Computer Malicious Adversaries

A book on Edward Snowden : No Place to Hide

2014-05-20T03:09:00.004-07:00

Anyone already read this book?
A friend suggest me to read it. Currently Amazon didn't ship to Asia so I only can use other channel to get the copy

link

HeartBleed OpenSSL Bug

2014-04-08T06:15:00.003-07:00

According to here:

The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

You can check whether your server is affected with a test page here

Hack In The Box 2013 Kuala Lumpur, Malaysia presentation materials

2013-10-17T08:58:00.005-07:00

Hack In The Box 2013 Kuala Lumpur (HITB 2013 KUL) just ended today. I managed to get a pass to this event, and this is my forth time attending this event.

The presentation materials can be downloaded from this link

Malware API Logs Dataset

2013-06-23T23:14:00.000-07:00

The problem with malware detection or classification research is that it does not have STANDARD dataset.

So I try to accumulate several datasets that being used by researchers so that you will be able to replicate and present the method that you proposed for your research.

This is important so that the examiners will not refuting the credibility of your methods or algorithms during your viva-voce

From NEXGINRC

This list will be updated from time to time based on your inputs ;)

Open Security Training (Cousera/Khan Academy Likes)

2013-03-27T17:55:00.001-07:00

This precious, heavily documented training materials have been shared. With videos, codes and slides, I strongly believe these are things that shouldn't be missed out!

Click here

"In the spirit of OpenCourseWare and the Khan Academy, OpenSecurityTraining.info is dedicated to sharing training material for computer security classes, on any topic, that are at least one day long.
All material is licensed with an open license like CreativeCommons, allowing anyone to use the material however they see fit, so long as they share modified works back to the community.
We highly encourage people who already know these topic areas to take the provided material and pursue paid and unpaid teaching opportunities.
Those who can, teach."

For malware related topics, the study paths has been lined out, for example:

Check all the titles here. Some materials (not including videos) are hundred MBs.. so prepare some spaces in your hard drive! :)

"Becoming a malware analyst"

2013-03-23T09:20:00.003-07:00

You want to become a malware analyst?

Read this

---------------------------------------------------------------------------------------------------------------------------------

There are few jobs in this industry that seem as appealing and interesting to me as that of a malware analyst. In my mind, these professionals were waking up each day to continue a complex game not unlike the Glass Bead Game from the eponymous novel by Herman Hesse - a pure pursuit of the mind that makes connections where there are seemingly none, all for the sake of solving intricate puzzles in order to satisfy their curiosity and cravings for intellectual challenges. But I was wrong!

To satisfy my own personal craving to know what it was all about, I decided to contact a number of malware analysts working for some of the most high-profile security companies out there and ask them a few questions.

The traits and skills of good malware analysts

Some malware researchers, like McAfee Lab’s Principal Research Architect Igor Muttik, entered the field in the '80s, when the anti-virus programs were only appearing and there was no multi-billion AV industry yet. Others, like Jana Barborikova, a Junior Virus Analyst at Avast, have been in it for less than a year.

But the one thing they all have in common - beside insatiable curiosity - is the satisfaction of knowing that they are keeping users safe. In fact, the willingness to help people is one of the main qualities of a good malware researcher according to Muttik. "In this regard what we do is very similar to the work of the doctors, police and firefighters," he muses.

"What are the others?" I asked. A high IQ, he says. "Anyone can be a good programmer but to successful in computer security one has to be smarter than the best of the attackers. This requires dedication and the more brain cells you can contribute - the better!"

"Crucial for malware analysts is the ability to get a full overview of what modern malware does, how it does it and why it’s doing it,"Bogdan Botezatu, Senior E-Threat Analyst with Bitdefender, tells me.

"Patience is also mandatory. Decrypting a piece of malware with server-side polymorphism or tracking down its behavior in a virtualized environment can get extremely frustrating. Last but not least is a strong sense of ethics. The lack of affiliation with black-hat or cybercriminal groups is just a start. Since we’re trusted with lots of confidential information and access to zero-day samples or still unpatched exploit code, we need to know that no employee would use the code for malicious purposes."

He sees the job more as a vocation. "I know quite a few antivirus researchers who are designated economists, MDs or, as in my case, historians or journalists, but are experts on cybercrime. Of course, IT-related educational backgrounds make it easier to learn how computers, operating systems, network communication and applications work, but it is not mandatory."

