renigma a tool to analyze malware
play

REnigma: A Tool to Analyze Malware April 23, 2018 Julian Grizzard, - PowerPoint PPT Presentation

Nov 13, 2023 •220 likes •393 views

REnigma: A Tool to Analyze Malware April 23, 2018 Julian Grizzard, Co-founder Deterministic Security, LLC James (Jim) Stevens, Co-founder Spin-off of The Johns Hopkins University Applied Physics Laboratory Need: Hard to Keep Networks Secure!

  1. REnigma: A Tool to Analyze Malware April 23, 2018 Julian Grizzard, Co-founder Deterministic Security, LLC James (Jim) Stevens, Co-founder Spin-off of The Johns Hopkins University Applied Physics Laboratory

  2. Need: Hard to Keep Networks Secure! Attempt to stop attacks before they reach the end points Network Defense Attempt to stop attacks that bypass network defenses End-Point Defense

  3. Need: Hard to Keep Networks Secure! Attempt to stop attacks before they reach the end points Network Defense Attempt to stop attacks that bypass network defenses End-Point Defense ● “PyeongChang 2018 Winter Olympics Opening Ceremony Disrupted by Malware Attacks” ● “Equifax Hack Exposes Personal Info of 143 Million US Consumers”

  4. Threat and Incident Response Incident Response Teams ● Recover from attacks that bypass all automated defenses Threat Teams Threat and Incident Response Teams ● Discover new threats and update defenses to block them REnigma focuses on threats that can make it through all automated defenses

  5. 37% 38% 11% 62% of respondents dedicate 10% full-time staff to malware analysis 2% 1% DHS-sponsored survey that includes Fortune 100, Fortune 500, S&P 500, Global 1000, and Global 2000 organizations (rounded)

  6. 18% 28% 37% 13% Highly skilled analyst (costly) requires hours, days, or sometimes 4% weeks to analyze one sample DHS-sponsored survey that includes Fortune 100, Fortune 500, S&P 500, Global 1000, and Global 2000 organizations (rounded)

  7. Approach - Overview Analyze malware Quarantine/Cleanup Alerts from Other Tools and block variants of the threat Network Defense Tools Abuse Box (Users) End-Point Defense Tools Search Logs Security Incident Threat Knowledge Hunt Team External Communities REnigma Inputs Outputs

  8. Approach - Overview Analyze malware Quarantine/Cleanup Alerts from Other Tools and block variants of the threat Network Defense Tools Abuse Box (Users) End-Point Defense Tools Search Logs Security Incident Threat Knowledge Hunt Team External Communities REnigma Inputs Outputs

  9. Approach - Overview Analyze malware Quarantine/Cleanup Alerts from Other Tools and block variants of the threat Network Defense Tools Abuse Box (Users) End-Point Defense Tools Search Logs Security Incident Threat Knowledge Hunt Team External Communities REnigma Inputs Outputs

  10. Approach - Analysis Detail 1. User uploads suspicious files or URLs to REnigma 2. REnigma records execution of sample in virtual machine (VM) ○ Interact with VM while recording 3. Analyst performs automated and/or semi-automated analysis of replay ○ Instruction-level analysis ○ “Rewind” to previous points Output: ● Deep understanding of threat ● Indicators of Compromise (IOCs)

  11. Approach - Analysis Detail 1. User uploads suspicious files or URLs to REnigma 2. REnigma records execution of sample in virtual machine (VM) ○ Interact with VM while recording 3. Analyst performs automated and/or semi-automated analysis of replay ○ Instruction-level analysis ○ “Rewind” to previous points Output: ● Deep understanding of threat ● Indicators of Compromise (IOCs)

  12. Benefits ● Record and replay functionality ● Analyst often has only “one shot” to solves critical challenges in analysis capture sample (e.g., website gone) ● Example: Easily “rewind” to ● Recording can capture point before cleanup sample before it is gone Quickly Understand New Threats Solve the “One Shot” Problem ● Export data in standard formats for ● Create online account for analysis with existing tools cloud-based service ● Example tools: IDA Pro, ● Onsite deployment Wireshark, Volatility possible Leverage Existing Analyst Skills Easy and Safe to Deploy

  13. Benefits - Feedback from Users ● Confidence in safe environment for analysis ○ Do not have to worry about setting up and securing a custom setup ○ Not detonating samples on corporate network ● Deeper knowledge of attacks that other tools don’t provide ○ Often receive alerts that something is bad but don’t know why ○ REnigma provides independent, fast, and deep understanding of attacks ● Actionable information ○ Results from REnigma used immediately to block threats ○ Able to obtain results more quickly than other tools

  14. Competition Static Analysis REnigma designed to provide ● Requires expensive and highly skilled analyst answers within minutes ● Takes weeks to analyze samples ● Example product: IDA Pro Traditional Commercial Sandbox REnigma records 100% of ● Limited to coarse-grained analysis activity to dig in deep ● Do not support replay ● Example product: Joe’s Sandbox (well known) Custom System (i.e., with open source) REnigma easy to configure ● Requires costly expert for setup/maintenance and leaves nowhere to hide ● Easy for attackers to study and evade ● Example tool: custom virtual machine

  15. REnigma Summary ● Powerful capability to quickly analyze threats that bypass your defenses ● Takes minutes rather than weeks of analysis ● Results gained from REnigma help keep your network safe

