The Anti-Virus Guy

I am in danger of pigeon-holing, type-casting myself as The Anti-Virus Guy.

If you have a highly mobile workforce, anti-virus software should be considered as an intrusion detection system.

Intrusion detection systems detect anomalies, typically restricting their focus to anomalous network activity. They detect anomalies; anomalies which may have been caused due to an intruder, although they rarely are. Intrusion detection systems rely upon a person to investigate and determine the appropriate action.

Anti-virus software detects malware, typically spyware or Trojan horse software. A virus (malicious code inserted in a host program) is rare. Anti-virus software has expanded its scope to include a broader range of software that you may not want running.

Learning where the detected malware came from helps you to block access to that location and helps you to learn what other programs arrived from that location. Treat malware detection alerts as suspicious activity to investigate and take appropriate action.

In a mobile workforce you cannot rely upon your network monitoring equipment to inform you about anomalous conditions. Your network-based intrusion detection system can scan internal network traffic including traffic on VPN connections. Other network traffic is outside its scope. Nonetheless, you can still gather information about anomalous events through your anti-virus software.

Related links:

• Is Anti-Virus Dead?
• Web Browser Forensics
• Why Blacklist?
• Fellow Malware Travelers
• How Anti-Virus Vendors Could Improve Detection

WinPcap, Wireshark upgrade message

When upgrading Wireshark, which implies an upgrade to WinPcap, a message appeared:

System Information
Operating system detected on registry: Windows vista - x86
True operating system (kernel.dll): Windows Vista - x86
npptools.dll present on the system:    false
netnm.inf present on the system:       false
nmnt.sys present on the system:        false

This message is normal.

npptools.dll, netnm.inf and nmnt.sys are components of Microsoft’s Network Monitor (netmon) utility. Netmon is a network traffic capture and protocol analysis utility, similar to Wireshark.

Framework

It is better to address the entire organization’s availability, confidentiality, integrity and authenticity (collectively: security) concerns than to test individual applications for security concerns. To that end, Microsoft offers a Security Assessment Tool, useful for even non-Microsoft environments.

• CERT OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) is a suite of tools, techniques, and methods for risk-based information security strategic assessment and planning. Business Continuity Planning
• Information Systems Security Assessment Framework (ISSAF) seeks to evaluate the organization’s information security policies & processes to report on their compliance with IT industry standards, and applicable laws and regulatory requirements
• NIST SP 800-34 Contingency Planning Guide for Information Technology Systems (Business Continuity Planning)
• NIST SP 800-115 Technical Guide to Information Security Testing and Assessment
• NSA IAM National Security Agency InfoSec Assessment Methodology
• Sherwood Applied Business Security Architecture (SABSA) SABSA: the What, Why, How, Who, Where and When and of Contextual, Conceptual, Logical, Physical, Component and Operational
• Zachman International Zachman Architecture Framework: the What, How, When, Who, Where, and Why of Identification, Definition, Representation, Specification, Configuration and Instantiation
• ITIL and ITSM World IT Infrastructure Library (ITIL) is a series of documents that are used to aid the implementation of a framework for IT Service Management (ITSM).
• Microsoft Security Development Lifecycle Procedures for incorporating security into software development. Tools to support steps in the lifecycle as well.

Report SPAM

Send unsolicited commercial email (SPAM) to KnujOn and spam@uce.gov.

Security Patch Management

When security patches are released, expect them to be reverse engineered. Expect an exploit to become available, if it isn’t already. That is, “is exploit code publicly available?” is not an important question. Act as if it is available.

“Is this vulnerability wormable?” is not an important question, either.  Worms were dramatic and news worthy, but now worms are scarce. It makes very little sense to develop a worm; there’s no money in it.

You want to know if your mission critical systems are in jeopardy. Can your data be stolen or corrupted? Where is your data? What would be required to reach it? Any software vulnerability should be addressed quickly.

Plan for spikes in support. For example, you may not know how many patches Microsoft will release on the second Tuesday of the month  but you know that patches will be released. Identify your mission critical applications. Assign a patch testing team for each mission critical application. Each patch testing team needs their own test script. On patch Tuesday, have each team install the patches and go through their test scripts to determine application impact. Set a deadline for a response; perhaps Friday of that week. Require a response, no compatibility issue found or compatibility issue exists. Follow your change control process.

For non-Microsoft patches, the notification process is less straightforward. Subscribe to the Secunia notifications to and any specific vendors you require. Encourage your vendors to adopt an announcement cycle. Don’t accept “when required” or “as needed” as responses. While they are caught by surprise when vulnerabilities are found, that unpredictability can be managed for their customers in all but the most troublesome of vulnerabilities.

