renigma a tool to analyze malware
play

REnigma: A Tool to Analyze Malware April 23, 2018 Julian Grizzard, - PowerPoint PPT Presentation

Nov 13, 2023 •220 likes •393 views

REnigma: A Tool to Analyze Malware April 23, 2018 Julian Grizzard, Co-founder Deterministic Security, LLC James (Jim) Stevens, Co-founder Spin-off of The Johns Hopkins University Applied Physics Laboratory Need: Hard to Keep Networks Secure!

  1. REnigma: A Tool to Analyze Malware April 23, 2018 Julian Grizzard, Co-founder Deterministic Security, LLC James (Jim) Stevens, Co-founder Spin-off of The Johns Hopkins University Applied Physics Laboratory

  2. Need: Hard to Keep Networks Secure! Attempt to stop attacks before they reach the end points Network Defense Attempt to stop attacks that bypass network defenses End-Point Defense

  3. Need: Hard to Keep Networks Secure! Attempt to stop attacks before they reach the end points Network Defense Attempt to stop attacks that bypass network defenses End-Point Defense ● “PyeongChang 2018 Winter Olympics Opening Ceremony Disrupted by Malware Attacks” ● “Equifax Hack Exposes Personal Info of 143 Million US Consumers”

  4. Threat and Incident Response Incident Response Teams ● Recover from attacks that bypass all automated defenses Threat Teams Threat and Incident Response Teams ● Discover new threats and update defenses to block them REnigma focuses on threats that can make it through all automated defenses

  5. 37% 38% 11% 62% of respondents dedicate 10% full-time staff to malware analysis 2% 1% DHS-sponsored survey that includes Fortune 100, Fortune 500, S&P 500, Global 1000, and Global 2000 organizations (rounded)

  6. 18% 28% 37% 13% Highly skilled analyst (costly) requires hours, days, or sometimes 4% weeks to analyze one sample DHS-sponsored survey that includes Fortune 100, Fortune 500, S&P 500, Global 1000, and Global 2000 organizations (rounded)

  7. Approach - Overview Analyze malware Quarantine/Cleanup Alerts from Other Tools and block variants of the threat Network Defense Tools Abuse Box (Users) End-Point Defense Tools Search Logs Security Incident Threat Knowledge Hunt Team External Communities REnigma Inputs Outputs

  8. Approach - Overview Analyze malware Quarantine/Cleanup Alerts from Other Tools and block variants of the threat Network Defense Tools Abuse Box (Users) End-Point Defense Tools Search Logs Security Incident Threat Knowledge Hunt Team External Communities REnigma Inputs Outputs

  9. Approach - Overview Analyze malware Quarantine/Cleanup Alerts from Other Tools and block variants of the threat Network Defense Tools Abuse Box (Users) End-Point Defense Tools Search Logs Security Incident Threat Knowledge Hunt Team External Communities REnigma Inputs Outputs

  10. Approach - Analysis Detail 1. User uploads suspicious files or URLs to REnigma 2. REnigma records execution of sample in virtual machine (VM) ○ Interact with VM while recording 3. Analyst performs automated and/or semi-automated analysis of replay ○ Instruction-level analysis ○ “Rewind” to previous points Output: ● Deep understanding of threat ● Indicators of Compromise (IOCs)

  11. Approach - Analysis Detail 1. User uploads suspicious files or URLs to REnigma 2. REnigma records execution of sample in virtual machine (VM) ○ Interact with VM while recording 3. Analyst performs automated and/or semi-automated analysis of replay ○ Instruction-level analysis ○ “Rewind” to previous points Output: ● Deep understanding of threat ● Indicators of Compromise (IOCs)

  12. Benefits ● Record and replay functionality ● Analyst often has only “one shot” to solves critical challenges in analysis capture sample (e.g., website gone) ● Example: Easily “rewind” to ● Recording can capture point before cleanup sample before it is gone Quickly Understand New Threats Solve the “One Shot” Problem ● Export data in standard formats for ● Create online account for analysis with existing tools cloud-based service ● Example tools: IDA Pro, ● Onsite deployment Wireshark, Volatility possible Leverage Existing Analyst Skills Easy and Safe to Deploy

