AVIEN Malware Defense Guide for the Enterprise

Front Cover

AVIEN Malware Defense Guide for the Enterprise

Copyright Page

Lead Author and Technical Editor

Foreword Author

Contributors

Contents

Foreword

Preface

Introduction

Chapter 1: Customer Power and AV Wannabes

Introduction

History of AVIEN and AVIEWS

Background: So Who Is Robert Vibert?

AV Vendor/Researcher Lists and Groups

VB 2000: A Star is Born

Cocktails For Two — and More

After the Hangover

One Day at a Time

Oh No,The Users Are Ganging Up On Us!!!

The Objectives of AVIEN and AVIEWS

AVIEN Membership Benefits

Alerts and Advisories

Peer Discussions

AVIEN Projects

Anti-virus Vendor Image

AVIEN & AVIEWS: Independents and Vendors in Anti-Malware Research

Favorite Myths

“Anti-virus Only Catches Known Viruses”

“Vendors Protect Their Own Revenue Stream, Not Their Customers”

“Vendors Only Know About and Detect Viruses”

“They Write All the Viruses”

“Anti-virus Should Be a Free Service: After All, There Are Free Services That Do a Better Job”

AV Wannabe

So You Want to Be a Bona Fide Computer Anti-Malware Researcher?

In the Beginning...

Anti-virus Company Analysts

Independent Researchers

Technical and Psychological Analysts

Corporate Anti-virus Specialist

What is a Researcher?

Researcher Skill-Set

What Makes a Researcher?

In The End

You Should Be Certified

(ISC)2

SSCP

CISSP

CISSP Concentrations

SANS GIAC/GSM Certifications

Other Certifications and Qualifications

Vendor-Dependent Training

McAfee

Sophos

Symantec

Should There Be a Vendor-independent Malware Specialist Certification?

Levels of Certification and Associated Knowledge Bases

Certified Anti-Virus Administrator (CAVA)

Certified Anti-virus Specialist (CAVS)

Certified Enterprise Anti-virus Architect (CEAVA)

Updating the Certifications

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 2: Stalkers on Your Desktop

Introduction

Malware Nomenclature

21st Century Paranoid Man

In The Beginning

The Current Threatscape

The Rise of Troy

Rootkits

Kernel Mode and User Mode

Persistency and Non-Persistency

Rootkit Detection

Words Can Hurt You

Spam, Spam, Spam

Fraudian Slips

Advance Fee Fraud (419s)

Phishing Scams

Or Would You Rather Be a Mule?

Pump and Dump Scams

Hoaxes and Chain Letters

Why Do People Pass Hoaxes and Chain Letters On?

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 3: A Tangled Web

Introduction

Attacks on the Web

Hacking into Web Sites

Index Hijacking

DNS Poisoning (Pharming)

Malware and the Web: What, Where, and How to Scan

What to Scan

Where to Scan

How to Scan

Parsing and Emulating HTML

Browser Vulnerabilities

Testing HTTP-scanning Solutions

Tangled Legal Web

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 4: Big Bad Botnets

Introduction

Bot Taxonomy

How Botnets are Used

DoS and DDoS ATTACKS

SYNs and Sensibility

UDP Flooding

ICMP Attacks

DNS Reflector Attacks

Managing DoS and DDoS Attacks

The Botnet as Spam Tool

Click Fraud

Click Fraud Detection

Bot Families

The Early Bot Catches the Worm

Pretty Park

SubSeven

GT Bot

TFN,Trinoo, and Stacheldraht

SDBot

Infection and Propagation

Rbot

Infection and Propagation

Known Vulnerability Exploits

Exploiting Malware Backdoors

Terminated Processes

Agobot (Gaobot) and Phatbot

Infection and Propagation

Terminated Processes

Spybot

Keystroke Logging and Data Capture

Mytob

Bot/Botnet Detection and Eradication

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 5: Cregraveme de la Cybercrime

Introduction

Old School Virus Writing

Generic Virus Writers

The Black Economy

Spam

A Word about Dialers

Botnets for Fun and for Profit

“Wicked Rose” and the NCPH Hacking Group

Introduction to NCPH

Public Knowledge of a Zero-day Word Exploit

The GinWui Backdoor Rootkit Payload

June 21, 2006-2007 - Continued US Targeted Attacks

Backtracking Targeted Attacks: RipGof

Timeline of Events

Introduction to Wicked Rose and NCPH

How Did NCPH Begin?

WZT

The Jiangsu Connection?

The China Syndrome

Lurkers in Your Crystal Ball

Things That Will Not Change (Much)

Social Engineering

Back in Fashion

Botnets

The Shape of Things to Come

Communication: A Common Problem

Automobiles

VoIP

RSS

Podcast

Home Media Systems

Cell Phones

Credit Cards

Operating Systems

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 6: Defense-in-depth

Introduction

Enterprise Defense-in-Depth

Getting to Know Your Network

Choosing Your Network-Knowledge Tools

Designing An Effective Protection Strategy

Secure Individual Hosts First

Purchase Host-based Protective Software

Carefully Examine All Points of Access to Hosts

Malware Detection

Intrusion Detection

SNORT

Virus Detection

Generic Anti-virus

Planning,Testing, Revising

Develop Contingency Plans

Perform an “After Action Review”

Designate a Conference Room or Office as a “War Room”

Personnel

Look Beyond the Borders

Documentation

Malware Laboratory Procedures

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 7: Perilous Outsorcery

Introduction

Key Concepts: Outsourcing AV Services and Risk Management

Key Building Blocks for Managing Outsourced Security

What Do “Security Activities” Imply for a Business Manager?