Review your exposure, there’s some exposure but mitigation could be more expensive. Patch installation should never be your only mitigation measure, but it is always an important one.

Web Browser Forensics

What question were you trying to answer? Could be:

• Where did this malicious software come from?
• What web sites has this person been visisting?

What access do you have? Could be:

• A single machine, and I have local access
• Multiple machines, and I have remote access

Is this actually a Forensics examination, where you care about preserving evidence, or is this a root cause examination, where discovery (not legally admissible evidence) is the goal.

The answers affect the tool you choose and how you use it. For example, in a “concerned parent” scenario there is a single Windows machine using Internet Explorer, for which you have local access, and  you want to learn the web sites visited. Use Mandiant Web Historian and inspect the C:\Users\<userid>\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat file. (A firewall log of successful web connections would be of more help.)

On the other hand, consider a large environment that investigates web-based malware alerts. Here the questions are: where was the threat encountered and what else arrived from that site or around that time. As part of the alert, you have the machine name and user id and the name of the malicious file.

Grab copies of the Index.dat files, saving them with names that make them distinguishable later. Use Pasco
(http://www.sourceforge.net/projects/fast) to make tab-separated text files from the dat files.

A batch file to make this task easier:

@echo off
if (%2)==() goto ERR_SYNTAX
copy "\\%1\C$\Users\%2\AppData\Local\Microsoft\Windows\Temporary
Internet Files\Content.IE5\index.dat" "%1_%2_cache_index.dat"
attrib -s -h "C:\Users\%2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat"
copy "\\%1\C$\Users\%2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat"
"%1_%2_history_index.dat"
attrib +s +h "C:\Users\%2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat"
copy "C:\Users\%2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat"
"%1_%2_history_index.dat"
pasco "%1_%2_cache_index.dat" > "%1_%2_cache_index.txt"
pasco "%1_%2_history_index.dat" > "%1_%2_history_index.txt"
GOTO EXIT
:ERR_SYNTAX
Error - requires two parameters, machine name (or IP address) and userid
:EXIT

When loading the text separated text file into Excel, some columns won’t line up. Close enough for my purposes, though.

Note that this problem in Excel is because some of the original fields in the index.dat file contain tabs; using pasco to create a tab-separated text file when some fields contain tabs is problematic. If you wish to be consistent, fields rarely contain pipe characters; creating a pipe character-separated text file will produce a more consistently formatted Excel spreadsheet.

The questions again were: Where was the threat encountered and what else arrived from that site (or around that time).

Search the resulting text file for the detected malicious file. This turns up a lot of undetected malware. A malicious site rarely sticks to only one threat. A site typically hangs on to the older, already detected threats when breaking in a new, undetected threat. Get a sample of the new, undetected threat and submit it to vendors. You will also turn up a pattern of sites and ASNs. Report sites, blacklist sites, and the count of detected threats goes down.

Utilities:

• Chrome Analysis Internet only, Google Chrome only utility
• Firefox 3 web browser forensics Includes description of the SQLite database, how to use sqlite3 to view the database and a PERL script to generate a report from the database. No need for Windows.
• Firefox 3 web browser forensics using f3e
• Fox Analysis Internet only, Firefox 3 only utility
• Mandiant Web Historian Internet only, Firefox and Internet Explorer utility
• Pasco (part of the Forensic Analyst’s Software Toolkit) Internet Explorer only utility
• SQLite Database Browser Public domain SQLite database browser, useful for Chrome and Firefox’s downloads.sqlite

Report Phishing

Report phishing by sending a saved copy of the email to

• phishing-report@us-cert.gov
• spam@uce.gov
• reportphishing@antiphishing.org

See US-CERT’s Report Phishing, FTC’s Phishing and Anti-Phishing Working Group (APWG), respectively. A copy of the email is preferred to forwarding the email, since forwarding loses source information.

There is also PhishTank, although that seems to be oriented toward URLs (e.g., web advertising that collect personal information for redistribution) and not toward email threats.

October 2009 is National Cyber Security Awareness Month

From InfraGard:

October 2009 is National Cyber Security Awareness Month (NSCAM), which the FBI endorses and participates.  The NSCAM event has been held every October since 2001, as a national awareness campaign to encourage everyone to protect their computers and our nation’s critical cyber infrastructure.

Cyber security requires vigilance 365 days per year.  However, the Department of Homeland Security, the FBI, the National Cyber Security Alliance, and the Multi-State Information Sharing and Analysis Center, coordinate to shed a brighter light in October on what home users, schools, businesses and governments need to do in order to protect their computers, children, and data.

Ultimately, our cyber infrastructure is only as strong as the weakest link.  No individuals, business, or government entity is solely responsible for cyber security.  Everyone has a role and everyone needs to share the responsibility to secure their part of cyber space and the networks they use.  The steps we take may differ based on what we do online and our responsibilities.  However, everyone needs to understand how their individual actions have a collective impact on cyber security.

