SlideShare uma empresa Scribd logo

BSidesNYC 2016 - An Adversarial View of SaaS Malware Sandboxes

•Transferir como PPTX, PDF•
•
Jason Trost
Jason Trost

Anyone attending this conference knows the usefulness of running malware in a sandbox to perform triage, speed security analysts' workflow, extract indicators of compromise (IOCs), and to gather useful information for detection and mitigation. When analysts do this, what are the OPSEC concerns regarding tipping the adversary off? Which sandbox providers are better than others in this regard? In this talk we will present some research on taking an adversarial view of the free and widely used SaaS malware sandboxes. When an adversary's malware is detonated in a sandbox, what network artifacts can they see? Can they determine which sandbox provider based on the network? How do malware and related IOCs submitted to these sandboxes propagate to security companies and ultimately threat intelligence feeds? In this talk, we will answer all these questions and more.

Software
1 de 34
An Adversarial View of SaaS Sandboxes Jason Trost Aaron Shelmire Jan 16th 2016
Whois Jason Jason Trost •VP of Threat Research @ ThreatStream •Previously at Sandia, DoD, Booz Allen, Endgame Inc. •Background in Big Data Analytics, Security Research, Honeypots, and Machine Learning
Whois Aaron Aaron Shelmire •Senior Threat Researcher @ ThreatStream •Previously at CERT, Secure Works CTU-SO, CMU •Background in Incident Response, Forensics, Security Research
• Advanced Malware Detects Sandboxes! • Does it? • Threat Intelligence Feeds • AV is Dead! • You’re going to tip off the adversary!!! • Everyone’s going to know I’m compromised Motivation
Experiment • Created Sensors with unique CampaignIDs • Encoded execution time and CampaignIDs in domain names • Tornado HTTP app and Bind DNS servers • Submitted unique samples to 29 free online Sandboxes • Submitted unique domains to ~50 domain/URL Reputation engines • Watched traffic roll in
Sandboxes Tested Avira Comodo Instant Malware Analysis Comodo Valkyrie F-Secure Online Analysis Joe Sandbox – Private File-analyzer.net Malwr.com NSI Payload Security ThreatExpert TotalHash ViCheck Cloud.vmray.com Ether.gtisc.gatech.edu Threat track Anubic.iseclab.com Metascan-online Eureka-cyber-ta.org Microsoft portal Online.drweb.com uploadMalware VirusTotal Virusscan.jotti.org wepawet Virscan ViCheck ThreatStream’s internal sandbox
Domain/URL Reputation Engines Tested app.webinspector.com malwaredomainlist.com senderscore.org trustedsource.org avgthreatlabs.com mxtoolbox.com/blacklists.aspx siteadvisor.com/sites unmaskparasites.com Bluecoat Web Pulse Passive Total sitecheck.sucuri.net URLVoid brightcloud.com Phishtank.com spam404.com urlblacklist.com Domain tools query Quttera spamhaus URLQuery dshield.org quttera.com Sucuri Sitecheck Virus Total URL query Fortiguard iprep reclassify.wrs.trendmicro.com SURBL VirusTotal URL domain/IP search Google Safe Browsing reputationauthority.org Threat Log vurl.mysteryfcm.co.uk Hosts-file.net safeweb.norton.com ThreatStream Web of Trust isithacked.com Scumware.org TotalHash wepawet.iseclab.org isitphishing.org senderbase.org trafficlight.bitdefender.com zulu.zscaler.com
Our Sensor – v1 Enumerate Host Sockets Based Comms Create Run Key Delete Run Key Exit Process NO REMOTE ACCESS CAPABILITY
APT TTP OMG! vpnlogin-ithelpdesk.com Filenames: anyconnect-win-4.1.04011-k9.exe vpnagent.exe svchost.exe svch0st.exe lsass.exe …
Sensor C2 – HTTP POST Exfil HTTP POST zlib compression base64 encoded Worked pretty well, but…
Sensor – v2 DNS Covert Channel C2 Some Sandboxes block TCP conns Most allow DNS unmodified zlib compression hex encode split data into chunks multiple DNS A requests
Malware Detects Sandboxes
Sandbox detection features ver. 1 • System Services Lists • Processes – VBoxService(1), vmtools (8) • MAC address • VMware, Inc. (55), Cadmus Computer Systems (40), ASUSTek COMPUTER INC. (23) • Bios • VMware (50), Bochs(34), ASUS(23), Google(8), Qemu(8) • Disk Size • 19.99GB (52), 25GB (37), 120GB (28), 50GB (20), 39GB (20) • RAM • 1GB (92), 1.5GB (18), 512MB (10) • Was the EXE renamed? • sample.exe, malware.exe, ${md5}.exe
Really Detecting Virtual Machines • System Services Lists • Processes – VBoxService(1), vmtools (8) • MAC address • VMware, Inc. (55), Cadmus Computer Systems (40), ASUSTek COMPUTER INC. (23) • Bios • VMware (50), Bochs(34), ASUS(23), Google(8), Qemu(8) • Disk Size • 19.99GB (52), 25GB (37), 120GB (28), 50GB (20), 39GB (20) • RAM • 1GB (92), 1.5GB (18), 512MB (10) • Was the EXE renamed? • sample.exe, malware.exe, ${md5}.exe
Sandbox Detection Techniques – Not Implemented • User Engagement • Dialog box, Double Click. Doc Scroll • Slow Mouse, Fast Sandbox • Execution after reboot • Pretty sure these would work • Require User engagement / Suspicion
Sandbox detection features ver. 3 • Wanted to try some new checks… • Uptime – Malware checks for over 12 minutes? • Is Sleep patched? • Is the Security Information Descriptor valid ? • Really checking if AV is emulating the process • What Group is the user in?
Sandbox detection features ver. 3 Uptime Is Sleep Patched? ValidSid Group ~60 minutes No Yes Administrators ~5 minutes No Yes Administrators ~2 minutes No Yes Administrators ~20 minutes No Yes Administrators 38 hosts w/ HTTP check in, only 4 valid check ins
Sandbox Detection Techniques -- Way too Advanced!!!! • Many companies, but only a few virtual machines used! • Same usernames • Same hostnames • Same disk size • Same CPU count •And then…
…just check the process name • artifact.exe • wbOxyeRLl6z7Jiq.exe • sampel.exe • 905DFEBA7A75DE9C6BF261CD5A076A5C5CB5FC1F.exe • samp1e_9ac36e185072270b0745ea0d68085dd9.exe GetModuleFileNameEx(hProcess, 0, lpBuff, MAX_PATH); if (lpBuff != lpszMyName) ExitProcess();
So we had some other questions… • AV? • Tipping off the adversary? • Threat Intel Feeds?
AV is Dead! • Is it?
What did AV think of our sensor? • At first…
Eventually… • VirusTotal: 6 Samples • Detection ranges from 8/57 to 30/57 • A lot of Trojan Zusy and Trojan Graftor • More malicious as time went on
3rd gen sensor… • Removed Sandbox accuracy checks • Run key that was added, then removed • Touch and Delete a file • Large amount of host profiling • Much more reasonable scoring • Accuracy is worse than before!
Sharing? • Yup, Lots • Samples shared • Evidence of new executions seen from different origins • Domain names shared (or scraped) • Previous execution’s domains resolved later by other orgs, different nameservers • Some domains appear on threat intel lists • Many orgs are trivially identified as security companies • Every major AV company is represented in our DNS logs • Several Security Product Companies
2nd Submission DNS Sensor 1st Submission Monday Morning 3rd Submission Sleep Check Tipping off the Adversary
Check In Activity 27 Trend Micro + Home Hosts Monday Morning – Everyone checks in Amazon + Google DNS Sensor
Anomalous Spikes 28 Many researchers ipVanish IPs
Sharing? – then something happened • Sharing based upon VT detections + new_file? • Takes ~4 days for files to reach VT from most sandbox sources. 1st Gen 3rd Gen HTTP unique IPs ~400 38 HTTP unique IP for source ~130 38 Valid HTTP Post 4 4 VT detections ~8/57 + 1/57
Sharing: Threat Intelligence Feeds? Campaign First DNS First HTTP Threatfeed UM 2015-08-29 22:47 2015-08-29 23:41 2015-08-30 06:33 AV 2015-08-30 17:08 2015-08-30 19:45 2015-08-30 18:43 A9 2015-09-03 20:33 2015-09-03 20:33 2015-10-24 08:55 A12 2015-09-03 20:45 2015-09-03 20:46 2015-10-27 18:47 AN 2015-09-08 07:10 2015-09-08 10:23 2015-09-08 17:55 C21 2015-10-22 00:28 - 2015-10-22 00:29 PS-Y 2016-01-11 23:21 2016-01-11 23:15 2016-01-13 04:14
Sharing: URL Reputation Services • Crafted unique campaign IDs and timestamp domains • Made queries for unique domains to ~50 reputation engines • Three sites resulted in daily DNS lookups spanning > 5 days • Two resulted in daily DNS lookups spanning nearly 2 months • Most major AV/security companies networks represented • YOUR QUERIES ARE SHARED (implicitly?/explicitly?) • When you query these sites, you lose control of the domain/URL
Threat Intel vs the Sandbox IPs? • Of all the Sandbox IPs that made valid POST requests to our server 15 were also identified in some threat intelligence feeds as malicious • 6 were TOR IPs • 1 was an Anonymous proxy • All others were characterized: • Bot IPs • Spammer IPs • Brute Force IPs • Scanning IPs • Compromised IPs (Hawkeye Keylogger, Dyre) • Interesting, but not surprising
Lessons • Most people use the same Sandbox Images • Most sandboxes don’t change the environment settings across executions • AV thinks your file is malicious • You will tip off the adversary • Everyone will hit their network touch points … forever … • Reputation services can result in noisy traffic to the NS • Malware sandboxes can be fingerprinted with very simple techniques • You get what you pay for
Contact Jason Trost • @jason_trost • jason [dot] trost [AT] threatstream [dot] com • https://github.com/jt6211 Aaron Shelmire •@Ashelmire •aaron[dot] shelmire [AT] threatstream [dot] com

