• Home

  • Documents

  • malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our...
23
© 2008 Team Cymru Stephen Gill Chief Scientist Team Cymru Malware Hash Registry Harnessing the power of AntiVirus Aggregation January, 2009 CONFIDENTIAL © 2008 Team Cymru

malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

  • Upload
    others

  • View
    2

  • Download
    0

Embed Size (px)

Citation preview

Page 1: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Stephen Gill Chief Scientist Team Cymru

Malware Hash Registry Harnessing the power of AntiVirus Aggregation

January, 2009

CONFIDENTIAL ©2008TeamCymru

Page 2: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Agenda

CONFIDENTIAL ©2008TeamCymru

•  Introduction•  Purpose•  Access•  Usage,Tools,Applications•  Statistics•  LookingtotheFuture•  Conclusion

Page 3: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

•  Began as a hobby in 1998; Incorporated in 2004. •  Network of researchers dedicated to supporting the

Internet community in maintaining security; non-profit •  Funded by multinational banks, CERTs/CSIRTS, security

vendors… and you? •  Global investigators previously from Dutch NHTCC, UK

Scotland Yard, Polish Police, USSS •  OurMission:TheWHOandtheWHY

Copyright©2008TeamCymru

Page 4: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

TheInternet

Page 5: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Malware’sEffectontheInternet

Page 6: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Malware

•  SamplesSkyrocketing:onenewvirusevery2seconds

•  Vectors:–  people–  mobileviruses–  DriveBydownloads–  fileinfectors(ievirut)–  USBdrives.spreadinglikewildfireinAsiaPac–  Officeprograms–  Middleman:arppoisoning

Page 7: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Enter,theMalwareHashRegistry

•  Inanutshell:queryourserviceforacomputedMD5orSHA‐1hashofafile–  ifitisknownmalwarewedisplayanAVdetectionRateandlastseentimestamp

•  SimilartoIPtoASNreleasedseveralyearsago:– http://www.team‐cymru.org/Services/ip‐to‐asn.html

– TranslatesIpstoBGPASNsviaWhoisandHTTP– Highlysuccessful

Page 8: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Enter,theMalwareHashRegistry

•  ComplementsAVextremelywell.– MaintainingHashesinsignaturesisimpractical(1(1GB+size)

– Wetakecareofthatbystoringitinthecloud

– LetsAVcontinuetodowhatitdoesbest:detectmalwarebasedonsignaturesandheuristics.

•  Freefornon‐commercialuse

Page 9: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

AccessMethods

•  AccessisavailableovertheInternetvia:– Whois:TCP43– Netcat:TCP43(bulkwhois)– DNS:UDP53

•  Possiblycominglater:–  InstantMessaging–  HTTP–  Yourideashere…

Page 10: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Architecture

MHRMalwareDB AVQueue

Queries

Page 11: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Usage•  Whois&Netcat

•  DNS

Page 12: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Applications

•  Hardware–  Comingsoontoaroutervendornearyou…

–  BROappliance–  Yourideashere…

•  Software

-  MailServers-  Forensics-  Poorman’sAV

-  TheSky’sthelimit

Page 13: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

SneakPeek:WinMHR

Page 14: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

AV’sEffectiveness

•  Wecollectapproximately~30K+uniquemalwaresamplesperday.

•  UsingcurrentAVsignaturesandenginesfrom32AVvendors,thedetectionrateiscirca28%.

•  30dayslaterthedetectionratecanbeashighas50%.Yay.:/

Page 15: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

MHR’sEffectiveness

•  AccordingtoOnePrivatestudy:– MHRimprovedAV’shitrateby50%!

•  ContributionsWelcomed!!!– AVengines(fromvendor)– Malwaresamples– Suggestionsforimprovement– Moralsupport– Coffee

Page 16: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

MHR’sAdoption

•  Inthefirst5days,over750kqueries•  10M+queriesinJan2009

•  BROAddoninthefirstdayhttp://wiki.github.com/sethhall/bro_scripts/the‐malware‐hash‐

registry‐and‐bro‐ids

RealtimeHTTPMonitoring

•  LinuxHostActiveScanning

Page 17: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

FutureAddons

•  KernelDrivertowatchfornewprocesses•  MonitoringofsubprocessesandDLLs(svchost.exe)

Page 18: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

FAQ•  HowdoIinterprettheoutput?

•  It’snottoobad,justtwonumberstoworryabout:timestamp(unix),anddetectionrate

•  Howdoyoucollectmalware?

•  Howdon’twecollectmalware...•  CanIdownloadyourhashregistrydatabase?

•  Itisnotpublicallyavailable,butyoumaycontactusaboutadatasharingagreement.

•  CanIhaveasampleofthefile…?

•  PleaseseetheFAQ

Page 19: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

FAQ•  WhichAVEngines?

•  Undisclosed•  Tellmemoreaboutyourmalwaredatabase?

•  Talktomeafterwards.•  ShouldIjuststopusingananti‐viruspackage?

•  NO!PleasecontinuetouseAV!•  Howup‐to‐dateisyourregistry?

