GelosSnake

SECURITY RESEARCH TODAY

SERIOUS FLAWS

NOT SCALABLE NOT AGILE SLOW ADOPTION

Page 8: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 8Omri Segev Moyal @GelosSnake

QUICK INTRODUCTION TO SERVERLESS

FOCUS ON WRITING CODE

EVENT DRIVEN

NEVER PAY FOR IDLE RESOURCES

SCALABLE

Page 9: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 9Omri Segev Moyal @GelosSnake

Page 10: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 10Omri Segev Moyal @GelosSnake

SERVERLESS CONS & LIMITATIONS

LEARNING CURVE

TOUGH TO DEBUG

TECHNICAL LIMITATIONS

WARM AND COLD BOOTS

Page 11: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 11Omri Segev Moyal @GelosSnake

Page 12: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 12Omri Segev Moyal @GelosSnake

COMMON SECURITY PROBLEMS

PERMISSIONSEVENT DATA INJECTION

VERBOSE EXCEPTIONS

INSECURE STORAGE BUDGET EXHAUSTIONNO LOGGING

Page 13: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

“A VERY INTERESTING QUOTE FROM THE ART OF

WAR.”

Omri Segev Moyal,who could not find any Sun Tzu related quote.

Page 14: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 14Omri Segev Moyal @GelosSnake

AIRBNB BINARY ALERT

http://www.binaryalert.io/

Page 15: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 15Omri Segev Moyal @GelosSnake

https://t.me/MalScanBot https://github.com/GelosSnake/MalwareResearchAPI

INTRODUCING MALSCANBOT

Page 16: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 16Omri Segev Moyal @GelosSnake

MALSCANBOT SERVERLESS BACKEND

Page 17: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 17Omri Segev Moyal @GelosSnake

PRACTICAL EXAMPLE – BUILDING A SERVERLESS SINKHOLE

Page 18: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 18Omri Segev Moyal @GelosSnake

FINDING “SINKABLE” MALWARE

TIP

site:virustotal.com"nxdomain"

Page 19: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 19Omri Segev Moyal @GelosSnake

BUILDING A SERVERLESS SINKHOLE

Page 20: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

Focus on Your Malware, Not Infrastructure! 20Omri Segev Moyal @GelosSnake

MONITORING RESULTS

Page 21: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

DEMO TIME

Page 22: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

PRESENTATIONRECAP

Modern Research Practices

Serverless Introduction &Security Considerations

Current Usage& Pioneers

Hands-On Example

Live Demo

01

02

04

05

03

Page 23: FOCUS ON YOUR MALWARE, NOT INFRASTRUCTURE!...Omri Segev Moyal @GelosSnake Focus on Your Malware,Not Infrastructure! 2 WHAT DO SECURITY RESEARCHERS FIND MOST CHALLENGING WHEN CREATING

THANK YOU

OMRI SEGEV MOYAL

GELOSSNAKE

[email protected]

@GELOSSNAKE

OMRIMOYAL


Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Reversing malware analysis training part8 malware memory forensics

Advanced malware analysis training session6 malware sandbox analysis

Moyal algebra: relevant properties, projective limits and ...€¦ · Moyal algebra: relevant properties, projective limits ... limits of the ring of polynomials of vector elds,

Metamorphic Malware 1 Metamorphic Malware Research

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Malware Analysis Without Looking At Assembly Codegauss.ececs.uc.edu/Courses/c5155/pdf/malware-analysis.pdf · 2015. 11. 20. · Malware Analysis Malware typically employs encryption:

Protecting the UK’s Critical National Infrastructure€¦ · 2015 and again in 2016 through spear phishing malware • the historical malware that is already estimated to be embedded

Moyal Chiropractic · Chiropractor, Dr. William Moyal. Whether it is taking care of his neighborhood patients, or celebrities, professional or Olympic athletes in his office or being

Things to Consider… Before You Deploy U.C. Lior Moyal AudioCodes

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

organisation study on Shree cement by Nitin Moyal

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Malware & APT risks for Critical Infrastructures Infrastructure...Malware & APT risks for Critical Infrastructures. Ashar Aziz, Founder, CEO & CTO . FireEye, Inc. October 18-20, 2011

Intrusion Detection and Malware Analysis - Malware collection

Malware & Anti-Malware

WTO AND INDIA PRESENTED BY -: ASHWANI MOYAL HARPREET SINGH HRIDESH SHARMA NAVJOT SINGH

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Developments in Moyal String Field Theoryisao.kishimoto/apple_site/...2003/3/18 KEK2003 1 Developments in Moyal String Field Theory Isao Kishimoto Univ. of Tokyo collaboratation with

Reversing malware analysis trainingpart9 advanced malware analysis

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Evaluating Open Source Malware Sandboxes with Linux malware

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Markov analysis and Kramers--Moyal expansion of the

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

TUTELAGE: Malware Defense Infrastructure (NSA/CSS)

HIVE: an Open Infrastructure for Malware Collection and ...netlab-mn.unipv.it/hive/ossconf_presentation.pdf · Introduction HIVE Conclusions HIVE: an Open Infrastructure for Malware

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Symplectic Geometry, Wigner-Weyl-Moyal Calculus, … · Symplectic Geometry, Wigner-Weyl-Moyal Calculus, and Quantum Mechanics in Phase Space MauriceA.deGosson Universit¨at Potsdam,

Malware Response Infrastructure Planning and Design Published: February 2011 Updated: November 2011

DEA / Edon Moyal case affidavit