Recomendados

An Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesAn Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesJason Trost
 
Distributed Sensor Data Contextualization for Threat Intelligence Analysis
Distributed Sensor Data Contextualization for Threat Intelligence AnalysisDistributed Sensor Data Contextualization for Threat Intelligence Analysis
Distributed Sensor Data Contextualization for Threat Intelligence AnalysisJason Trost
 
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...Jason Trost
 
R-CISC Summit 2016 Borderless Threat Intelligence
R-CISC Summit 2016 Borderless Threat IntelligenceR-CISC Summit 2016 Borderless Threat Intelligence
R-CISC Summit 2016 Borderless Threat IntelligenceJason Trost
 
Anomali Detect 2016 - Borderless Threat Intelligence
Anomali Detect 2016 - Borderless Threat IntelligenceAnomali Detect 2016 - Borderless Threat Intelligence
Anomali Detect 2016 - Borderless Threat IntelligenceJason Trost
 
Modern Honey Network (MHN)
Modern Honey Network (MHN)Modern Honey Network (MHN)
Modern Honey Network (MHN)Jason Trost
 
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...Andrew Morris
 
SANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceSANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceJason Trost
 

Recomendados

An Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesAn Adversarial View of SaaS Malware Sandboxes
An Adversarial View of SaaS Malware SandboxesJason Trost
 
Distributed Sensor Data Contextualization for Threat Intelligence Analysis
Distributed Sensor Data Contextualization for Threat Intelligence AnalysisDistributed Sensor Data Contextualization for Threat Intelligence Analysis
Distributed Sensor Data Contextualization for Threat Intelligence AnalysisJason Trost
 
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...
Deploying, Managing, and Leveraging Honeypots in the Enterprise using Open So...Jason Trost
 
R-CISC Summit 2016 Borderless Threat Intelligence
R-CISC Summit 2016 Borderless Threat IntelligenceR-CISC Summit 2016 Borderless Threat Intelligence
R-CISC Summit 2016 Borderless Threat IntelligenceJason Trost
 
Anomali Detect 2016 - Borderless Threat Intelligence
Anomali Detect 2016 - Borderless Threat IntelligenceAnomali Detect 2016 - Borderless Threat Intelligence
Anomali Detect 2016 - Borderless Threat IntelligenceJason Trost
 
