Several Posts on Malware Analysis Tools

In the past weeks I published several posts describing malware analysis tools and approaches at other blogs:

• Installing the REMnux Virtual Appliance for Malware Analysis: Starting with version 4, the REMnux virtual appliance is available as the Open Virtualization Format (OVF/OVA) file, which can be imported into most virtualization tools, such as VMware and VirtualBox. Extra: Explore other updates in the Announcement of the REMnux v4 Release.

• Automating Static Malware Analysis With MASTIFF: MASTIFF is an open source framework for automating static malware analysis. This tool, created by Tyler Hudak, determines the type of file that is being analyzed and then applies only the static analysis techniques that are appropriate for that file type. MASTIFF offers a useful way for performing triage on a large set of suspicious files. Extra: See my MASTIFF demo as part of the What’s New in REMnux v4 for Malware Analysis webcast.

• Extracting Digital Signatures from Signed Malware: Sometimes attackers digitally sign their malicious software. Examining properties of the signature helps malware analysts understand the context of the incident. Moreover, analysts could use the signature as an indicator of compromise. Here are some tips and tools for determining whether a suspicious Windows executable has been signed and for extracting the embedded signature in a Linux environment. Extra: Check out steps to extract signatures from Apple .app files and Didier Steven’s AnalyzePESig tool.

• Tools for Examining XOR Obfuscation for Malware Analysis: There are numerous ways of concealing sensitive data and code within malicious files and programs. Fortunately, attackers use one particular XOR-based technique very frequently, because offers sufficient protection and is simple to implement. Here’s a look at several tools for deobfuscating XOR-encoded data during static malware analysis. Extra: Experiment with Thomas Chopitea’s unXOR tool.

Also, on my own blog I took a look at Cylance’s Accelerify tool for speeding up the lab system’s clock for malware analysis.

— Lenny Zeltser

Anticipating Cyber Threats Beyond APT

Some organizations have encountered Advanced Persistent Threat over 5 years ago—earlier than most of us. Because of the types of data they process, these initial APT victims were exposed to carefully-orchestrated, espionage-motivated attacks before they spread to a wider range of targets.

Now, half a decade later, might the time to look at the attacks that the initial APT victims are fighting nowadays to forecast the threats that will eventually reach other companies. I am wondering:

• Will traditional APT actors eventually disengage from early APT targets, perhaps after obtaining the necessary data, finding the cost of maintaining presence too costly or deciding to focus on easier-to-attack victims? Have they done this already?
• Will APT groups remain engaged, but drastically change tactics according to new goals and in response to new defensive elements? How have these tactics changed in the recent years?
• What can we learn by treating initial APT targets as predictors of threat dynamics that will eventually affect a broader set of victims? What attacks are effective today against the organizations that had the time and skills to adapt to initial APT tactics?

It’s hard to answer these questions without first-hand access to the companies that witnessed the first wave of APT attacks. Furthermore, the dilution of the term APT by marketing departments makes it harder to differentiate between reliable APT insights, such as what Mandiant has been publishing, from generic APT-themed sales collateral peppered throughout the web.

Based on public information and observations, I suspect the threat landscape over the next few years will involve:

• A greater use of purchased non-public exploits. (See Reuters’ article on the trends in the exploits market.)
• More professional oversight of multiple aspects of attack operations and logistics to improve effectiveness and efficiency.
• Smarter mining of stolen data (“big data”) to derive intel for subsequent attacks, discover relationships and spot other valuable information.
• The adoption of the techniques seen in “military-grade” malware, such as Stuxnet, by a broader range of attack groups. (See Eugene Kaspersky’s concerns over military’s use of malware.)
• Increased use of anti-forensics and evasion techniques to conceal attackers’ capabilities and motives. (See Eugene Rodionov and Alexandr Matrosov’s overview of anti-forensics malware features.)

These are just conjectures. I don’t have the answers to the questions I posed above; however, I thought I’d at least ask them and explore the idea of looking at early APT targets’ current state to anticipate advanced threats that will later affect other organizations.

