malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our...

Stephen Gill Chief Scientist Team Cymru

Malware Hash Registry Harnessing the power of AntiVirus Aggregation

January, 2009

Agenda

•  Introduction•  Purpose•  Access•  Usage,Tools,Applications•  Statistics•  LookingtotheFuture•  Conclusion

•  Began as a hobby in 1998; Incorporated in 2004. •  Network of researchers dedicated to supporting the

Internet community in maintaining security; non-profit •  Funded by multinational banks, CERTs/CSIRTS, security

vendors… and you? •  Global investigators previously from Dutch NHTCC, UK

Scotland Yard, Polish Police, USSS •  OurMission:TheWHOandtheWHY

TheInternet

Malware’sEffectontheInternet

Malware

•  SamplesSkyrocketing:onenewvirusevery2seconds

•  Vectors:–  people–  mobileviruses–  DriveBydownloads–  fileinfectors(ievirut)–  USBdrives.spreadinglikewildfireinAsiaPac–  Officeprograms–  Middleman:arppoisoning

Enter,theMalwareHashRegistry

•  Inanutshell:queryourserviceforacomputedMD5orSHA‐1hashofafile–  ifitisknownmalwarewedisplayanAVdetectionRateandlastseentimestamp

•  SimilartoIPtoASNreleasedseveralyearsago:– http://www.team‐cymru.org/Services/ip‐to‐asn.html

– TranslatesIpstoBGPASNsviaWhoisandHTTP– Highlysuccessful

Enter,theMalwareHashRegistry

•  ComplementsAVextremelywell.– MaintainingHashesinsignaturesisimpractical(1(1GB+size)

– Wetakecareofthatbystoringitinthecloud

– LetsAVcontinuetodowhatitdoesbest:detectmalwarebasedonsignaturesandheuristics.

•  Freefornon‐commercialuse

AccessMethods

•  AccessisavailableovertheInternetvia:– Whois:TCP43– Netcat:TCP43(bulkwhois)– DNS:UDP53

•  Possiblycominglater:–  InstantMessaging–  HTTP–  Yourideashere…

Architecture

MHRMalwareDB AVQueue

Queries

Usage•  Whois&Netcat

•  DNS

Applications

•  Hardware–  Comingsoontoaroutervendornearyou…

–  BROappliance–  Yourideashere…

•  Software

-  MailServers-  Forensics-  Poorman’sAV

-  TheSky’sthelimit

SneakPeek:WinMHR

AV’sEffectiveness

•  Wecollectapproximately~30K+uniquemalwaresamplesperday.

•  UsingcurrentAVsignaturesandenginesfrom32AVvendors,thedetectionrateiscirca28%.

•  30dayslaterthedetectionratecanbeashighas50%.Yay.:/

MHR’sEffectiveness

•  AccordingtoOnePrivatestudy:– MHRimprovedAV’shitrateby50%!

•  ContributionsWelcomed!!!– AVengines(fromvendor)– Malwaresamples– Suggestionsforimprovement– Moralsupport– Coffee

MHR’sAdoption

•  Inthefirst5days,over750kqueries•  10M+queriesinJan2009

•  BROAddoninthefirstdayhttp://wiki.github.com/sethhall/bro_scripts/the‐malware‐hash‐

registry‐and‐bro‐ids

RealtimeHTTPMonitoring

•  LinuxHostActiveScanning

FutureAddons

•  KernelDrivertowatchfornewprocesses•  MonitoringofsubprocessesandDLLs(svchost.exe)

FAQ•  HowdoIinterprettheoutput?

•  It’snottoobad,justtwonumberstoworryabout:timestamp(unix),anddetectionrate

•  Howdoyoucollectmalware?

•  Howdon’twecollectmalware...•  CanIdownloadyourhashregistrydatabase?

•  Itisnotpublicallyavailable,butyoumaycontactusaboutadatasharingagreement.

•  CanIhaveasampleofthefile…?

•  PleaseseetheFAQ

FAQ•  WhichAVEngines?

•  Undisclosed•  Tellmemoreaboutyourmalwaredatabase?

•  Talktomeafterwards.•  ShouldIjuststopusingananti‐viruspackage?

•  NO!PleasecontinuetouseAV!•  Howup‐to‐dateisyourregistry?

•  Updatedonce,daily.•  HowdoIreportaFalsePositive?

•  http://www.team‐cymru.org/Services/MHR/

TeamCymrucanHelpYou!•  Detection

– Flows, Feeds, Compromised devices – Have questions about your network or IPs?

Talk to me afterwards. •  Investigation

– Cyber who dunnit? •  Prevention •  Mitigation •  Collaboration

Thank you for your time!

ConcludingRemarks

•  Questions?

MoreInformation

•  http://www.team‐cymru.org/Services/MHR/

malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our...

Documents

Olympics, hash lyrics, forthcoming events, hash humour etc

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Trafﬁc Exchanges

Chapter 3 Public Key Cryptography · 30 One way datadata hash value hash value. 31 Collision resistant datadata hash function hash value hash value datadata. 32 Message Authentication

Hashing & Hash TablesHashing & Hash Tablesananth/CptS223/Lectures/hashing.pdf · Hash table: Main components key value Hash index e “john” key h(“john”) TableSiz Hash function

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Hash Functions 1 Hash Functions Hash Functions 2 Cryptographic Hash Function Crypto hash function h(x) must provide o Compression output length is

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Cryptographic Hash Functions CS432. Overview Hash Functions Hash Algorithms: MD5 (Message Digest). MD5 (Message Digest). SHA1: (Secure Hash Algorithm)

Cryptographic Hash functions Hash Functions RIPEMD-160 and

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Tweakable Hash Functions in Stateless Hash-Based Signature

Understanding Malware - · PDF file•HTTP Bot •Banking Trojan Understanding malware ... - Packer info - Anti-virus detection info Activity of - File system - Registry - Process

OASIS/ebXML Registry Information Model v2.02 Bug … · Registry Registry to Registry

Forensic Investigation & Malware Analysis against Targeted ...–For root cause of malware infection, we can trace back timeline based on the timestamps •Registry File Extraction

Windows for Reverse Engineers - TKK€¦ · Registry and malware • Malware typically wants to survive a reboot •The registry is the most common place to do this •Hundreds of

Indexação e Hashing - Construção de Índices e Funções Hash · Funções Hash Dinâmicas ∙ A função hash é modiﬁcada dinamicamente Hash Extensível (Extendible Hashing)

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

12-1 12 Hash-Table Data Structures Hash-table principles. Closed-bucket and open-bucket hash tables. Searching, insertion, deletion. Hash-table design

Recommendation for applications using approved … WORDS: digital signatures, hash algorithm, hash function, hash-based key derivation algorithms, hash value, HMAC, message digest,