Modern Honey Network (MHN)
Modern Honey Network (MHN)Modern Honey Network (MHN)
Modern Honey Network (MHN)Jason Trost
 
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...
Identifying and Correlating Internet-wide Scan Traffic to Newsworthy Security...Andrew Morris
 
SANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceSANS CTI Summit 2016 Borderless Threat Intelligence
SANS CTI Summit 2016 Borderless Threat IntelligenceJason Trost
 
The Background Noise of the Internet
The Background Noise of the InternetThe Background Noise of the Internet
The Background Noise of the InternetAndrew Morris
 
Threat Intelligence Field of Dreams
Threat Intelligence Field of DreamsThreat Intelligence Field of Dreams
Threat Intelligence Field of DreamsGreg Foss
 
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzBSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzChristopher Gerritz
 
Incident Response for the Work-from-home Workforce
Incident Response for the Work-from-home WorkforceIncident Response for the Work-from-home Workforce
Incident Response for the Work-from-home WorkforceChristopher Gerritz
 
H@dfex 2015 malware analysis
H@dfex 2015 malware analysisH@dfex 2015 malware analysis
H@dfex 2015 malware analysisCharles Lim
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Chi En (Ashley) Shen
 
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...Andrew Morris
 
BSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysBSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysJoff Thyer
 
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud XiaoFruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud XiaoShakacon
 
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...BlueHat Security Conference
 
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud Service
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud ServiceLet’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud Service
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud ServiceChi En (Ashley) Shen
 
External to DA, the OS X Way
External to DA, the OS X WayExternal to DA, the OS X Way
External to DA, the OS X WayStephan Borosh
 
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg day
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg dayCSW2017 Kyle ehmke lots of squats- ap-ts never miss leg day
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg dayCanSecWest
 
Weekend Malware Research 2012
Weekend Malware Research 2012Weekend Malware Research 2012
Weekend Malware Research 2012Andrew Morris
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016Matthew Dunwoody
 
Attacker's Perspective of Active Directory
Attacker's Perspective of Active DirectoryAttacker's Perspective of Active Directory
Attacker's Perspective of Active DirectorySunny Neo
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationRaffael Marty
 
Top 10 Threats to Cloud Security
Top 10 Threats to Cloud SecurityTop 10 Threats to Cloud Security
Top 10 Threats to Cloud SecuritySBWebinars
 
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows toolIntroducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows toolMichael Gough
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseLuca Simonelli
 
Rescue1.asd
Rescue1.asdRescue1.asd
Rescue1.asdmahmoud shetewy
 
Eye Catching Photos
Eye Catching PhotosEye Catching Photos
Eye Catching PhotosYee Seng Gan
 

Mais conteúdo relacionado

Mais procurados

The Background Noise of the Internet
The Background Noise of the InternetThe Background Noise of the Internet
The Background Noise of the InternetAndrew Morris
 
Threat Intelligence Field of Dreams
Threat Intelligence Field of DreamsThreat Intelligence Field of Dreams
Threat Intelligence Field of DreamsGreg Foss
 
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzBSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzChristopher Gerritz
 
Incident Response for the Work-from-home Workforce
Incident Response for the Work-from-home WorkforceIncident Response for the Work-from-home Workforce
Incident Response for the Work-from-home WorkforceChristopher Gerritz
 
H@dfex 2015 malware analysis
H@dfex 2015 malware analysisH@dfex 2015 malware analysis
H@dfex 2015 malware analysisCharles Lim
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Chi En (Ashley) Shen
 
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...Andrew Morris
 
BSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysBSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysJoff Thyer
 
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud XiaoFruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud XiaoShakacon
 
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...BlueHat Security Conference
 
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud Service
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud ServiceLet’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud Service
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud ServiceChi En (Ashley) Shen
 
External to DA, the OS X Way
External to DA, the OS X WayExternal to DA, the OS X Way
External to DA, the OS X WayStephan Borosh
 
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg day
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg dayCSW2017 Kyle ehmke lots of squats- ap-ts never miss leg day
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg dayCanSecWest
 
Weekend Malware Research 2012
Weekend Malware Research 2012Weekend Malware Research 2012
Weekend Malware Research 2012Andrew Morris
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016Matthew Dunwoody
 
Attacker's Perspective of Active Directory
Attacker's Perspective of Active DirectoryAttacker's Perspective of Active Directory
Attacker's Perspective of Active DirectorySunny Neo
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationRaffael Marty
 
Top 10 Threats to Cloud Security
Top 10 Threats to Cloud SecurityTop 10 Threats to Cloud Security
Top 10 Threats to Cloud SecuritySBWebinars
 
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows toolIntroducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows toolMichael Gough
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseLuca Simonelli
 

Mais procurados (20)

The Background Noise of the Internet
The Background Noise of the InternetThe Background Noise of the Internet
The Background Noise of the Internet
 
Threat Intelligence Field of Dreams
Threat Intelligence Field of DreamsThreat Intelligence Field of Dreams
Threat Intelligence Field of Dreams
 
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzBSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
 
Incident Response for the Work-from-home Workforce
Incident Response for the Work-from-home WorkforceIncident Response for the Work-from-home Workforce
Incident Response for the Work-from-home Workforce
 
H@dfex 2015 malware analysis
H@dfex 2015 malware analysisH@dfex 2015 malware analysis
H@dfex 2015 malware analysis
 
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
Catching the Golden Snitch- Leveraging Threat Intelligence Platforms to Defen...
 
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
BSidesCharleston2014 - Ballin on a Budget: Tracking Chinese Malware Campaigns...
 
BSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad GuysBSIDES-PR Keynote Hunting for Bad Guys
BSIDES-PR Keynote Hunting for Bad Guys
 
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud XiaoFruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
Fruit vs Zombies: Defeat Non-jailbroken iOS Malware by Claud Xiao
 
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...
BlueHat v17 || A Lustrum of Malware Network Communication: Evolution and Insi...
 