Kaspersky Lab Senior Malware Analyst Denis Maslennikov agrees. "The most important thing is to be interested in this field, because if you are, this interest will drive you and guide you while you search for new knowledge and experience. It’s more about the knowledge you have than about the diploma. If you have some basic background and are able to learn new stuff you can become malware analyst."

He also reiterates Botezatu's opinion on ethics. "Stay out of the black / grey area. No antivirus company will hire you or trust you with zero-day code if you have worked for or have been affiliated with exploit writers, black hat hackers or unauthorized pen-testers. Most disclosure about ongoing operations follows a strict vouching process in which the candidate receives approval or denial from peers in the industry."

The ability of not letting failure to put you off is another crucial trait according to Barborikova. "An analyst cannot be afraid to try new approaches and think outside of the box."

Finally, you need to be ready and able to communicate. "The best reverse engineer in the world is useless if she cannot report her findings in a clear and concise way," points out Guillaume Lovet, Senior Manager FortiGuard's Labs in EMEA at Fortinet.

But what kind of base knowledge is a must-have? Or, at least, is highly recommended?

"Most malware nowadays requires analysts to understand assembly languages. Learning and understanding this will unlock many doors in the field of malware analysis," says Liam O’Murchu, Manager of Operations, Symantec Security Response.

Barborikova concurs, and that is why she's currently focusing on learning them. "The analyst does nothing without some programming skills, fundamentals of networking and a basic knowledge of operating systems," she adds.

"Reverse engineering – although the focus of antivirus research – is not everything a candidate needs to understand. Most of the time, you will need to build your own tools and extend them to suit your new purposes," Botezatu weighs in.

"If you already understand assembly language, you should start learning a programming language (such as C++ and Python), as you’re going to use it to automate day-to-day tasks, write custom scripts to help you with your work or develop state-of-the-art disinfection routines that will reach millions of customers on the next update."

Lovet agrees, and considers some developer skills in scripting languages almost mandatory. He also points out that - unlike him - not all analysts have been professional C++ developers before becoming analysts, and that he finds this a significant advantage when it comes down to reverse-engineering malware pieces, which are usually coded in C++.

What none of them (or the companies they work for) consider important is having certifications.

"We do not require any certifications for new malware engineers joining our team. The most important thing is to have hands on experience analyzing malware or performing security investigations," says O’Murchu.

How does one become a malware researcher?

The roads that lead to this are many and various. Maslennikov and O'Murchu studied, respectively, information security and computer engineering at college. For the former, the road was very straight - while still at university, he got a call from Kaspersky Lab and was offered a malware analyst position.

The latter went through several jobs such as a security tester for an internet kiosk company and working at an anti-spam company that was ultimately bought by Symantec. "We were given a tour of the new Symantec offices and as soon as I entered the malware analysis lab I knew that was the job I wanted. I was fortunate to have the opportunity to transfer into that department and short time later and have been here since," he says.

Muttik and Barborikova have an education in natural and formal sciences. Both were interested in a career in information security, and Muttik practiced reverse-engineering viruses as a hobby.

A previously mentioned, Botezatu studied history and journalism, but was also interested in reverse-engineering malware since he was a teenager. Following a stint as a network administrator for his university, he applied for a job at Bitdefender two times. After having overslept and missed the interview the first time, he worked half a year as a tech journalist before trying his luck again. This time, he was recruited by the company's communication team.

"Since joining Bitdefender, I’ve worked in a multitude of fields, from technical communication to anti-malware research and new product development. I grew to understand security from tracking down malicious activity to actually developing solutions to mitigate it, and speaking about developments in the industry at international conferences. As part of a cross-disciplinary team, we’re exposed to everything that happens in the anti-malware field, so we have a full perspective on the industry," he shared.

Lovet became a malware analyst after a 2-year-long developer experience. "Being a developer satisfied my analytic and synthetic mind, as well as my creativity, yet it lacked the 'passion' component," he says, adding that he began working as a Malware Analyst at Fortinet in 2004.

"At the beginning, we'd manually process loads of legacy DOS viruses - because we needed to have detection for those to earn some certifications. These were fun times: studying 20+ viruses per day is the equivalent of playing poker online, at 5 different tables at once: you play a LOT of hands, and gain experience faster," he shares.

