git your yara for nothing and your malware for free
play

Git Your YARA For Nothing and Your Malware for Free Automating - PowerPoint PPT Presentation

May 12, 2023 •772 likes •1.01k views

<location, date> < Location , date> Reversing Labs // June 2020 Git Your YARA For Nothing and Your Malware for Free Automating Scanning with thousands of YARA rules Cooper Quintin - Senior Security Researcher - EFF Threat Lab

  1. <location, date> < Location , date> Reversing Labs // June 2020 Git Your YARA For Nothing and Your Malware for Free Automating Scanning with thousands of YARA rules Cooper Quintin - Senior Security Researcher - EFF Threat Lab

  2. <location, date> < Location , date> Reversing Labs // June 2020 Intro • Cooper Quintin – Senior Security Researcher – New Parent – Laziness is a Virtue • EFF – Non profit – Defending civil liberties – 30 years • Threat Lab

  3. <location, date> < Location , date> Reversing Labs // June 2020 Malware that Targets At Risk People • Activists, human rights defenders, journalists, domestic abuse victims, immigrants, sex workers, minority groups, political dissidents, etc… • Goals of targeted malware: – Gather intelligence on opposition – Spy extraterritorially or illegally – Blackmail – Locate and Capture – Harass and Intimidate – Stifle freedom of expression

  4. <location, date> < Location , date> Reversing Labs // June 2020 Jeff Bezos Can Afford a Security Team Cybersecurity and AV companies care about the types of malware that affects their customers (usually enterprise.) We get to care about the types of malware the infringe on civil liberties and human rights of This guy is not at risk. at risk people.

  5. <location, date> < Location , date> Reversing Labs // June 2020 Our Goals • Protect People • Broaden our communities` understanding of threats and defenses • Expose bad faith actors • Make better laws

  6. <location, date> < Location , date> Reversing Labs // June 2020 Typical Process 1. Receive Sample 2. Triage Sample 3. Dynamic Analysis 4. Static Analysis 5. Attribution (is hard) 6. Report

  7. <location, date> < Location , date> Reversing Labs // June 2020 Typical Process 1. Receive Sample 2. Triage Sample 3. Dynamic Analysis 4. Static Analysis 5. Attribution (is hard) 6. Report

  8. <location, date> < Location , date> Reversing Labs // June 2020 Triaging Samples Goals: • Determine if sample is known. • Determine if sample is crimeware/spam or targeted. • Scan a possibly infected computer for samples to further investigate.

  9. <location, date> < Location , date> Reversing Labs // June 2020 Triaging By Hand

  10. <location, date> < Location , date> Reversing Labs // June 2020 Triaging with YARA

  11. <location, date> < Location , date> Reversing Labs // June 2020 Full Disclosure 1.I am a YARA noob! 2.I am fundamentally lazy.

  12. <location, date> < Location , date> Reversing Labs // June 2020 I love writing Yara rules but I can only write so many useful ones, my time is limited and there is a lot of malware out there. Luckily people much smarter than me, including people on this stage, have already written a ton of great rules!

  13. <location, date> < Location , date> Reversing Labs // June 2020 Let’s Not Reinvent the Wheel! https://github.com/InQuest/awesome-yara

  14. <location, date> < Location , date> Reversing Labs // June 2020 Some of My Favorites ● Apple OSX Apple has ~40 YARA signatures for detecting malware on OSX. ○ The file, XProtect.yara, is available locally at /System/Library/CoreServices/XProtect.bundle/Contents/Reso urces/. ● Citizen Lab Malware Signatures YARA signatures developed by Citizen Lab. Dozens of ○ signatures covering a variety of malware families. The also inclde a syntax file for Vim. Last update was in November of 2016.

  15. <location, date> < Location , date> Reversing Labs // June 2020 Some of My Favorites ● mikesxrs YARA Rules Collection Large collection of open source rules aggregated from a variety ○ of sources, including blogs and other more ephemeral sources. Over 100 categories, 1500 files, 4000 rules, and 20Mb. If you're going to pull down a single repo to play with, this is the one. ● YaraRules Project Official Repo Large collection of rules constantly updated by the community. ○

  16. <location, date> < Location , date> Reversing Labs // June 2020 Some of My Favorites ● Florian roth rules Florian Roth's signature base is a frequently updated collection ○ of IOCs and YARA rules that cover a wide range of threats. There are dozens of rules which are actively maintained. Watch the repository to see rules evolve over time to address false positives / negatives. ● X64 Debug Rules Great collection of rules for identifying packers and crypto ○ constants.

  17. <location, date> < Location , date> Reversing Labs // June 2020 “But Cooper, I don’t want to download and dig through almost 50 repositories of yara rules of varying quality, that sounds like a chore.”

  18. <location, date> < Location , date> Reversing Labs // June 2020 I Got You

  19. <location, date> < Location , date> Reversing Labs // June 2020 Introducing YAYA Yet Another Yara Automaton • Download Open Source Rulesets • Keep them up to date • Ignore problematic rules • Add your own rules • Run scans • Uses go-yara (thanks Hilko!) • https://github.com/cooperq/yaya

  20. <location, date> < Location , date> Reversing Labs // June 2020 Demo Pardon me while I sacrifice this chicken to the demo gods.

  21. <location, date> < Location , date> Reversing Labs // June 2020 Potential Uses • Put it in your email scanning pipeline. • Scan a possibly infected server or client device with it. • Scan cloud storage uploads. • Quickly triage and classify new samples. It’s open source so please file bugs and add features if you like it.