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud Service
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud ServiceLet’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud Service
Let’s Play Hide and Seek In the Cloud The APT Malwares Favored in Cloud Service
 
External to DA, the OS X Way
External to DA, the OS X WayExternal to DA, the OS X Way
External to DA, the OS X Way
 
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg day
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg dayCSW2017 Kyle ehmke lots of squats- ap-ts never miss leg day
CSW2017 Kyle ehmke lots of squats- ap-ts never miss leg day
 
Weekend Malware Research 2012
Weekend Malware Research 2012Weekend Malware Research 2012
Weekend Malware Research 2012
 
No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
 
Attacker's Perspective of Active Directory
Attacker's Perspective of Active DirectoryAttacker's Perspective of Active Directory
Attacker's Perspective of Active Directory
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
 
Top 10 Threats to Cloud Security
Top 10 Threats to Cloud SecurityTop 10 Threats to Cloud Security
Top 10 Threats to Cloud Security
 
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows toolIntroducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
Introducing ArTHIR - ATT&CK Remote Threat Hunting Incident Response Windows tool
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and Defense
 

Destaque

Eye Catching Photos
Eye Catching PhotosEye Catching Photos
Eye Catching PhotosYee Seng Gan
 
Nair jure123456
Nair jure123456Nair jure123456
Nair jure123456nairjure
 
Merkel double wiper_pt-1
Merkel double wiper_pt-1Merkel double wiper_pt-1
Merkel double wiper_pt-1walleseals
 
6847575 a-saga-dos-foxworth-4-sementes-do-passado-virginia-c-andrews
6847575 a-saga-dos-foxworth-4-sementes-do-passado-virginia-c-andrews6847575 a-saga-dos-foxworth-4-sementes-do-passado-virginia-c-andrews
6847575 a-saga-dos-foxworth-4-sementes-do-passado-virginia-c-andrewsAlessandra Vidal
 
Some for all rather than more for some: A myth or an opportunity lost?
Some for all rather than more for some: A myth or an opportunity lost?Some for all rather than more for some: A myth or an opportunity lost?
Some for all rather than more for some: A myth or an opportunity lost?STEPS Centre
 
Helping each other grow
Helping each other growHelping each other grow
Helping each other growHarry Jarrett
 
Aceds 2011 E Discovery Conference Brochure Seth Row Voucher
Aceds 2011 E Discovery Conference Brochure Seth Row VoucherAceds 2011 E Discovery Conference Brochure Seth Row Voucher
Aceds 2011 E Discovery Conference Brochure Seth Row VoucherSeth Row
 
Words Associated with Questions about Macros in Tex
Words Associated with Questions about Macros in TexWords Associated with Questions about Macros in Tex
Words Associated with Questions about Macros in TexAngela Lozano
 
Wamye Be Taniisaken!
Wamye Be Taniisaken!Wamye Be Taniisaken!
Wamye Be Taniisaken!Keti Tseradze
 
Happy birthday to Prof. Yunus - you change foundation
Happy birthday to Prof. Yunus - you change foundationHappy birthday to Prof. Yunus - you change foundation
Happy birthday to Prof. Yunus - you change foundationThe Grameen Creative Lab
 
He devoted his life for the pride and honor of the country
He devoted his life for the pride and honor of the countryHe devoted his life for the pride and honor of the country
He devoted his life for the pride and honor of the countrysatish kumar
 
Building A Social Network Waa 1 17 07 V2 Draft
Building A Social Network Waa 1 17 07 V2 DraftBuilding A Social Network Waa 1 17 07 V2 Draft
Building A Social Network Waa 1 17 07 V2 DraftMarshall Sponder
 
Corporate Image Consulting
Corporate Image ConsultingCorporate Image Consulting
Corporate Image Consultingrobertsol
 
2006增刊目录
2006增刊目录2006增刊目录
2006增刊目录guest2bb2c
 

Destaque (18)

Rescue1.asd
Rescue1.asdRescue1.asd
Rescue1.asd
 
Eye Catching Photos
Eye Catching PhotosEye Catching Photos
Eye Catching Photos
 
Nair jure123456
Nair jure123456Nair jure123456
Nair jure123456
 
Merkel double wiper_pt-1
Merkel double wiper_pt-1Merkel double wiper_pt-1
Merkel double wiper_pt-1
 
6847575 a-saga-dos-foxworth-4-sementes-do-passado-virginia-c-andrews
6847575 a-saga-dos-foxworth-4-sementes-do-passado-virginia-c-andrews6847575 a-saga-dos-foxworth-4-sementes-do-passado-virginia-c-andrews
6847575 a-saga-dos-foxworth-4-sementes-do-passado-virginia-c-andrews
 
Anh vui
Anh vuiAnh vui
Anh vui
 
Some for all rather than more for some: A myth or an opportunity lost?
Some for all rather than more for some: A myth or an opportunity lost?Some for all rather than more for some: A myth or an opportunity lost?
Some for all rather than more for some: A myth or an opportunity lost?
 
Helping each other grow
Helping each other growHelping each other grow
Helping each other grow
 
Aceds 2011 E Discovery Conference Brochure Seth Row Voucher
Aceds 2011 E Discovery Conference Brochure Seth Row VoucherAceds 2011 E Discovery Conference Brochure Seth Row Voucher
Aceds 2011 E Discovery Conference Brochure Seth Row Voucher
 
Words Associated with Questions about Macros in Tex
Words Associated with Questions about Macros in TexWords Associated with Questions about Macros in Tex
Words Associated with Questions about Macros in Tex
 
Wamye Be Taniisaken!
Wamye Be Taniisaken!Wamye Be Taniisaken!
Wamye Be Taniisaken!
 