Please read the Awareness Month Fact Sheet, Awareness Month What Home Users Can Do Tip Sheet, and the Awareness Month CSAVE Fact Sheet.

You can read more by visiting STAYSAFEONLINE.ORG.

Thanks,

John “Chris” Dowd
Unit Chief
Public/Private Alliance Unit
Strategic Outreach and Initiative Section
Cyber Division

Can You Trust That Web Site? (URL Shortener edition)

Regarding URL shorteners such as Bit.ly, is.gd, ow.ly and tinyurl.com, services designed to redirect to a different, typically longer, URL.

• They are nearly mandatory when posting a URL via Twitter (or other microblogging site).
• They can get your email dropped by a SPAM filter, since URL redirection (URL forwarding, URL obfuscation) is how malicious sites get past SPAM filters.
• A URL shortener service takes links out of your control; many of the free URL shortener services have already shut down.

You want to know if you can trust that web site, and a meaningless link doesn’t help. Note that you should always treat any link you may see in an email or web page as meaningless; there is no reason to trust that what the link connects to the text displayed.

Instead of HpHosts as your first step (my advice from Can You Trust That Web Site?), go to vURL. vURL reveals and expands the redirected web site. You can learn what the obfuscated URL will lead you to (and examine the code) without directly connecting to the web site. Then learn if the revealed web site is trustworthy at HpHosts.

Can You Trust That File?

More importantly, can you trust that file’s source? Learning to suspect the source and being cautious (see Can You Trust That Web Site) is crucial.

Sometimes you want to confirm the source or authorship of a program, document, spreadsheet, or PDF file. Unfortunately, developers are not required to digitally sign executables (it is recommended, but not enforced). Confirmation of a certificate would help establish trust for a program. Similarly, persons rarely add digital signatures to documents, spreadsheets or PDF files. Again, this would help confirm its source. We don’t get the digital signature mechanism, so we need ways to make informed decisions (educated guesses) about whether programs and other files are trustworthy.

If you’re running anti-virus software, then you already have its opinion. You can be too careful, to point that it interferes with your responsibilities, but it is healthy to be suspicious.

Finding suspicious programs is covered in Simple Malware Discovery Measures.

Send the sample to your anti-virus vendor. They have the analysis procedures and expertise; you don’t.  It doesn’t hurt to get a second opinion, though. I use VirusTotal to test a suspicious file against multiple anti-virus vendors. Expect some vendors to report that a file is malicious while others do not; this does not necessarily indicate that some vendors are more effective than others. For example, Sunbelt Software reports that FlashGet is a Trojan horse program because it contains support for the bittorrent protocol. This, like other peer-to-peer file sharing schemes, introduces a remote control mechanism. If you are unaware of this feature it can be used to compromise your system and Sunbelt appropriately warns you.

Alternatives to VirusTotal (test a suspicious files against multiple anti-virus vendors):

VirSCAN Submit suspicious file, up to 20 MB (even password protected ZIP or RAR files)

Anubis Iseclab Anubis is a service for detecting and analyzing web-based malware. It currently handles executable files as uploads and as URLs.

Information Technology Information Sharing and Analysis Center (IT-ISAC) Public section with best practices, news, references and a suspicious file submission vehicle. Private section for organizations

Offensive Computing Submit a suspicious file. Almost, news about real threats that mainstream media doesn’t cover.

ThreatExpert Submit a suspicious file.

UploadMalware Submit up to six suspicious files.

Sandbox utilities, analyze the program’s behavior for signs of maliciousness

InMAS CW-Sandbow Internet Malware Analysis System – submit W32 samples up to 16MB

Norman Sandbox Upload suspicious executable to be run and monitored for suspicious behavior (not just scanned). Archive files will not be unpacked, they are only scanned.

Sunbelt CWSandbox

Special purpose analysis sites

jsunpack jsunpack is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files.

wepawet Wepawet is a service for detecting and analyzing web-based malware. It currently handles Flash, JavaScript, and PDF files.

Reverse engineering

Really? You want to spend your time on this? What are you trying to find?

VirSCAN and PEiD can be used to identify which packer, cryptor or compiler was used (if any). Then use an appropriate unpacker:

• Ollydbg with the Ollydump plugin
• IDAPro with the “Universal Unpacker”
• Generic Unpacker Win32 by Christop Gabler
• To be practical, use the latest PEiD and Google for the packer it finds along with the word “unpacker.”

Once unpacked and unencrypted, use strings (from Sysinternals). You may find a URL that the program connects to. When you encounter a suspicious URL, you have learned you cannot trust that file.