  22. <location, date> < Location , date> Reversing Labs // June 2020 Thank you! Cooper Quintin Senior Security Researcher EFF Threat Lab cooperq@eff.org - twitter: @cooperq https://github.com/cooperq/yaya

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi |

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi |

Reversing 2020 - YARA Summit | Pushing the Barriers of Unique YARA Uses | Tom Ueltschi | TLP-GREEN 1 TLP-GREEN TOM UELTSCHI YARA-SUMMIT 2020 C:&gt; whoami /all Tom Ueltschi Swiss Post CERT / SOC / CSIRT since 2007 (13 years!) Focus

1.3k views • 101 slides
Yara International ASA Bernstein Conference Petter stb, EVP, Chief Financial Officer 26

Yara International ASA Bernstein Conference Petter stb, EVP, Chief Financial Officer 26

Yara International ASA Bernstein Conference Petter stb, EVP, Chief Financial Officer 26 September 2018 Agenda Yara introduction Market fundamentals Yara strategy Targets 2 IR September 2018 Safe operations is our

1.07k views • 58 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

568 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
This talk Given a compiled YARA ruleset, how easy is it to reconstruct the individual rules?

This talk Given a compiled YARA ruleset, how easy is it to reconstruct the individual rules?

This talk Given a compiled YARA ruleset, how easy is it to reconstruct the individual rules? Strings/regular expressions seem easy. . . . . . but what about the condition syntax? Possible improvements to YARA itself Warning: Some C

270 views • 23 slides
On the Selmer group associated to a modular form and an algebraic Hecke character. Yara Elias

On the Selmer group associated to a modular form and an algebraic Hecke character. Yara Elias

On the Selmer group associated to a modular form and an algebraic Hecke character. Yara Elias McGill University April 7, 2015 Yara Elias On the Selmer group Structure of E ( K ) Mordell, Weil Let E be an elliptic curve over a number field K .

866 views • 58 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
Yara Marine Technologies We provide technologies to enable a greener maritime industry Quality

Yara Marine Technologies We provide technologies to enable a greener maritime industry Quality

Yara Marine Technologies We provide technologies to enable a greener maritime industry Quality Reliability Cost-efficiency The easy solution Yara Marine Technologies Founded in 2010 as 250+ employees in Millions of Green Tech Marine

610 views • 35 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND &amp; CONTROL QUESTIONS &amp; ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Angelas List of Recommended Blogs for School Librarians My blog:

Angelas List of Recommended Blogs for School Librarians My blog:

Angelas List of Recommended Blogs for School Librarians My blog: http://suburbiaschoollibrarian.blogspot.com/ My Media Minutes gallery: http://mediaminutesgallery.wikispaces.com/ Other OELMA Members Blogs: Krista Taracuk:

428 views • 4 slides
Inspiring, Creating, and Tackling Change: Collaborative Teaching Using iBooks and Google Classroom

Inspiring, Creating, and Tackling Change: Collaborative Teaching Using iBooks and Google Classroom

Inspiring, Creating, and Tackling Change: Collaborative Teaching Using iBooks and Google Classroom Andrea Brown &amp; Tessa Potgeter Wayland Union High School Andrea Brown PUT QR CODE browna@waylandunion.org Tessa Potgeter

533 views • 18 slides
The Giving Tree Jesus and Unconditional Love The Story of the Giving Tree Once there was a

The Giving Tree Jesus and Unconditional Love The Story of the Giving Tree Once there was a

The Giving Tree Jesus and Unconditional Love The Story of the Giving Tree Once there was a tree.... and she loved a little boy. And everyday the boy would come and he would gather her leaves and make them into crowns and play

209 views • 20 slides
Your Presenters Tim Rapoza 20 years working in technology field; the last 12 years

Your Presenters Tim Rapoza 20 years working in technology field; the last 12 years

Cyber Awareness for Parents ONLY How to support your family in an always-connected world Your Presenters Tim Rapoza 20 years working in technology field; the last 12 years working in Educational Technology. Dighton Middle School

474 views • 15 slides
Tobacco Cessation Washington State House of Representatives Health and Human Services

Tobacco Cessation Washington State House of Representatives Health and Human Services

AMERICAN INDIAN HEALTH COMMISSION FOR WASHINGTON STATE IMPROVING INDIAN HEALTH THROUGH TRIBAL-STATE COLLABORATION Tobacco Cessation Washington State House of Representatives Health and Human Services Appropriation and Oversight Committee

537 views • 8 slides
Getting to One Infant Mortality Screening &amp; Referral Pilot Project October 29, 2015 Carly

Getting to One Infant Mortality Screening &amp; Referral Pilot Project October 29, 2015 Carly

Getting to One Infant Mortality Screening &amp; Referral Pilot Project October 29, 2015 Carly Miller, MPH Assistant Director NW Ohio Pathways HUB Hospital Council of Northwest Ohio Kent Bishop, MD Angela Brandt President, Chief Medical

291 views • 25 slides
Monthly Financial Report January 31, 2020 1 Year-to-Date Summary Revenues +$33M +6%

Monthly Financial Report January 31, 2020 1 Year-to-Date Summary Revenues +$33M +6%

FAC Presentation 2/12/2020 2/11/2020 Monthly Financial Report January 31, 2020 1 Year-to-Date Summary Revenues +$33M +6% Expenditures -$16M -3% January 2020 Financial Report 2 1 FAC Presentation 2/12/2020 2/11/2020

97 views • 6 slides
LOW-INCOME PROGRAM IMPROVEMENT OPPORTUNITIES 2019-2021 Residential Planning Workshop #3

LOW-INCOME PROGRAM IMPROVEMENT OPPORTUNITIES 2019-2021 Residential Planning Workshop #3

LOW-INCOME PROGRAM IMPROVEMENT OPPORTUNITIES 2019-2021 Residential Planning Workshop #3 December 5, 2017 OVERVIEW Lifetime electric savings and associated spending have implications for future Program participation levels and savings

122 views • 11 slides

More recommend