  13. Benefits - Feedback from Users ● Confidence in safe environment for analysis ○ Do not have to worry about setting up and securing a custom setup ○ Not detonating samples on corporate network ● Deeper knowledge of attacks that other tools don’t provide ○ Often receive alerts that something is bad but don’t know why ○ REnigma provides independent, fast, and deep understanding of attacks ● Actionable information ○ Results from REnigma used immediately to block threats ○ Able to obtain results more quickly than other tools

  14. Competition Static Analysis REnigma designed to provide ● Requires expensive and highly skilled analyst answers within minutes ● Takes weeks to analyze samples ● Example product: IDA Pro Traditional Commercial Sandbox REnigma records 100% of ● Limited to coarse-grained analysis activity to dig in deep ● Do not support replay ● Example product: Joe’s Sandbox (well known) Custom System (i.e., with open source) REnigma easy to configure ● Requires costly expert for setup/maintenance and leaves nowhere to hide ● Easy for attackers to study and evade ● Example tool: custom virtual machine

  15. REnigma Summary ● Powerful capability to quickly analyze threats that bypass your defenses ● Takes minutes rather than weeks of analysis ● Results gained from REnigma help keep your network safe

  16. DTRSEC Services ● REnigma for Enterprise IT ○ 4 month trial period ○ Host on site or in DTRSEC Cloud ○ Options for improved performance and reliability ● Malware Analysis Training ○ Operating systems and computer architecture basics ○ Study recordings of real malware in action ○ Learn advanced malware analysis with REnigma Contact us for more information Julian Grizzard, Co-Founder Jim Stevens, Co-Founder Julian@dtrsec.com Jim@dtrsec.com Deterministic Security, LLC Deterministic Security, LLC

Recommend

Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User

Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User

Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User Study Khaled Yakdan Sergej Dechand Matthew Smith Elmar Gerhards-Padilla Fraunhofer FKIE University of Bonn University of Bonn University of Bonn

426 views • 19 slides
Extracting Benefit from Harm: Using Malware Pollution to Analyze the Impact of Political and

Extracting Benefit from Harm: Using Malware Pollution to Analyze the Impact of Political and

SIGCOMM 2012 13-17 August, 2012 - Helsinki, Finland Extracting Benefit from Harm: Using Malware Pollution to Analyze the Impact of Political and Geophysical Events on the Internet A. Dainotti, R. Amman, E. Aben, K. C. Claffy alberto@caida.org

649 views • 22 slides
Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Describe types of malware See certain malware behaviors Scan and analyze malware

883 views • 25 slides
IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security

IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security

IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security professionals constantly analyze assembly language code } Many exploits are written in assembly } Source code for applications and malware is not

1.1k views • 58 slides
Introduction to the Data Library [DL] a tool to analyze and visualize data I. Introduction

Introduction to the Data Library [DL] a tool to analyze and visualize data I. Introduction

Introduction to the Data Library [DL] a tool to analyze and visualize data I. Introduction Alessandra Giannini alesall@iri.columbia.edu Ti e International Research Institute for Climate and Society The Data Library [DL] is 3 things:

701 views • 33 slides
Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software

Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software

Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software Architect 1 Agenda Problem Description Fileless Attacks Overview Common Injection Techniques Current Challenges with memory

870 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
ImmunoDB: a web based tool to analyze preclinical data Rosa LAVIERI a Gilberto FILACI b Daniela

ImmunoDB: a web based tool to analyze preclinical data Rosa LAVIERI a Gilberto FILACI b Daniela

ImmunoDB: a web based tool to analyze preclinical data Rosa LAVIERI a Gilberto FILACI b Daniela FENOGLIO b and Mauro GIACOMINI a,1 a Department of Informatics, Bioengineering, Robotics and System Engineering (DIBRIS), University of Genoa, Via Opera

603 views • 11 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Weather Typing as a Potential Tool to Analyze Tropical-Extratropical Interactions ngel G.

Weather Typing as a Potential Tool to Analyze Tropical-Extratropical Interactions ngel G.

Advanced School on Tropical-Extratropical Interactions Weather Typing as a Potential Tool to Analyze Tropical-Extratropical Interactions ngel G. Muoz agms@princeton.edu Atmospheric and Oceanic Sciences (AOS). Princeton University Advanced

584 views • 29 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides
On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides

More recommend