Happy birthday to Prof. Yunus - you change foundation
Happy birthday to Prof. Yunus - you change foundationHappy birthday to Prof. Yunus - you change foundation
Happy birthday to Prof. Yunus - you change foundation
 
He devoted his life for the pride and honor of the country
He devoted his life for the pride and honor of the countryHe devoted his life for the pride and honor of the country
He devoted his life for the pride and honor of the country
 
A turukott 100tk
A turukott 100tkA turukott 100tk
A turukott 100tk
 
Versos
VersosVersos
Versos
 
Building A Social Network Waa 1 17 07 V2 Draft
Building A Social Network Waa 1 17 07 V2 DraftBuilding A Social Network Waa 1 17 07 V2 Draft
Building A Social Network Waa 1 17 07 V2 Draft
 
Corporate Image Consulting
Corporate Image ConsultingCorporate Image Consulting
Corporate Image Consulting
 
2006增刊目录
2006增刊目录2006增刊目录
2006增刊目录
 

Semelhante a BSidesNYC 2016 - An Adversarial View of SaaS Malware Sandboxes

Hunting on the cheap
Hunting on the cheapHunting on the cheap
Hunting on the cheapAnjum Ahuja
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the CheapEndgameInc
 
Sandbox vs manual malware analysis v1.1
Sandbox vs manual malware analysis v1.1Sandbox vs manual malware analysis v1.1
Sandbox vs manual malware analysis v1.1Michael Gough
 
Building next gen malware behavioural analysis environment
Building next gen malware behavioural analysis environment Building next gen malware behavioural analysis environment
Building next gen malware behavioural analysis environment isc2-hellenic
 
Let's Talk Technical: Malware Evasion and Detection
Let's Talk Technical: Malware Evasion and DetectionLet's Talk Technical: Malware Evasion and Detection
Let's Talk Technical: Malware Evasion and DetectionJames Haughom Jr
 
Malware analysis _ Threat Intelligence Morocco
Malware analysis _ Threat Intelligence MoroccoMalware analysis _ Threat Intelligence Morocco
Malware analysis _ Threat Intelligence MoroccoTouhami Kasbaoui
 
Breaking Smart Speakers: We are Listening to You.
Breaking Smart Speakers: We are Listening to You.Breaking Smart Speakers: We are Listening to You.
Breaking Smart Speakers: We are Listening to You.Priyanka Aash
 
Sandbox detection: leak, abuse, test - Hacktivity 2015
Sandbox detection: leak, abuse, test - Hacktivity 2015Sandbox detection: leak, abuse, test - Hacktivity 2015
Sandbox detection: leak, abuse, test - Hacktivity 2015Zoltan Balazs
 
White Lightning Sept 2014
White Lightning Sept 2014White Lightning Sept 2014
White Lightning Sept 2014Bryce Kunz
 
Automation Attacks At Scale
Automation Attacks At ScaleAutomation Attacks At Scale
Automation Attacks At ScaleMayank Dhiman
 
Logs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thiefLogs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thiefMichael Gough
 
Logging for hackers SAINTCON
Logging for hackers SAINTCONLogging for hackers SAINTCON
Logging for hackers SAINTCONMichael Gough
 
Hacklu2011 tricaud
Hacklu2011 tricaudHacklu2011 tricaud
Hacklu2011 tricaudstricaud
 
Logging for Hackers - What you need to know to catch them
Logging for Hackers - What you need to know to catch themLogging for Hackers - What you need to know to catch them
Logging for Hackers - What you need to know to catch themMichael Gough
 
What are-you-investigate-today? (version 2.0)
What are-you-investigate-today? (version 2.0)What are-you-investigate-today? (version 2.0)
What are-you-investigate-today? (version 2.0)Xavier Mertens
 
Thinking Outside the Sand[box]
Thinking Outside the Sand[box]Thinking Outside the Sand[box]
Thinking Outside the Sand[box]Juniper Networks
 
Principles of Chaos Engineering
Principles of Chaos EngineeringPrinciples of Chaos Engineering
Principles of Chaos Engineeringh_marvin
 
Workshop on Network Security
Workshop on Network SecurityWorkshop on Network Security
Workshop on Network SecurityUC San Diego
 

Semelhante a BSidesNYC 2016 - An Adversarial View of SaaS Malware Sandboxes (20)

Hunting on the cheap
Hunting on the cheapHunting on the cheap
Hunting on the cheap
 
Hunting on the Cheap
Hunting on the CheapHunting on the Cheap
Hunting on the Cheap
 
Sandbox vs manual malware analysis v1.1
Sandbox vs manual malware analysis v1.1Sandbox vs manual malware analysis v1.1
Sandbox vs manual malware analysis v1.1
 
Building next gen malware behavioural analysis environment
Building next gen malware behavioural analysis environment Building next gen malware behavioural analysis environment
Building next gen malware behavioural analysis environment
 
Malware analysis
Malware analysisMalware analysis
Malware analysis
 
Let's Talk Technical: Malware Evasion and Detection
Let's Talk Technical: Malware Evasion and DetectionLet's Talk Technical: Malware Evasion and Detection
Let's Talk Technical: Malware Evasion and Detection
 
Checksum 101
Checksum 101Checksum 101
Checksum 101
 
Malware analysis _ Threat Intelligence Morocco
Malware analysis _ Threat Intelligence MoroccoMalware analysis _ Threat Intelligence Morocco
Malware analysis _ Threat Intelligence Morocco
 
Breaking Smart Speakers: We are Listening to You.
Breaking Smart Speakers: We are Listening to You.Breaking Smart Speakers: We are Listening to You.
Breaking Smart Speakers: We are Listening to You.
 
Sandbox detection: leak, abuse, test - Hacktivity 2015
Sandbox detection: leak, abuse, test - Hacktivity 2015Sandbox detection: leak, abuse, test - Hacktivity 2015
Sandbox detection: leak, abuse, test - Hacktivity 2015
 
White Lightning Sept 2014
White Lightning Sept 2014White Lightning Sept 2014
White Lightning Sept 2014
 
Automation Attacks At Scale
Automation Attacks At ScaleAutomation Attacks At Scale
Automation Attacks At Scale
 
Logs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thiefLogs, Logs, Logs - What you need to know to catch a thief
Logs, Logs, Logs - What you need to know to catch a thief
 
Logging for hackers SAINTCON
Logging for hackers SAINTCONLogging for hackers SAINTCON
Logging for hackers SAINTCON
 
Hacklu2011 tricaud
Hacklu2011 tricaudHacklu2011 tricaud
Hacklu2011 tricaud
 
Logging for Hackers - What you need to know to catch them
Logging for Hackers - What you need to know to catch themLogging for Hackers - What you need to know to catch them
Logging for Hackers - What you need to know to catch them
 
What are-you-investigate-today? (version 2.0)
What are-you-investigate-today? (version 2.0)What are-you-investigate-today? (version 2.0)
What are-you-investigate-today? (version 2.0)
 