•  Updatedonce,daily.•  HowdoIreportaFalsePositive?

•  http://www.team‐cymru.org/Services/MHR/

Page 20: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

TeamCymrucanHelpYou!•  Detection

– Flows, Feeds, Compromised devices – Have questions about your network or IPs?

Talk to me afterwards. •  Investigation

– Cyber who dunnit? •  Prevention •  Mitigation •  Collaboration

Page 21: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

Thank you for your time!

Copyright©2008TeamCymru

Page 22: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

ConcludingRemarks

•  Questions?

Page 23: malware hash registry - NANOG ArchiveEnter, the Malware Hash Registry • In a nutshell: query our service for a computed MD5 or SHA‐1 hash of a file – if it is known malware we

©2008TeamCymru

MoreInformation

•  http://www.team‐cymru.org/Services/MHR/


hash tables - cs.sfu.ca · A Good Hash Function Independent hash function: Express the key as an integer (if it isn’t already one), called hash value or hash code . When doing so

hash tables - cs.sfu.ca · A Good Hash Function Independent hash function: Express the key as an integer (if it isn’t already one), called hash value or hash code . When doing so

Documents
Hash-JoinAlgorithmen · Hash-Join Algorithmen | Matthias Richly | 6. Januar 2009 3 Gliederung Hash-JoinAlgorithmen allgemein Einfacher Hash-Join GRACE Hash-Join Hybrid Hash-Join

Hash-JoinAlgorithmen · Hash-Join Algorithmen | Matthias Richly | 6. Januar 2009 3 Gliederung Hash-JoinAlgorithmen allgemein Einfacher Hash-Join GRACE Hash-Join Hybrid Hash-Join

Documents
1 Hashing Techniques: Implementation Implementing Hash Functions Implementing Hash Tables Implementing Chained Hash Tables Implementing Open Hash Tables

1 Hashing Techniques: Implementation Implementing Hash Functions Implementing Hash Tables Implementing Chained Hash Tables Implementing Open Hash Tables

Documents
Multi-Hash: A Family of Cryptographic Hash Algorithm ... · Multi-Hash: A Family of Cryptographic Hash Algorithm Extensions 5 Definition of Multi-Hash We define Multi-Hash extensions

Multi-Hash: A Family of Cryptographic Hash Algorithm ... · Multi-Hash: A Family of Cryptographic Hash Algorithm Extensions 5 Definition of Multi-Hash We define Multi-Hash extensions

Documents
Dynamics ofof Distributed Hash Distributed Hash …balke/lecture-p2p/Vorlesung_5.pdfL3S Research Center, University of Hannover Dynamics ofof Distributed Hash Distributed Hash Tables

Dynamics ofof Distributed Hash Distributed Hash …balke/lecture-p2p/Vorlesung_5.pdfL3S Research Center, University of Hannover Dynamics ofof Distributed Hash Distributed Hash Tables

Documents
Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Documents
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents
Dictionaries and Hash Tables - Purdue University · Dictionaries and Hash Tables 4 Hash Functions and Hash Tables (§8.2) A hash function h maps keys of a given type to integers in

Dictionaries and Hash Tables - Purdue University · Dictionaries and Hash Tables 4 Hash Functions and Hash Tables (§8.2) A hash function h maps keys of a given type to integers in

Documents
Olympics, hash lyrics, forthcoming events, hash humour etc

Olympics, hash lyrics, forthcoming events, hash humour etc

Documents
Recommendation for applications using approved … WORDS: digital signatures, hash algorithm, hash function, hash-based key derivation algorithms, hash value, HMAC, message digest,

Recommendation for applications using approved … WORDS: digital signatures, hash algorithm, hash function, hash-based key derivation algorithms, hash value, HMAC, message digest,

Documents
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Hash Functions and Hash Tables - CSE, IIT Bombay

Hash Functions and Hash Tables - CSE, IIT Bombay

Documents
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Indexação e Hashing - Construção de Índices e Funções Hash · Funções Hash Dinâmicas ∙ A função hash é modificada dinamicamente Hash Extensível (Extendible Hashing)

Indexação e Hashing - Construção de Índices e Funções Hash · Funções Hash Dinâmicas ∙ A função hash é modificada dinamicamente Hash Extensível (Extendible Hashing)

Documents
degli Accessi Privilegiati Quali le Best Practice? Denis ...€¦ · Malicious ActiveX controls Spyware / Adware Malware to facilitate pass-the-hash exploits ... Enable Secure Path

degli Accessi Privilegiati Quali le Best Practice? Denis ...€¦ · Malicious ActiveX controls Spyware / Adware Malware to facilitate pass-the-hash exploits ... Enable Secure Path

Documents
Hashing & Hash TablesHashing & Hash Tablesananth/CptS223/Lectures/hashing.pdf · Hash table: Main components key value Hash index e “john” key h(“john”) TableSiz Hash function

Hashing & Hash TablesHashing & Hash Tablesananth/CptS223/Lectures/hashing.pdf · Hash table: Main components key value Hash index e “john” key h(“john”) TableSiz Hash function