What does “Outsourcing AV Services” Mean?

What Drives the Success or Failure of Outsourced Operational AV?

First Law

Second Law

Third Law

Fourth Law

Fifth Law

Sixth Law

Seventh Law

What Common Phases does the Project Manager Encounter when Outsourcing AV Services?

What Are The Most Common Problems Seen During AV Outsourcing?

Miscommunication Between Customer and Vendor

Lack of Responsive and Flexible Threat/ Change Management Mechanisms

Procurement and Tendering Conflicts

A Vendor-Centric Worldview

Overestimation of a Vendor’s Competence

The Perils of Outsourcing AV Activities

Why Do More and More Companies Outsource AV Services?

The ‘Perilous Outsorcery’ Management Matrix

The First Dimension: Use The Job Descriptions, Roles, and Functions of People You Meet

The Second Dimension:AV Function Types from Risk and Systems Management Perspectives

The Third Dimension:Type of Governance Role Using The RACI Model

An Example of the “Perils of Outsourcing” Matrix

Critical Success Factors for Surviving AV Outsourcing

Sources of CSFs: the More Explicit, the Better!

Open Peer Communication Lines Between Both Companies

Use a Questionnaire to Match People to AV Functions

Align as Soon as Possible with Monitoring Services (SOC) and Incident Management Teams

Outline the AV infrastructure (as Seen by the Customer and the Vendor) and Discuss Differences

Align or Prepare the Reporting on Compliance Issues of Outsourced AV Services

Putting the Pieces Together

Roles and Responsibilities

Sample AV Skills and Experience Questionnaire for an AV Service Provider.

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 8: Education in Education

Introduction

User Education from an Educationalist’s Perspective

Some True Stories

The Grandmother

The Sister

The Father

The Young Girl

The Self-employed Professional

The Unwitting Spammers

And the Point is...

Where Do You Come In?

Security and Education in the UK

Evaluating Security Advice

Information Sharing and the WARP factor

The Myth of Teenage Literacy

Teaching Security in the Classroom

Duty of Care

Surfing the Darkside Economy

Duty of Care Issues (Again)

Cross-Curricular Security

Technical Areas Checklist

Not Exactly a Case Study:The Julie Amero Affair

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 9: DIY Malware Analysis

Introduction

Anti-Malware Tools of the Trade 101

The Basics: Identifying a Malicious File

Process and Network Service Detection Tools

Web-based Inspection and Virus Analysis Tools

AV Vendors Accept Submissions

Using an Online Malware Inspection Sandbox

Using Packet Analyzers to Gather Information

Results of Running windump at the Command Line to Show Proper Syntax Formatting

Examining Your Malware Sample with Executable Inspection Tools

Using Vulnerability Assessment and Port Scanning Tools

Advanced Tools: An Overview of Windows Code Debuggers

Advanced Analysis and Forensics

Advanced Malware Analysis

Static (Code) Analysis

Packers and Memory Dumping

Quick Assessment

Disassembling Malware

Debugging Malware

Dynamic (Behavior) Analysis

Isolated Environments

Behavior Monitoring

Forensic Analysis

Collecting Volatile Data

Rootkits

Collecting Process and Network Data

Collecting Non-volatile Data

Determining the Initial Vector

A Lesson from History

Case Study: An IRCbot-infected Machine

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 10: Antimalware Evaluation and Testing

Introduction

Antimalware Product Evaluation

Configurability

Cost

Ease of Use

Functionality

Performance

Support Issues

Upgrades and Updates

Information Flow and Documentation

Evaluation Checklist

Core Issues

Testing Antimalware Products

Replicating Malware

Why is Sample Verification Important?

Polymorphic Replicative Malware

Environment

In the Wild Testing

Non-Replicating Malware

Is It or Isn’t It?

Does it work?

Time To Update Testing

Defining the Problems

Problem 1:Time to Update as a Measure of Protection Capability

Problem 2: Baseline Setting for Heuristic/Proactive Detections

Problem 3:Time of Release vs.Time of First Detection

Frozen Update (Retrospective) Testing

A Few Words on False Positives

A Checklist of Do’s and Don’ts in Testing

First of All, Here’s What Not to Do!

How to Do it Right!

Non-detection Testing Parameters

Conclusion

Independent Testing and Certification Bodies

VB100 Awards

ICSA Labs (a Division of Cybertrust)

Checkmark Certification

Anti-virus Level 1

Anti-virus Level 2

Trojan

Anti-Spyware

AV-Test.org

AV-Comparatives.org

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 11: AVIEN and AVIEWS: the Future

Appendix A: Resources

Introduction

Customer Power

Stalkers on Your Desktop

A Tangled Web

Big Bad Bots

Cragraveme de la CyberCrime

Defense in Depth

Perilous Outsorcery

Education in Education

DIY Malware Analysis

Antivirus Evaluation and Testing

Additional Resources

Books

Additional Resources

Linux:

Macintosh:

Network Tools:

SANS:

Security Focus Newsletters

Appendix B: Glossary

Introduction

Index