Related articles you might like:

• Mutually-Assured Destruction in Cyberspace
• Indicators of Compromise Entering the Mainstream Enterprise?
• Why I Make Fun of Advanced Persistent Threat (APT)

— Lenny Zeltser

Live and Recorded Malware Forensics Webcasts

In the field of IT in general and digital forensics in particular, you become obsolete the moment you stop learning. Here are several free webcasts related to reverse-engineering and malware analysis that will help you keep your skills up to date.

Upcoming live malware forensics webcasts:

• 50 Shades of Hidden - Diving Deep Into Code Injection by Jake Williams, May 17, 2013
• Pwn’ing APT1 with Yara Signatures by Jake Williams, May 29, 2013

Previously-recorded malware forensics webcasts:

• Introduction to Malware Analysis on Windows: Turn Malware Inside Out! by Lenny Zeltser
• Sharper Incident Response with Protocol Reverse Engineering by Michael Cloppert
• Malware Analysis Essentials using REMnux by Lenny Zeltser
• What’s New in REMnux v4 for Malware Analysis? by Lenny Zeltser
• Memory Forensics for Incident Response by Hal Pomeranz
• Finding Unknown Malware by Alissa Torres

— Lenny Zeltser

New Release of REMnux Linux Distro for Malware Analysis

I’m pleased to announce the release of version 4 of the REMnux Linux distribution for reverse-engineering malicious software. The new version includes a variety of new malware analysis tools and updates the utilities that have already been present on the distro.

What’s new in REMnux v4? See the details below and register for a free webcast where I will showcase some of the key additions. You can download the latest release at REMnux.org.

What’s New in REMnux v4

REMnux is now available as a Open Virtualization Format (OVF/OVA) file for improved compatibility with virtualization software, including VMware and VirtualBox. (Here’s how to easily install the REMnux virtual appliance.) A proprietary VMware file is also available. You can also get REMnux as an ISO image of a Live CD.

Key updates to existing tools and components:

• Core system: Upgraded the underlying Ubuntu OS components and packages; increased default RAM of the virtual appliance to 512MB; replaced OpenJDK with Oracle Java 7 runtime.
• Memory analysis: Updated Volatility to version 2.2.
• PDF analysis: Updated pdfid and pdf-parser, Origami, peepdf
• Web analysis: Updated SWFTools, V8, libemu, NetworkMiner, Burp Proxy, Wireshark, Firefox and its add-ons.
• Other changes: Updated xorsearch, DensityScout, Pyew, passive-dns, ClamAV, capabilities.yara; replaced FreeMind with XMind

New tools added to REMnux:

• Windows tools: Installed Wine; added OfficeMalScanner, Malzilla
• XOR analysis: Added NoMoreXOR, brutexor, XORBruteForcer
• PE file analysis: Added pev, dism-this, ExeScan, udis86 (udcli), autorule (/usr/local/autorule), disitool
• Other file analysis: Added extract_swf.py, ExifTool, MASTIFF
• Other additions: Added hack-functions (/usr/local/hack-functions), bulk_extractor, ProcDot

Getting Started With REMnux

The one-page REMnux Usage Tips cheat sheet outlines some of the more popular tools installed on REMnux. Feel free to customize it to incorporate your own tips and tricks.

The recorded Malware Analysis Essentials Using REMnux webcast provides a good overview and examples of some of the tools for performing static malware analysis. I also recorded a webcast to discuss What’s New in REMnux v4 for Malware Analysis and to demonstrate the new tools.

If you find REMnux useful, take a look at the reverse-engineering malware course that my colleagues and I teach at SANS. It makes use of REMnux and various other tools.

If you haven’t already, download the REMnux distro at REMnux.org.

For tips, issues and workarounds related to installing REMnux v4, see REMnux Version 4 Installation Notes.