Documents
virtualtumourbank.kankerregister.org...93 belgian cancer registry appendix 6 Appendix Appendix 1 Data set Patient data a Unique patient identifi cation code! Hash code! National social

virtualtumourbank.kankerregister.org...93 belgian cancer registry appendix 6 Appendix Appendix 1 Data set Patient data a Unique patient identifi cation code! Hash code! National social

Documents
Chapter 5 Hash Functions What is a Hash Function? The Birthday Problem Tiger Hash Uses of Hash Functions

Chapter 5 Hash Functions What is a Hash Function? The Birthday Problem Tiger Hash Uses of Hash Functions

Documents
Evolving Hash Functions using Genetic Algorithmsajiips.com.au/papers/V4.1/V4N1.4 - Evolving Hash Functions using... · hash function called "PKP Hash" by Peter.K.Pearson [5] that

Evolving Hash Functions using Genetic Algorithmsajiips.com.au/papers/V4.1/V4N1.4 - Evolving Hash Functions using... · hash function called "PKP Hash" by Peter.K.Pearson [5] that

Documents
Hash Functions 1 Hash Functions Hash Functions 2 Cryptographic Hash Function Crypto hash function h(x) must provide o Compression output length is

Hash Functions 1 Hash Functions Hash Functions 2 Cryptographic Hash Function Crypto hash function h(x) must provide o Compression output length is

Documents
Hash-Based Indexingadrem.uantwerpen.be/sites/default/files/db2-hash-indexes.pdfHash-Based Indexing Hash-Based Indexing Static Hashing Hash Functions Extendible Hashing Search Insertion

Hash-Based Indexingadrem.uantwerpen.be/sites/default/files/db2-hash-indexes.pdfHash-Based Indexing Hash-Based Indexing Static Hashing Hash Functions Extendible Hashing Search Insertion

Documents
Tweakable Hash Functions in Stateless Hash-Based Signature

Tweakable Hash Functions in Stateless Hash-Based Signature

Documents
Hash Tables - ics.uci.edugoodrich/teach/cs260P/notes/HashTables.… · Hash Tables 5 Hash Functions and Hash Tables q A hash function h maps keys of a given type to integers in a

Hash Tables - ics.uci.edugoodrich/teach/cs260P/notes/HashTables.… · Hash Tables 5 Hash Functions and Hash Tables q A hash function h maps keys of a given type to integers in a

Documents
Métodos de Acesso Indice estruturado por Hash. Plano Geral Vantagens e Limitações Hash Estático Hash Extensível Hash Linear Comparação entre Hash Extensível

Métodos de Acesso Indice estruturado por Hash. Plano Geral Vantagens e Limitações Hash Estático Hash Extensível Hash Linear Comparação entre Hash Extensível

Documents
Forensic Investigation & Malware Analysis against Targeted ...–For root cause of malware infection, we can trace back timeline based on the timestamps •Registry File Extraction

Forensic Investigation & Malware Analysis against Targeted ...–For root cause of malware infection, we can trace back timeline based on the timestamps •Registry File Extraction

Documents
Hash TableHash Table - ORCCAyxie/courses/cs2210b-2011/htmls/notes/05-hash... · Hash TableHash Table Outline • motivation • hash functions • collision handling 1 Courtesy to

Hash TableHash Table - ORCCAyxie/courses/cs2210b-2011/htmls/notes/05-hash... · Hash TableHash Table Outline • motivation • hash functions • collision handling 1 Courtesy to

Documents
1 Lecture #14 The Modulus Operator Hash Tables –Closed hash tables Inserting, Searching, Deleting –Open hash tables –Hash table efficiency and “load factor”

1 Lecture #14 The Modulus Operator Hash Tables –Closed hash tables Inserting, Searching, Deleting –Open hash tables –Hash table efficiency and “load factor”

Documents
Tehnologije za provjeru integriteta datoteka · Hash funkcije Svaka hash funkcija primjenjuje neki hash algoritam za ra čunanje sažetaka Obilježja hash funkcija: Hash funkcije

Tehnologije za provjeru integriteta datoteka · Hash funkcije Svaka hash funkcija primjenjuje neki hash algoritam za ra čunanje sažetaka Obilježja hash funkcija: Hash funkcije

Documents
DETECTING DERIVATIVE MALWARE SAMPLES USING …az817975.vo.msecnd.net/wm-418498-cmsimages/ARJJune... · The rolling hash is used to provide the trigger points for separating the input

DETECTING DERIVATIVE MALWARE SAMPLES USING …az817975.vo.msecnd.net/wm-418498-cmsimages/ARJJune... · The rolling hash is used to provide the trigger points for separating the input

Documents
MMF reference model figures. PDES/STEP Registry Manufacturing ebXML Registry UDDI Component Registry GCI Registry EAN Registry CPFR Registry RosettaNet

MMF reference model figures. PDES/STEP Registry Manufacturing ebXML Registry UDDI Component Registry GCI Registry EAN Registry CPFR Registry RosettaNet

Documents