Thinking Outside the Sand[box]
Thinking Outside the Sand[box]Thinking Outside the Sand[box]
Thinking Outside the Sand[box]
 
Principles of Chaos Engineering
Principles of Chaos EngineeringPrinciples of Chaos Engineering
Principles of Chaos Engineering
 
Workshop on Network Security
Workshop on Network SecurityWorkshop on Network Security
Workshop on Network Security
 

Último

Odoo 14 - eLearning Module In Odoo 14 Enterprise
Odoo 14 - eLearning Module In Odoo 14 EnterpriseOdoo 14 - eLearning Module In Odoo 14 Enterprise
Odoo 14 - eLearning Module In Odoo 14 Enterprisepreethippts
 
Simplifying Microservices & Apps - The art of effortless development - Meetup...
Simplifying Microservices & Apps - The art of effortless development - Meetup...Simplifying Microservices & Apps - The art of effortless development - Meetup...
Simplifying Microservices & Apps - The art of effortless development - Meetup...Rob Geurden
 
Implementing Zero Trust strategy with Azure
Implementing Zero Trust strategy with AzureImplementing Zero Trust strategy with Azure
Implementing Zero Trust strategy with AzureDinusha Kumarasiri
 
VK Business Profile - provides IT solutions and Web Development
VK Business Profile - provides IT solutions and Web DevelopmentVK Business Profile - provides IT solutions and Web Development
VK Business Profile - provides IT solutions and Web Developmentvyaparkranti
 
Post Quantum Cryptography – The Impact on Identity
Post Quantum Cryptography – The Impact on IdentityPost Quantum Cryptography – The Impact on Identity
Post Quantum Cryptography – The Impact on Identityteam-WIBU
 
Powering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsPowering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsSafe Software
 
MYjobs Presentation Django-based project
MYjobs Presentation Django-based projectMYjobs Presentation Django-based project
MYjobs Presentation Django-based projectAnoyGreter
 
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...Cizo Technology Services
 
Understanding Flamingo - DeepMind's VLM Architecture
Understanding Flamingo - DeepMind's VLM ArchitectureUnderstanding Flamingo - DeepMind's VLM Architecture
Understanding Flamingo - DeepMind's VLM Architecturerahul_net
 
SuccessFactors 1H 2024 Release - Sneak-Peek by Deloitte Germany
SuccessFactors 1H 2024 Release - Sneak-Peek by Deloitte GermanySuccessFactors 1H 2024 Release - Sneak-Peek by Deloitte Germany
SuccessFactors 1H 2024 Release - Sneak-Peek by Deloitte GermanyChristoph Pohl
 
How to submit a standout Adobe Champion Application
How to submit a standout Adobe Champion ApplicationHow to submit a standout Adobe Champion Application
How to submit a standout Adobe Champion ApplicationBradBedford3
 
Call Us🔝>༒+91-9711147426⇛Call In girls karol bagh (Delhi)
Call Us🔝>༒+91-9711147426⇛Call In girls karol bagh (Delhi)Call Us🔝>༒+91-9711147426⇛Call In girls karol bagh (Delhi)
Call Us🔝>༒+91-9711147426⇛Call In girls karol bagh (Delhi)jennyeacort
 
Unveiling the Future: Sylius 2.0 New Features
Unveiling the Future: Sylius 2.0 New FeaturesUnveiling the Future: Sylius 2.0 New Features
Unveiling the Future: Sylius 2.0 New FeaturesŁukasz Chruściel
 
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Angel Borroy López
 
20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...
20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...
20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...Akihiro Suda
 
Software Project Health Check: Best Practices and Techniques for Your Product...
Software Project Health Check: Best Practices and Techniques for Your Product...Software Project Health Check: Best Practices and Techniques for Your Product...
Software Project Health Check: Best Practices and Techniques for Your Product...Velvetech LLC
 
Precise and Complete Requirements? An Elusive Goal
Precise and Complete Requirements? An Elusive GoalPrecise and Complete Requirements? An Elusive Goal
Precise and Complete Requirements? An Elusive GoalLionel Briand
 
Machine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringMachine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringHironori Washizaki
 
Cloud Data Center Network Construction - IEEE
Cloud Data Center Network Construction - IEEECloud Data Center Network Construction - IEEE
Cloud Data Center Network Construction - IEEEVICTOR MAESTRE RAMIREZ
 
Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...
Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...
Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...OnePlan Solutions
 

Último (20)

Odoo 14 - eLearning Module In Odoo 14 Enterprise
Odoo 14 - eLearning Module In Odoo 14 EnterpriseOdoo 14 - eLearning Module In Odoo 14 Enterprise
Odoo 14 - eLearning Module In Odoo 14 Enterprise
 
Simplifying Microservices & Apps - The art of effortless development - Meetup...
Simplifying Microservices & Apps - The art of effortless development - Meetup...Simplifying Microservices & Apps - The art of effortless development - Meetup...
Simplifying Microservices & Apps - The art of effortless development - Meetup...
 
Implementing Zero Trust strategy with Azure
Implementing Zero Trust strategy with AzureImplementing Zero Trust strategy with Azure
Implementing Zero Trust strategy with Azure
 
VK Business Profile - provides IT solutions and Web Development
VK Business Profile - provides IT solutions and Web DevelopmentVK Business Profile - provides IT solutions and Web Development
VK Business Profile - provides IT solutions and Web Development
 
Post Quantum Cryptography – The Impact on Identity
Post Quantum Cryptography – The Impact on IdentityPost Quantum Cryptography – The Impact on Identity
Post Quantum Cryptography – The Impact on Identity
 
Powering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data StreamsPowering Real-Time Decisions with Continuous Data Streams
Powering Real-Time Decisions with Continuous Data Streams
 
MYjobs Presentation Django-based project
MYjobs Presentation Django-based projectMYjobs Presentation Django-based project
MYjobs Presentation Django-based project
 
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
Global Identity Enrolment and Verification Pro Solution - Cizo Technology Ser...
 
