Discussion Post

Discuss how testing of ani-malware should be conducted.

The only absolute rule seems to be, don’t conduct anti-malware testing on your production systems. Testing of anti-malware should be performed in an isolated malware testing environment, and care should be taken to ensure that the system is completely isolated. For example, if you construct a malware test lab using a hypervisor and virtual machines, but keep the virtual machines on your production network, well, let’s say that’s not isolated. If correctly set up and configured hypervisors and virtual machines can be a testers best friend.

The Anti-Malware Testing Standards Organization (AMTSO) had developed and documented all sorts of testing guidance from Principles of Testing to Facilitating Testing. The key here is that the testing method must be safe and it must use methods which are generally accepted (consistent, unbiased, transparent, empirical, etc.) (AMTSO, 2018)

The use of generally accepted tools and toolkits for malware research, testing and analysis can easily overcome certain testing obstacles, allowing the analyst to focus on the testing methodology rather than the acceptance of a specific testing tool or platform. Safely conducting testing and ensuring that you are not endangering yourself and others is the burden of the analyst; the complexity of the technologies being used to construct isolated environments and the malware itself can make this complicated, so there is plenty of room for error.

My two favorite toolkits for malware testing are:

  • Flare VM (Kacherginsky, 2017) is essentially a PowerShell script that used BoxStarter and Chocolatey to turn a >= Windows 7 machine into a malware analysis distribution by quickly loading all the tools you need to do malware analysis.
  • REMnux is a Linux distribution for malware analysis and reverse-engineering. Like Flare VM, REMnux contains a set of tools to perform malware analysis and reverse engineering. Because REMnux is built on Linux (an open source operating system), it can be deployed using an install script like Flare VM or via a virtual machine (VM) image which packages the OS and tools making it easy to download, deploy and use.

There are a plethora of security-focused Linux distributions like Kali Linux, Backbox Linux, and the distribution which I use, Parrot Linux. All of these Linux based security-focused distributions offer some of the tools required for malware analysis, but none are focused on malware analysis like REMnux.

Anti-malware is a requirement; it is the last line of defense. Simple malware scanners, heuristics, activity/anomaly-based detection, is not enough. Next generation anti-malware and real-time scanning and discovery is a necessity. Malware can be identified using real-time detection technologies by monitoring activities like:

  • Attempts to alter restricted locations such as registry or startup files.
  • Attempts to modify executables.
  • Opening, deleting or editing files.
  • Attempts to write to or modify the boot sector.
  • Creating, accessing or adding macros to documents.

Not all anti-virus and anti-malware is created equal. avtest.org conducts independent analysis on the efficacy of anti-virus and anti-malware solutions, services like this can be an excellent resource for those looking to make the right decision when selecting anti-virus and anti-malware solutions.

I love this quote: “People have to understand that anti-virus is more like a seatbelt than an armored car: It might help you in an accident, but it might not,” Huger said. “There are some things you can do to make sure you don’t get into an accident in the first place, and those are the places to focus because things get dicey real quick when today’s malware gets past the outside defenses and onto the desktop.” (Kerbs, 2010)

References

Adams, J. (2016, June 8). Building a Vulnerability/Malware Test Lab. Retrieved June 6, 2018, from https://westoahu.hawaii.edu/cyber/building-a-vulnerability-malware-test-lab/

AMTSO. (2018, June 6). Welcome to the Anti-Malware Testing Standards Organization. Retrieved June 6, 2018, from https://www.amtso.org/

Kacherginsky, P. (2017, July 26). FLARE VM: The Windows Malware Analysis Distribution You’ve Always Needed! « FLARE VM: The Windows Malware Analysis Distribution You’ve Always Needed! Retrieved June 6, 2018, from https://www.fireeye.com/blog/threat-research/2017/07/flare-vm-the-windows-malware.html

Kerbs, B. (2010, June 25). Krebs on Security. Retrieved June 6, 2018, from https://krebsonsecurity.com/2010/06/anti-virus-is-a-poor-substitute-for-common-sense/

REMnux. (2018, June 6). REMnux: A Linux Toolkit for Reverse-Engineering and Analyzing Malware. Retrieved June 6, 2018, from https://remnux.org/

Williams, G. (2018, June 6). Detecting and Mitigating Cyber Threats and Attacks. Retrieved June 6, 2018, from https://www.coursera.org/learn/detecting-cyber-attacks/lecture/xE8ns/snort

 

Discussion Response 1

Good post. IMO it’s essential when discussing anti-malware to consider attack vectors. While anti-malware heuristics are getting better, aided by deep learning, the primary attack vector remains the user, and it seems unlikely that a change in trajectory is on the near-term horizon. Attackers use numerous attack vectors, and when I think about the needle used to inject the virus I think about examples such as:

  • Spam: Where email or social media are the delivery mechanism for malware.
  • Phishing, Spear Phishing, Spoofing, Pharming: Where attackers impersonate legitimate sources or destinations to trick unsuspecting victims to sites that capture personal information, exploit them, etc.