  16. DTRSEC Services ● REnigma for Enterprise IT ○ 4 month trial period ○ Host on site or in DTRSEC Cloud ○ Options for improved performance and reliability ● Malware Analysis Training ○ Operating systems and computer architecture basics ○ Study recordings of real malware in action ○ Learn advanced malware analysis with REnigma Contact us for more information Julian Grizzard, Co-Founder Jim Stevens, Co-Founder Julian@dtrsec.com Jim@dtrsec.com Deterministic Security, LLC Deterministic Security, LLC

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User

Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User

Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User Study Khaled Yakdan Sergej Dechand Matthew Smith Elmar Gerhards-Padilla Fraunhofer FKIE University of Bonn University of Bonn University of Bonn

426 views • 19 slides
Extracting Benefit from Harm: Using Malware Pollution to Analyze the Impact of Political and

Extracting Benefit from Harm: Using Malware Pollution to Analyze the Impact of Political and

SIGCOMM 2012 13-17 August, 2012 - Helsinki, Finland Extracting Benefit from Harm: Using Malware Pollution to Analyze the Impact of Political and Geophysical Events on the Internet A. Dainotti, R. Amman, E. Aben, K. C. Claffy alberto@caida.org

649 views • 22 slides
Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Describe types of malware See certain malware behaviors Scan and analyze malware

883 views • 25 slides
IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security

IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security

IA-32 Architecture CS 4440/7440 Malware Analysis and Defense Intel x86 Architecture } Security professionals constantly analyze assembly language code } Many exploits are written in assembly } Source code for applications and malware is not

1.1k views • 58 slides
Introduction to the Data Library [DL] a tool to analyze and visualize data I. Introduction

Introduction to the Data Library [DL] a tool to analyze and visualize data I. Introduction

Introduction to the Data Library [DL] a tool to analyze and visualize data I. Introduction Alessandra Giannini alesall@iri.columbia.edu Ti e International Research Institute for Climate and Society The Data Library [DL] is 3 things:

701 views • 33 slides
Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software

Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software

Hunting For Memory Resident Malware Memhunter tool Marcos Oviedo | McAfee Endpoint Software Architect 1 Agenda Problem Description Fileless Attacks Overview Common Injection Techniques Current Challenges with memory

870 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

568 views • 22 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
ImmunoDB: a web based tool to analyze preclinical data Rosa LAVIERI a Gilberto FILACI b Daniela

ImmunoDB: a web based tool to analyze preclinical data Rosa LAVIERI a Gilberto FILACI b Daniela

ImmunoDB: a web based tool to analyze preclinical data Rosa LAVIERI a Gilberto FILACI b Daniela FENOGLIO b and Mauro GIACOMINI a,1 a Department of Informatics, Bioengineering, Robotics and System Engineering (DIBRIS), University of Genoa, Via Opera

603 views • 11 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Cyber Security in Marine Nuclear Transport Systems Contents: 1. What are we protecting? 2.

Cyber Security in Marine Nuclear Transport Systems Contents: 1. What are we protecting? 2.

Cyber Security in Marine Nuclear Transport Systems Contents: 1. What are we protecting? 2. Why do we need Cyber Security? 3. How do they do it? 4. Cyber incidents and threats why it should be important to you 5. The dangers of

450 views • 18 slides
Project Plan Predictive Engine for Long Term Malware Detonation The Capstone Experience Team

Project Plan Predictive Engine for Long Term Malware Detonation The Capstone Experience Team

Project Plan Predictive Engine for Long Term Malware Detonation The Capstone Experience Team Proofpoint Izzy Dove Samuel Gendelman Alexander Kendall Joshua Wilson Geoffrey Witherington-Perkins Department of Computer Science and Engineering

391 views • 12 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides
Digit Digital al Se Security y Training Topics Covered Week 5 Week 1 Social Media

Digit Digital al Se Security y Training Topics Covered Week 5 Week 1 Social Media

Be Best Practices A digital training brought to you by RSAT Security in partnership with Supreme Technologies Group. Digit Digital al Se Security y Training Topics Covered Week 5 Week 1 Social Media Introduction to Information Security

506 views • 24 slides
Agenda Why we need a new approach to endpoint security Introducing Sophos Intercept X

Agenda Why we need a new approach to endpoint security Introducing Sophos Intercept X

Agenda Why we need a new approach to endpoint security Introducing Sophos Intercept X Demonstration / Feature Walk Through Deployment Options Q & A 2 Endpoint Security has reached a Tipping Point Attacks are from within the

937 views • 29 slides
Technology for Good KPMG eGaming S ummit, October 2019 POLL: How familiar are you wit h quant um

Technology for Good KPMG eGaming S ummit, October 2019 POLL: How familiar are you wit h quant um

Technology for Good KPMG eGaming S ummit, October 2019 POLL: How familiar are you wit h quant um comput ing? 1. Isnt that a show from the 90s? 2. I know the term, but I dont know what it means. 3. Im comfortable with the

463 views • 35 slides
NEWS RELEASE Isle of Man students hail life - changing experience at NASA United Space School

NEWS RELEASE Isle of Man students hail life - changing experience at NASA United Space School

NEWS RELEASE Isle of Man students hail life - changing experience at NASA United Space School Douglas, Isle of Man 19 September 2016 There arent many students who can give what must be one of the coolest answers to that age- old

359 views • 3 slides
PrimeServ Copenhagen Your Strong and Reliable Partner January 17 th 2013 MAN Diesel

PrimeServ Copenhagen Your Strong and Reliable Partner January 17 th 2013 MAN Diesel

PrimeServ Copenhagen Your Strong and Reliable Partner January 17 th 2013 MAN Diesel & Turbo PrimeServ Copenhagen Your Strong and Reliable Partner 17.01.2013 < 1 > MAN Diesel & Turbo Product Range by Strategic

153 views • 13 slides

More recommend