Understanding Flamingo - DeepMind's VLM Architecture
Understanding Flamingo - DeepMind's VLM ArchitectureUnderstanding Flamingo - DeepMind's VLM Architecture
Understanding Flamingo - DeepMind's VLM Architecture
 
SuccessFactors 1H 2024 Release - Sneak-Peek by Deloitte Germany
SuccessFactors 1H 2024 Release - Sneak-Peek by Deloitte GermanySuccessFactors 1H 2024 Release - Sneak-Peek by Deloitte Germany
SuccessFactors 1H 2024 Release - Sneak-Peek by Deloitte Germany
 
How to submit a standout Adobe Champion Application
How to submit a standout Adobe Champion ApplicationHow to submit a standout Adobe Champion Application
How to submit a standout Adobe Champion Application
 
Call Us🔝>༒+91-9711147426⇛Call In girls karol bagh (Delhi)
Call Us🔝>༒+91-9711147426⇛Call In girls karol bagh (Delhi)Call Us🔝>༒+91-9711147426⇛Call In girls karol bagh (Delhi)
Call Us🔝>༒+91-9711147426⇛Call In girls karol bagh (Delhi)
 
Unveiling the Future: Sylius 2.0 New Features
Unveiling the Future: Sylius 2.0 New FeaturesUnveiling the Future: Sylius 2.0 New Features
Unveiling the Future: Sylius 2.0 New Features
 
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
Alfresco TTL#157 - Troubleshooting Made Easy: Deciphering Alfresco mTLS Confi...
 
20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...
20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...
20240415 [Container Plumbing Days] Usernetes Gen2 - Kubernetes in Rootless Do...
 
Software Project Health Check: Best Practices and Techniques for Your Product...
Software Project Health Check: Best Practices and Techniques for Your Product...Software Project Health Check: Best Practices and Techniques for Your Product...
Software Project Health Check: Best Practices and Techniques for Your Product...
 
Precise and Complete Requirements? An Elusive Goal
Precise and Complete Requirements? An Elusive GoalPrecise and Complete Requirements? An Elusive Goal
Precise and Complete Requirements? An Elusive Goal
 
Machine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their EngineeringMachine Learning Software Engineering Patterns and Their Engineering
Machine Learning Software Engineering Patterns and Their Engineering
 
Cloud Data Center Network Construction - IEEE
Cloud Data Center Network Construction - IEEECloud Data Center Network Construction - IEEE
Cloud Data Center Network Construction - IEEE
 
Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...
Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...
Tech Tuesday - Mastering Time Management Unlock the Power of OnePlan's Timesh...
 