— Lenny Zeltser

Two-Step Verification for Apple ID Consistent With Authentication Trends

Apple’s introduction of two-step verification for Apple IDs is consistent with the trend in the industry to strengthen user authentication practices. Facebook has been experimenting with one-time passwords and social CAPTCHA authentication; Google began offering 2-step verification a while back. It’s great to see Apple get onto this bus.

Apple explains that “two-step verification is an optional security feature for your Apple ID.” To activate it, sign into My Apple ID on Apple’s website and go to the Password and Security area. You will then have the ability to specify which “trusted devices” associated with your Apple ID you wish to use as the second authentication token.

When designating a trusted device, such as an iPhone or an iPad, Apple will send a 4-digit verification code, which will pop up on the device almost instantaneously. You’ll need to enter the code on Apple’s website to confirm that you’re in the possession of the device.

Once you’ve enabled two-step verification, you’ll need to verify that you still have the device whenever you login to the My Apple ID website, when you “make an iTunes, App Store, or iBookstore purchase from a new device” or when you attempt to “get Apple ID-related support from Apple.”

For example, after signing into the My Apple ID website with your username and password, you’ll be presented with the prompt to “verify your identity” using one of the enrolled devices.

A pop-up like this will appear on the designated trusted device:

If your device is locked when the code is delivered, you will need to unlock it before seeing the code. The overall experience is a bit more streamlined than what Google uses, because Google requires the user to install and the activate the Google Authenticator app on the mobile device.

Receiving the code requires an active data connection. If you are using an iPhone, don’t have data but are able to receive SMS, Apple can send a verification code to your a verified phone via SMS. To take advantage of this feature, you need to verify the phone number through the My Apple ID website.

When activating the two-step verification option, Apple automatically generates a Recovery Key, which can be used as an authentication token if you lose access to a trusted device:

Google, Apple and to some extent Facebook now give users the option of strengthening their account authentication process. It’s only a matter of time before other industry giants, such as Twitter, jump in. Perhaps stronger authentication becomes the norm, we might see some innovation in making it more reliable and convenient for end-users.

— Lenny Zeltser

Tips on Malware Analysis from Jake Williams

I had the pleasure of speaking with Jake Williams, my colleague at SANS Institute, about his perspective on various malware analysis and reverse-engineering topics. You can read the interview in three parts:

• Part 1: Getting into digital forensics, crafting a strong malware analysis reports and making use of the analyst’s findings
• Part 2: Acting upon malware analyst’s findings and the role of indicators of compromise (IOCs) in the incident response effort
• Part 3: Various approaches to malware analysis, including behavioral, dynamic, static and memory forensics 

Jake is highly experienced in this space and shared helpful insights in the interview above. Jake will be teaching FOR610: Reverse-Engineering Malware on several occasions at SANS this year.

— Lenny Zeltser

Beyond Logins: Continuous and Seamless User Authentication

User authentication is usually discussed in the context of the person’s initial interactions with the system—a safeguard often implemented by a classic login screen. However, one-time validation of the user’s identity is becoming insufficient for modern devices and applications that process sensitive data. Such situations might benefit from a seamless authentication approach that incorporates continuous verification of the user’s identity.

Initial attempts at continuous user authentication can be seen in security policies that lock the user’s workstation after a period of inactivity or settings demanding that mobile phone users enter their PIN every few minutes. These traditional security measures annoy people and leave much room for innovation.

Continuous user authentication could occur transparently by spotting anomalies in which the user interacts with the system. Such methods could avoid interrupting the user unless the system begins to doubt the person’s identity. For instance, the user’s web application activities could be continuously scrutinized for deviations from normal workflow and UI interaction patterns. Similarly, a mobile phone could regularly examine the user’s bio-signs to spot an impostor.

