git your yara for nothing and your malware for free
play

Git Your YARA For Nothing and Your Malware for Free Automating - PowerPoint PPT Presentation

May 12, 2023 •772 likes •1.01k views

<location, date> < Location , date> Reversing Labs // June 2020 Git Your YARA For Nothing and Your Malware for Free Automating Scanning with thousands of YARA rules Cooper Quintin - Senior Security Researcher - EFF Threat Lab

  1. <location, date> < Location , date> Reversing Labs // June 2020 Git Your YARA For Nothing and Your Malware for Free Automating Scanning with thousands of YARA rules Cooper Quintin - Senior Security Researcher - EFF Threat Lab

  2. <location, date> < Location , date> Reversing Labs // June 2020 Intro • Cooper Quintin – Senior Security Researcher – New Parent – Laziness is a Virtue • EFF – Non profit – Defending civil liberties – 30 years • Threat Lab

  3. <location, date> < Location , date> Reversing Labs // June 2020 Malware that Targets At Risk People • Activists, human rights defenders, journalists, domestic abuse victims, immigrants, sex workers, minority groups, political dissidents, etc… • Goals of targeted malware: – Gather intelligence on opposition – Spy extraterritorially or illegally – Blackmail – Locate and Capture – Harass and Intimidate – Stifle freedom of expression

  4. <location, date> < Location , date> Reversing Labs // June 2020 Jeff Bezos Can Afford a Security Team Cybersecurity and AV companies care about the types of malware that affects their customers (usually enterprise.) We get to care about the types of malware the infringe on civil liberties and human rights of This guy is not at risk. at risk people.

  5. <location, date> < Location , date> Reversing Labs // June 2020 Our Goals • Protect People • Broaden our communities` understanding of threats and defenses • Expose bad faith actors • Make better laws

  6. <location, date> < Location , date> Reversing Labs // June 2020 Typical Process 1. Receive Sample 2. Triage Sample 3. Dynamic Analysis 4. Static Analysis 5. Attribution (is hard) 6. Report

  7. <location, date> < Location , date> Reversing Labs // June 2020 Typical Process 1. Receive Sample 2. Triage Sample 3. Dynamic Analysis 4. Static Analysis 5. Attribution (is hard) 6. Report

  8. <location, date> < Location , date> Reversing Labs // June 2020 Triaging Samples Goals: • Determine if sample is known. • Determine if sample is crimeware/spam or targeted. • Scan a possibly infected computer for samples to further investigate.

  9. <location, date> < Location , date> Reversing Labs // June 2020 Triaging By Hand

  10. <location, date> < Location , date> Reversing Labs // June 2020 Triaging with YARA

  11. <location, date> < Location , date> Reversing Labs // June 2020 Full Disclosure 1.I am a YARA noob! 2.I am fundamentally lazy.

  12. <location, date> < Location , date> Reversing Labs // June 2020 I love writing Yara rules but I can only write so many useful ones, my time is limited and there is a lot of malware out there. Luckily people much smarter than me, including people on this stage, have already written a ton of great rules!

  13. <location, date> < Location , date> Reversing Labs // June 2020 Let’s Not Reinvent the Wheel! https://github.com/InQuest/awesome-yara

  14. <location, date> < Location , date> Reversing Labs // June 2020 Some of My Favorites ● Apple OSX Apple has ~40 YARA signatures for detecting malware on OSX. ○ The file, XProtect.yara, is available locally at /System/Library/CoreServices/XProtect.bundle/Contents/Reso urces/. ● Citizen Lab Malware Signatures YARA signatures developed by Citizen Lab. Dozens of ○ signatures covering a variety of malware families. The also inclde a syntax file for Vim. Last update was in November of 2016.