BSidesNYC 2016 - An Adversarial View of SaaS Malware Sandboxes

  • 1. An Adversarial View of SaaS Sandboxes Jason Trost Aaron Shelmire Jan 16th 2016
  • 2. Whois Jason Jason Trost •VP of Threat Research @ ThreatStream •Previously at Sandia, DoD, Booz Allen, Endgame Inc. •Background in Big Data Analytics, Security Research, Honeypots, and Machine Learning
  • 3. Whois Aaron Aaron Shelmire •Senior Threat Researcher @ ThreatStream •Previously at CERT, Secure Works CTU-SO, CMU •Background in Incident Response, Forensics, Security Research
  • 4. • Advanced Malware Detects Sandboxes! • Does it? • Threat Intelligence Feeds • AV is Dead! • You’re going to tip off the adversary!!! • Everyone’s going to know I’m compromised Motivation
  • 5. Experiment • Created Sensors with unique CampaignIDs • Encoded execution time and CampaignIDs in domain names • Tornado HTTP app and Bind DNS servers • Submitted unique samples to 29 free online Sandboxes • Submitted unique domains to ~50 domain/URL Reputation engines • Watched traffic roll in
  • 6. Sandboxes Tested Avira Comodo Instant Malware Analysis Comodo Valkyrie F-Secure Online Analysis Joe Sandbox – Private File-analyzer.net Malwr.com NSI Payload Security ThreatExpert TotalHash ViCheck Cloud.vmray.com Ether.gtisc.gatech.edu Threat track Anubic.iseclab.com Metascan-online Eureka-cyber-ta.org Microsoft portal Online.drweb.com uploadMalware VirusTotal Virusscan.jotti.org wepawet Virscan ViCheck ThreatStream’s internal sandbox
  • 7. Domain/URL Reputation Engines Tested app.webinspector.com malwaredomainlist.com senderscore.org trustedsource.org avgthreatlabs.com mxtoolbox.com/blacklists.aspx siteadvisor.com/sites unmaskparasites.com Bluecoat Web Pulse Passive Total sitecheck.sucuri.net URLVoid brightcloud.com Phishtank.com spam404.com urlblacklist.com Domain tools query Quttera spamhaus URLQuery dshield.org quttera.com Sucuri Sitecheck Virus Total URL query Fortiguard iprep reclassify.wrs.trendmicro.com SURBL VirusTotal URL domain/IP search Google Safe Browsing reputationauthority.org Threat Log vurl.mysteryfcm.co.uk Hosts-file.net safeweb.norton.com ThreatStream Web of Trust isithacked.com Scumware.org TotalHash wepawet.iseclab.org isitphishing.org senderbase.org trafficlight.bitdefender.com zulu.zscaler.com
  • 8. Our Sensor – v1 Enumerate Host Sockets Based Comms Create Run Key Delete Run Key Exit Process NO REMOTE ACCESS CAPABILITY
  • 10. Sensor C2 – HTTP POST Exfil HTTP POST zlib compression base64 encoded Worked pretty well, but…
  • 11. Sensor – v2 DNS Covert Channel C2 Some Sandboxes block TCP conns Most allow DNS unmodified zlib compression hex encode split data into chunks multiple DNS A requests
  • 13. Sandbox detection features ver. 1 • System Services Lists • Processes – VBoxService(1), vmtools (8) • MAC address • VMware, Inc. (55), Cadmus Computer Systems (40), ASUSTek COMPUTER INC. (23) • Bios • VMware (50), Bochs(34), ASUS(23), Google(8), Qemu(8) • Disk Size • 19.99GB (52), 25GB (37), 120GB (28), 50GB (20), 39GB (20) • RAM • 1GB (92), 1.5GB (18), 512MB (10) • Was the EXE renamed? • sample.exe, malware.exe, ${md5}.exe
  • 14. Really Detecting Virtual Machines • System Services Lists • Processes – VBoxService(1), vmtools (8) • MAC address • VMware, Inc. (55), Cadmus Computer Systems (40), ASUSTek COMPUTER INC. (23) • Bios • VMware (50), Bochs(34), ASUS(23), Google(8), Qemu(8) • Disk Size • 19.99GB (52), 25GB (37), 120GB (28), 50GB (20), 39GB (20) • RAM • 1GB (92), 1.5GB (18), 512MB (10) • Was the EXE renamed? • sample.exe, malware.exe, ${md5}.exe
  • 15. Sandbox Detection Techniques – Not Implemented • User Engagement • Dialog box, Double Click. Doc Scroll • Slow Mouse, Fast Sandbox • Execution after reboot • Pretty sure these would work • Require User engagement / Suspicion
  • 16. Sandbox detection features ver. 3 • Wanted to try some new checks… • Uptime – Malware checks for over 12 minutes? • Is Sleep patched? • Is the Security Information Descriptor valid ? • Really checking if AV is emulating the process • What Group is the user in?
  • 17. Sandbox detection features ver. 3 Uptime Is Sleep Patched? ValidSid Group ~60 minutes No Yes Administrators ~5 minutes No Yes Administrators ~2 minutes No Yes Administrators ~20 minutes No Yes Administrators 38 hosts w/ HTTP check in, only 4 valid check ins
  • 18. Sandbox Detection Techniques -- Way too Advanced!!!! • Many companies, but only a few virtual machines used! • Same usernames • Same hostnames • Same disk size • Same CPU count •And then…
  • 19. …just check the process name • artifact.exe • wbOxyeRLl6z7Jiq.exe • sampel.exe • 905DFEBA7A75DE9C6BF261CD5A076A5C5CB5FC1F.exe • samp1e_9ac36e185072270b0745ea0d68085dd9.exe GetModuleFileNameEx(hProcess, 0, lpBuff, MAX_PATH); if (lpBuff != lpszMyName) ExitProcess();
  • 20. So we had some other questions… • AV? • Tipping off the adversary? • Threat Intel Feeds?
  • 21. AV is Dead! • Is it?
  • 22. What did AV think of our sensor? • At first…
  • 23. Eventually… • VirusTotal: 6 Samples • Detection ranges from 8/57 to 30/57 • A lot of Trojan Zusy and Trojan Graftor • More malicious as time went on
  • 24. 3rd gen sensor… • Removed Sandbox accuracy checks • Run key that was added, then removed • Touch and Delete a file • Large amount of host profiling • Much more reasonable scoring • Accuracy is worse than before!
  • 25. Sharing? • Yup, Lots • Samples shared • Evidence of new executions seen from different origins • Domain names shared (or scraped) • Previous execution’s domains resolved later by other orgs, different nameservers • Some domains appear on threat intel lists • Many orgs are trivially identified as security companies • Every major AV company is represented in our DNS logs • Several Security Product Companies
  • 26. 2nd Submission DNS Sensor 1st Submission Monday Morning 3rd Submission Sleep Check Tipping off the Adversary
  • 27. Check In Activity 27 Trend Micro + Home Hosts Monday Morning – Everyone checks in Amazon + Google DNS Sensor
  • 29. Sharing? – then something happened • Sharing based upon VT detections + new_file? • Takes ~4 days for files to reach VT from most sandbox sources. 1st Gen 3rd Gen HTTP unique IPs ~400 38 HTTP unique IP for source ~130 38 Valid HTTP Post 4 4 VT detections ~8/57 + 1/57
  • 30. Sharing: Threat Intelligence Feeds? Campaign First DNS First HTTP Threatfeed UM 2015-08-29 22:47 2015-08-29 23:41 2015-08-30 06:33 AV 2015-08-30 17:08 2015-08-30 19:45 2015-08-30 18:43 A9 2015-09-03 20:33 2015-09-03 20:33 2015-10-24 08:55 A12 2015-09-03 20:45 2015-09-03 20:46 2015-10-27 18:47 AN 2015-09-08 07:10 2015-09-08 10:23 2015-09-08 17:55 C21 2015-10-22 00:28 - 2015-10-22 00:29 PS-Y 2016-01-11 23:21 2016-01-11 23:15 2016-01-13 04:14
  • 31. Sharing: URL Reputation Services • Crafted unique campaign IDs and timestamp domains • Made queries for unique domains to ~50 reputation engines • Three sites resulted in daily DNS lookups spanning > 5 days • Two resulted in daily DNS lookups spanning nearly 2 months • Most major AV/security companies networks represented • YOUR QUERIES ARE SHARED (implicitly?/explicitly?) • When you query these sites, you lose control of the domain/URL
  • 32. Threat Intel vs the Sandbox IPs? • Of all the Sandbox IPs that made valid POST requests to our server 15 were also identified in some threat intelligence feeds as malicious • 6 were TOR IPs • 1 was an Anonymous proxy • All others were characterized: • Bot IPs • Spammer IPs • Brute Force IPs • Scanning IPs • Compromised IPs (Hawkeye Keylogger, Dyre) • Interesting, but not surprising
  • 33. Lessons • Most people use the same Sandbox Images • Most sandboxes don’t change the environment settings across executions • AV thinks your file is malicious • You will tip off the adversary • Everyone will hit their network touch points … forever … • Reputation services can result in noisy traffic to the NS • Malware sandboxes can be fingerprinted with very simple techniques • You get what you pay for
  • 34. Contact Jason Trost • @jason_trost • jason [dot] trost [AT] threatstream [dot] com • https://github.com/jt6211 Aaron Shelmire •@Ashelmire •aaron[dot] shelmire [AT] threatstream [dot] com

Notas do Editor

  1. select timestamp::DATE, campaign_id, org, COUNT(1) from network_activity where host ILIKE '%.x.vpnlogin-it-helpdesk.com' group by 1,2,3 order by 3,1, 2;
  2. select timestamp::DATE, campaign_id, org, COUNT(1) from network_activity where host ILIKE '%.x.vpnlogin-it-helpdesk.com' group by 1,2,3 order by 3,1, 2;
  3. Several binaries that were initially sandboxed later resulted in more sandbox executions and those resulted in the domains making their way onto a commercial threat feed NOTE: this sensor has 0 to 1 AV detections and still made its way onto these feeds.