After becoming the AV Team leader, he turned more toward researcher and presenting at international conferences such as AVAR, EICAR, and Virus Bulletin.

"Eventually, I got promoted to AV and IPS team manager, then senior manager. Today, I still do my share of research (last year I presented 2 papers at BlackHat in Amsterdam), and some management of people. This was my choice, in order to diversify my skills. It is perfectly possible to stick to purely technical tasks and progress in the company aside of the management ladder, up to the rank of Fellow, which equates a VP rank in the management career," he points out.

Malware researchers' typical working day and the tools they use

"During my work I deal mainly with web malware," shares Barborikova. "I go through a list of potentially dangerous URLs and select domains which are actually malicious. Then I analyze samples, especially HTML and PHP files. Apart from handy internal tools developed in our virus lab department I use freeware tools like VirtualBox, Process Monitor or Wireshark and online deobfuscators and decoders."

"We use IDA Pro and OllyDbg for reverse engineering. And our own tools for intelligence and monitoring (probes and honeypots), says Lovet. "On the secluded replication machines, where we safely run viruses to study their behavior, we don't use virtual machines, as some malware spots those. On the mobile malware side, we have our own in-lab, secluded GSM network.

We built a base-station with a modified USRP board. The software part is OpenBTS, an open source system. When we register infected phones to that network, we can therefore trace what they do on the network: send SMS, place calls, etc."

IDA and OllyDbg are O’Murchu's "weapons of choice," as well, since they are standards for the two primary tools any malware analyst needs: a disassembler and a debugger.

"We have separate machines that we use for malware analysis. In addition to having all the tools needed for analysis installed, these machines are also isolated with no Internet connection. This prevents any malware from escaping when we are testing it," he says.

"We generally run the threat to look at observable behaviors first, then dig deeper as needed. Using hex editors and file format parsers and learning about different file formats is also a big part of a malware analyst’s role. For example if a PDF file is being used to distribute a piece of malware, then analyst will need to become familiar with how PDF files are created and how to break them apart."

Botezatu says that he is not sure where his typical day ends and where it starts. "Antivirus research is a 24-hour mission - if your phone rings or the SMS alert beeps in the middle of the night, you take off to work, or at least VPN into the company immediately," he notes. "If an outbreak has been detected, we start developing a removal tool for computer users who are not running a Bitdefender solution.

If everything is running normally, we proceed to solving support tickets, clustering new malware and improving heuristics, while keeping an eye on security (highly private) mailing lists for new samples and developments. You know - the save-the-world-while-having-coffee activities."

"As far as tools are concerned, we’re using a lot of readily available tools such as Far Manager, IDA, Process Explorer, Process Monitor, Malzilla, and Wireshark. But the heavy lifting is done with proprietary tools built in-house, tools that don’t even have names. In the fight against malware, it’s every man for himself, we’re mostly using tools that we develop ad-hoc, ranging from unpackers to utilities for clustering files, rebooting remote machines or controlling operations off-site," he concludes.

Maslennikov says that there is really no typical working day, as there is always something new and / or urgent going on. He does his testing on two desktops with Windows and Linux and a lot of smartphones with different OS, and can't do without the Far file manager, IDA, Hiew and a number of various internal tools. Oh, and coffee - plenty of it, and often.

Finally, I asked them:

What surprised them the most during their current career?

"I have been in the security industry for almost 10 years, and I am continuously surprised by the new attacks the malware cyber criminals dream up," says O’Murchu. "Although the vast majority of attacks are predictable and nothing out of the ordinary, there is always a small number of threats that push the boundaries of what is possible."

The threat that has amazed him the most was Stuxnet. "We had never seen a piece of malware capable of changing how physical machinery works. That was a threat that really pushed the boundaries of what malware can do," he added.

Botezatu has been most surprised by the success of the Slammer worm, the virality of Conficker, the way cyber-crooks made easy money with the Rogue AV campaigns and the complexity of the TDSS family.

"But the piece of malware that went through our hands and surprised the entire world was Flamer, a piece so elegantly designed that it tricked the user into acting as a mule for the stolen data," he shares. "It took espionage to a whole new level: the ability to prioritize importance of stolen data, the way it carried the data to a gateway and the fact that it lacked compression and obfuscation, hiding its code in plain sight. This was clearly not the result of a single man, but rather the work of a team of specialists."