The notion of continuous and seamless authentication isn’t new; however, it has yet to enter mainstream computing in a meaningful way. Here are a few examples of what might be feasible:

• Continuous Authentication using Biometric Keystroke Dynamics and Keystroke Dynamics Based Human Authentication System using Genetic Algorithm discussed challenges and solutions for continuous authentication techniques based on the user’s typing activity.
• Physical Access Protection using Continuous Authentication discussed prototype systems that continuously and seamlessly authenticated PC users through “video from a camera, and fingerprint images from a mouse equipped with a fingerprint scanner.”
• Continuous Mobile Authentication Using Touchscreen Gestures proposed an approach that tracked the user’s user’s “unique touch features, such as finger pressure and trajectory, the speed and acceleration of movement” as the person interacted with the mobile device.
• Continuous Identity Authentication Using Multi-modal Physiological Sensors proposed multiple physiological sensors that could be used for this purpose, including eye position, pupil size, skin conductivity, blink rate, etc.

Users of modern web applications and mobile devices demand strong security measures that don’t get in the way of normal activities. Continuous user authentication could help fulfill such seemingly unattainable demands by passively tracking relevant sensors and metrics, getting on the way only after observing an anomaly that exceeded a reasonable threshold.

Related articles you might like:

• Creative Options for Better Authentication of Mobile Phone Users
• We Still Suck at Protecting Logon Credentials

— Lenny Zeltser

Creative Options for Better Authentication of Mobile Phone Users

If you think your mobile phone is already deeply embedded in your life, consider the critical role it will have in just a few years. As the importance and sensitivity of the data handled by mobile phones increase, so do the repercussions of the devices falling into unauthorized hands. Manufacturers and app developers will need to implement creative ways of authenticating legitimate phone users without relying on awkward passwords and PINs.

Here are a few creative options for determining whether an authorized person is using the phone:

• Scan the user’s fingerprint while the person is holding the phone. Apple’s purchase of AuthenTec fueled speculations that Apple will include a 2D fingerprint reader in an upcoming iPhone.
• Identify the unique walking pattern of the phone’s user using an accelerometer already built into many smartphones. This authentication approach is described in a paper titled Pace Independent Human Identification Using Cell Phone Accelerometer Dynamics.
• Examine the user’s appearance using the phone’s built-in camera, potentially looking at eye patterns, facial geometry or ear shape. One such approach is described in the paper Face and Eye Detection for Person Authentication in Mobile Phones. For another example, consider EyeVerify’s authentication software based on eye vein biometrics.
• Analyze the phone user’s thermal imaging patterns as means of authentication. This approach is described in the paper Thermal Imaging As A Biometrics Approach To Facial Signature Authentication. For an example of thermal imaging phone technology, see the IR-Blue accessory for iPhone and Android devices.
• Tune into the user’s voice patterns to authenticate the person using approaches outlined in the paper Shedding Some Light on Voice Authentication and implemented by researchers in the context of mobile phones.
• Sense the manner in which the user holds the phone, paying attention to the strength of the grip or finger placement. This approach is being discussed in the context of firearms—see papers Hangrip Recognition and Algorithm Design for Grip-Pattern Verification in Smart Gun. It could be applied to mobile phones, too.

Authentication factors above might not work on their own, but they could be combined with each other to reach the right balance between false positives and false negatives.

For additional context, the authentication decision could account for the expected bio-pattern of the legitimate user, such as the heart rate range that could be obtained using activity trackers that integrate with phones, such as FuelBand, Fitbit or UP. The phone could also pay attention to the user’s breathing patterns, in the style of the Breathing Zone iPhone App.The decision could also incorporate the person’s expected physical location and activities (i.e. jogging); for an example of the phone can “predict” the user’s activities see the Google Now app.

Innovative authentication options are gradually becoming available for mobile phones. More will come to light over the next few years. In the next decade, we’ll see authentication mechanisms that effortlessly tie the bio-measured identity and  context with the phone’s hardware and software functions. In some ways, it will be hard to distinguish between the mobile device and its user.

For a follow up to this post, take a look at Beyond Logins: Continuous and Seamless User Authentication.

— Lenny Zeltser