  15. <location, date> < Location , date> Reversing Labs // June 2020 Some of My Favorites ● mikesxrs YARA Rules Collection Large collection of open source rules aggregated from a variety ○ of sources, including blogs and other more ephemeral sources. Over 100 categories, 1500 files, 4000 rules, and 20Mb. If you're going to pull down a single repo to play with, this is the one. ● YaraRules Project Official Repo Large collection of rules constantly updated by the community. ○

  16. <location, date> < Location , date> Reversing Labs // June 2020 Some of My Favorites ● Florian roth rules Florian Roth's signature base is a frequently updated collection ○ of IOCs and YARA rules that cover a wide range of threats. There are dozens of rules which are actively maintained. Watch the repository to see rules evolve over time to address false positives / negatives. ● X64 Debug Rules Great collection of rules for identifying packers and crypto ○ constants.

  17. <location, date> < Location , date> Reversing Labs // June 2020 “But Cooper, I don’t want to download and dig through almost 50 repositories of yara rules of varying quality, that sounds like a chore.”

  18. <location, date> < Location , date> Reversing Labs // June 2020 I Got You

  19. <location, date> < Location , date> Reversing Labs // June 2020 Introducing YAYA Yet Another Yara Automaton • Download Open Source Rulesets • Keep them up to date • Ignore problematic rules • Add your own rules • Run scans • Uses go-yara (thanks Hilko!) • https://github.com/cooperq/yaya

  20. <location, date> < Location , date> Reversing Labs // June 2020 Demo Pardon me while I sacrifice this chicken to the demo gods.

  21. <location, date> < Location , date> Reversing Labs // June 2020 Potential Uses • Put it in your email scanning pipeline. • Scan a possibly infected server or client device with it. • Scan cloud storage uploads. • Quickly triage and classify new samples. It’s open source so please file bugs and add features if you like it.

  22. <location, date> < Location , date> Reversing Labs // June 2020 Thank you! Cooper Quintin Senior Security Researcher EFF Threat Lab cooperq@eff.org - twitter: @cooperq https://github.com/cooperq/yaya

Recommend

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi |

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi |

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 1 TLP-GREEN TOM UELTSCHI YARA-SUMMIT 2020 C:&gt; whoami /all Tom Ueltschi Swiss Post CERT / SOC / CSIRT since 2007 (13 years!) Focus

1.3k views • 101 slides
Yara International ASA Bernstein Conference Petter stb, EVP, Chief Financial Officer 26

Yara International ASA Bernstein Conference Petter stb, EVP, Chief Financial Officer 26

Yara International ASA Bernstein Conference Petter stb, EVP, Chief Financial Officer 26 September 2018 Agenda Yara introduction Market fundamentals Yara strategy Targets 2 IR September 2018 Safe operations is our

1.07k views • 58 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
This talk Given a compiled YARA ruleset, how easy is it to reconstruct the individual rules?

This talk Given a compiled YARA ruleset, how easy is it to reconstruct the individual rules?

This talk Given a compiled YARA ruleset, how easy is it to reconstruct the individual rules? Strings/regular expressions seem easy. . . . . . but what about the condition syntax? Possible improvements to YARA itself Warning: Some C

270 views • 23 slides
On the Selmer group associated to a modular form and an algebraic Hecke character. Yara Elias

On the Selmer group associated to a modular form and an algebraic Hecke character. Yara Elias

On the Selmer group associated to a modular form and an algebraic Hecke character. Yara Elias McGill University April 7, 2015 Yara Elias On the Selmer group Structure of E ( K ) Mordell, Weil Let E be an elliptic curve over a number field K .

866 views • 58 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
Yara Marine Technologies We provide technologies to enable a greener maritime industry Quality

Yara Marine Technologies We provide technologies to enable a greener maritime industry Quality

Yara Marine Technologies We provide technologies to enable a greener maritime industry Quality Reliability Cost-efficiency The easy solution Yara Marine Technologies Founded in 2010 as 250+ employees in Millions of Green Tech Marine

610 views • 35 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND &amp; CONTROL QUESTIONS &amp; ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides
On Static Malware Detection Tayssir Touili LIPN, CNRS &amp; Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS &amp; Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS &amp; Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides
Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Describe types of malware See certain malware behaviors Scan and analyze malware

883 views • 25 slides
Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487

Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487

Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides based on Baileys ECE 422 Malware review How does the malware start running? Logic bomb? Trojan horse? Virus?

470 views • 27 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides

More recommend