I use the examples above as a way to convey that exploitation often begins with the exploitation of an individual, this happens before the malware infects their system. A lack of knowledge, skill, vigilance, a sense of trust, etc. are all too often the root cause of an issue.

I just recently started taking a Coursera course called “Usable Security” and one area they focus on is HCI (Human-Computer Interaction). They stress how important it is for the designer to make the safeguards understandable and usable, not by the minority of experts but by the majority of casual users. They use two specific examples, at least so far. The first example is a medial cart with a proximity sensor. On paper, the proximity sensor seems like a great idea, but it turns out the doctors didn’t like it, so they covered the proximity sensors with styrofoam cups making the system less effective than the prior system which required the doctor to lock the computer after their session and a reasonable login timeout. The second is the SSL warning system in Firefox, the warning you get about an expired or unsigned certificate, sighting that most people don’t know what this means and add an exception without much thought.

Over the years I have observed the situations like the above with anti-malware software. The software slows the system down, do the tech user disables it or the anti-malware software reports so many false positives that the tech user disables it. The bottom line is there no replacement for human vigilance. I wonder if we can get to a place where the software can protect the user from himself or herself. Whatever the solution, I believe it will need to be frictionless, we aren’t there yet, but maybe someday.

References

Golbeck, J. (2018, June 10). Usable Security. Retrieved June 10, 2018, from https://www.coursera.org/learn/usable-security University of Maryland, College Park

Texas Tech University. (2018, June 10). Scams – Spam, Phishing, Spoofing and Pharming. Retrieved June 10, 2018, from https://www.ttu.edu/cybersecurity/lubbock/digital-life/digital-identity/scams-spam-phishing-spoofing-pharming.php

 

Discussion Response 2

All good points.  Seems almost inconceivable that a tester would be testing something for which they have no knowledge, but of course, we know this is often the case (and this goes way beyond anti-malware software).

You bring up a good point regarding what the tester is testing for. I think we have seen the era of “total security” products that cover everything from firewall to anti-malware, this is likely born from necessity and the need to move from reactive defensive anti-malware focused on scans to provocative strategies which attempt to keep the malware out rather than just focusing on detection and remediation after the fact. I think we are seeing systems emerge today which leverage data mining and deep learning to better protect users. With the level of sophistication being used in both malware and anti-malware I can’t imagine the role of the tester getting any easier. We live in interesting times and on a positive note, I think we can anticipate that they will only get more interesting.

 

Discussion Response 3

Good post. We’ve certainly seen some leaders in the security field have their ethics and motives questioned, most notably Kaspersky Lab (Volz, 2017). I have to admit in the case of Kaspersky Lab it’s hard to not wonder if this isn’t just a bunch of legislators who may have a bigger struggle with ethics and motivation than Kaspersky Lab does, this is a slippery slope. We live in a global economy and having read what Kaspersky Lab volunteered to do, I can’t wonder if this move may have some marketing flare associated with it. avtest.org has consistently rated Kaspersky Lab anti-malware among the best in the industry (AV-TEST, 2018). Is it possible that the Kremlin could have an influence on Kaspersky Lab? I suppose it is (Matlack, Riley & Robertson, 2015), but do I think this was the motivation for the legislation, not likely.

References

AV-TEST. (2018, April 06). AV-TEST – The Independent IT-Security Institute. Retrieved June 10, 2018, from https://www.av-test.org/en/award/2017/

Matlack, C., Riley, M., & Robertson, J. (2015, March 19). Cybersecurity: Kaspersky Has Close Ties to Russian Spies. Retrieved June 11, 2018, from https://www.bloomberg.com/news/articles/2015-03-19/cybersecurity-kaspersky-has-close-ties-to-russian-spies

Volz, D. (2017, December 12). Trump signs into law U.S. government ban on Kaspersky Lab software. Retrieved June 10, 2018, from https://www.reuters.com/article/us-usa-cyber-kaspersky/trump-signs-into-law-u-s-government-ban-on-kaspersky-lab-software-idUSKBN1E62V4?utm_source=applenews

 

Essay Assignment

How does anti-malware software detect viruses? What techniques are available, and how do they differ?

[google-drive-embed url=”https://docs.google.com/document/d/1-5Gmk97WZQ5eKVcsoXGSzJ8VJIklMxLA7U-onkgc5-I/preview?usp=drivesdk” title=”Bocchinfuso – FIT – MGT5156 – Week 6 – Assignment 1″ icon=”https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.document” width=”100%” height=”400″ style=”embed”]

 

Viruses and Virus Detection Module Assignment

[google-drive-embed url=”https://docs.google.com/document/d/1tgs93eHUzrPxTmzt2hOQt6XA9naQ3SKi7yvEd1df8w8/preview?usp=drivesdk” title=”Bocchinfuso – FIT – MGT5156 – Week 6 – Assignment 2″ icon=”https://drive-thirdparty.googleusercontent.com/16/type/application/vnd.google-apps.document” width=”100%” height=”400″ style=”embed”]