And while Barborikova, who has only been doing this for a year, says that she naturally often encounter things that are new for her, Lovet says that the thing that fascinates him the most is that cybercriminals have not begun exploiting mobile phones earlier.

"Back in 2006, I predicted that they would, since a smartphone was basically a computer with something more: an integrated payment system (i.e. premium numbers). It'd simplify a lot the business model you need to set up to turn infected machines into cash," he pointed out.

Nevertheless, it didn't really happen before 2011, and even now, he says, the scale on which it's happening is still moderate as compared to the PC world.

Conclusion

I am very grateful for the peek that these experts gave me into their profession, and I hope that you have enjoyed this as well, especially if you're contemplating a (new) career in malware research.

Common sense says that cyber attack will never stop, but just become different, so put in you "pros" column the fact that you'll rarely be bored at your job and that, if you become good at it, will probably never experience a lack of job offers.

How to secure your Windows computer from malware

2012-12-31T08:26:00.001-08:00

Most of us are actually using Windows computer in their daily tasks. However, some precaution must be made in order not to get mad after being infected by the nasty viruses.

Always scan your USB drive.

-Sometimes your friend comes to your room and asked for your computer for casual stuffs - surfing, finishing her work or sort of that. Make sure he scan her USB drive with an antivirus. You can easily find one, which is free, for example "Microsoft Security Essential" or "MSE"

Do not download a suspicious attachment

-Somehow you might get an email from unknown people. If you happened to download the file, make sure you scan the file first - in order to reassure it is clean and pristine

Use Linux

-Well, Windows virus is not compatible with Linux. Different architecture for real. This, for the case of normal executable file. Application based attack will not being discussed here. Linux is free, and I have been using it for almost 10 years without any virus infection.

Lastly, stay safe!

Basic Research Skills in CS

2012-12-17T02:56:00.002-08:00

I found these two links, which really helps in directing your PhD research:

http://www.dcs.gla.ac.uk/~johnson/teaching/research_skills/basics.html
http://www.dcs.gla.ac.uk/~johnson/teaching/research_skills/research.html

Security talks at CERIAS, Purdue

2012-12-17T02:55:00.000-08:00

I stumbled to this page and perhaps you guys interested to listen to these talks as well:

click

Chrome and Blackhole Exploit

2012-12-06T22:17:00.002-08:00

A friend who just move to Blue Coat Inc had his article published in Threatpost. Seems changing an employer opened him to new opportunities too!

Chromium Exploited Again in HITB 2012

2012-10-10T09:24:00.004-07:00

Siang tadi aku tgk scoreboard ada nama mamat ni.. masa tu belum confirm lagi. ni mcm dah confirm je dia dapat another USD60K. hebatlah

dari sini

For the second time this year, an anonymous teenage security researcher has succeeded in producing a full exploit, including a sandbox escape, against Google Chrome. The researcher, who uses the pseudonym PinkiePie, submitted his exploit Wednesday during the Pwnium contest run by Google at the Hack in the Box conference.

tadi ingat nak masuk PirateBay punya talk, tapi talk cancelled.

Pirate Bay founders Peter Sunde and Fredrik Neij suddenly and unexpectedly didn't show up for their eagerly-awaited presentation at the HiTB security conference in Kuala Lumpur, Malaysia this afternoon.
There is still no official word on the whereabouts or status of Sunde and Neij.
They were set to travel seperately, with Nelj coming to the conference via Thailand

Don't know what happened to them.

Malicious Software Coursera FREE class now online

2012-09-25T08:55:00.003-07:00

Coursera previously initiated with few classes and now expands with many classes across different disciplines. Good to know, Dr Lorenzo Cavalero also started his class on Malicious Software which can simply being signed up here

Summary

"Malicious Software and its Underground Economy: Two Sides to Every Story
Lorenzo Cavallaro of Royal Holloway, University of London

Learn about traditional and mobile malware, the security threats they represent, state-of-the-art analysis and detection techniques, and the underground ecosystem that drives such a profitable but illegal business."

The class however will only start next Jun 2013.. that's almost 9 months to go! Enough to get a baby birthed.

Have fun!

From Springerlink, "Automatic Malware Analysis An Emulator Based Approach"

2012-09-19T17:53:00.001-07:00

the book can be downloaded here (your organization need a subscription)

Value of Hacked PC - by Krebs

2012-09-11T19:51:00.001-07:00

Krebs put this on his website. Thought it'll be useful to share it to you guys.

Kippo - MySQL 101

2012-09-10T09:36:00.000-07:00

mysqd_safe --skip-grant-tables;
mysql -u root -p;
use mysql;
update user set password=PASSWORD("testpass") where User='root';
create database kippo;
use kippo;
grant all privileges on kippo.* to 'kippo'@'localhost' identified by 'secret';
flush privileges;

just my copy+paste script, useful for fresh installation

Snort MySQL error "database: must enter database name in configuration file#012"

2012-09-07T01:22:00.003-07:00

in /etc/snort/database.conf, modify the line

output database: log, mysql

to

output database: log, mysql, user=snort password=<your pass> dbname=snort host=localhost

My self note on Snort + MySQL on Ubuntu

2012-09-05T08:28:00.002-07:00

Metasploit

2012-09-03T23:40:00.002-07:00

I kinda like the SVN version of anything, of course, expect buggy riding when doing so. For example, what did you do with your metasploit?

My paper "Challenges in High Accuracy of Malware Detection" is available at IEEExplore

2012-08-31T20:17:00.002-07:00

My paper which was presented last July 2012 is now available via IEEExplore. Get it here

e-majalah "The Hacker News" PERCUMA/GRATIS!

2012-08-31T18:00:00.001-07:00

The Hacker News atau THN ada menyediakan majalah sekuriti secara percuma dalam bentuk elektronik (PDF). Boleh dimuat turun di sini

NSS 2013 CFP at Madrid

2012-08-29T18:14:00.003-07:00

NSS 2013 CFP: here

NSS is an annual international conference covering research in network and system security. The conference seeks submissions from academia, industry, and government presenting novel research on all theoretical and practical aspects of network security, privacy, applications security, and system security. Papers describing case studies, implementation experiences, and lessons learned are also encouraged. Topics of interest include but are not limited to:

- Active Defense Systems
- Adaptive Defense Systems
- Analysis, Benchmark of Security Systems
- Applied Cryptography
- Authentication
- Biometric Security
- Complex Systems Security
- Database and System Security
- Data Protection
- Data/System Integrity
- Distributed Access Control
- Distributed Attack Systems
- Denial-of-Service
- High Performance Network Virtualization
- High Performance Security Systems
- Hardware Security
- Identity Management
- Intelligent Defense Systems
- Insider Threats
- Intellectual Property Rights Protection
- Internet and Network Forensics
- Intrusion Detection and Prevention
- Key Distribution and Management
- Large-scale Attacks and Defense
- Malware
- Network Resiliency
- Network Security
- RFID Security and Privacy
- Security Architectures
- Security for Critical Infrastructures
- Security in P2P systems
- Security in Cloud and Grid Systems
- Security in E-Commerce
- Security in Pervasive/Ubiquitous Computing
- Security and Privacy in Smart Grid
- Security and Privacy in Wireless Networks
- Secure Mobile Agents and Mobile Code
- Security Policy
- Security Protocols
- Security Simulation and Tools
- Security Theory and Tools
- Standards and Assurance Methods
- Trusted Computing
- Trust Management
- World Wide Web Security

HITB 2012 Kuala Lumpur, Malaysia

2012-08-28T18:45:00.001-07:00

HITB 2012 KUL will be held in the incoming October 2012! I already registered my name and hope to see you guys there!

More info here

avast: can not initialize avast! engine: Invalid argument

2012-08-28T00:56:00.002-07:00

I was unable to use my Avast AV on Linux, so I stumbled here due to the similar error message.

The solution as given in the blog;

sysctl -w kernel.shmmax=100000000

It works for me! 

Windows malware detection on Linux host

2012-08-27T04:42:00.000-07:00

My favoriate workstation is Linux, but I need to analyze Windows malware.
The are several options such as listed here

On Ubuntu for example, we can simply type

"sudo apt-get install clamav"

F-prot also provides a free Linux host antivirus to analyze Windows malware here

Spotting scam email

2012-08-16T20:03:00.001-07:00

A friend asked whether an attachment that she got is trustworthy or not. Upon receiving, I could quickly conclude it is a scam, preying for greedy or needy people. However I notice it seems "localized" a bit, since my friend is a Malaysian, the scam email also use "Malaysia" in the content.

The sample of this "United Nation" scam email can be referred here, someone blogged it out