Blog

Malware Analysis: Tools of the Trade

Excellent information gathering by Lorna Hutcheson in this Internet Storm Center Handler’s Diary Entry. From the diary entry:

First I want to thank everyone who sent in tools for this endeavor. I hope that this list of tools continues to grow and everyone can get good use out of it. If you look at the diary entry that launched this endeavor, you will find the information that I’m looking to obtain about the tools. If you have some that need would be good to list here, please pass them along and I’ll update the list. Some folks sent in entries and checked the box not to have thier names mentioned, so there are no names by those submissions. If you want me to include your name, I’d love to, but you need to give me permission first when you submit the information. All information has been submitted as provided. If you have any additions, I’d be happy to add them!

The List:
1.   Malcode Analyst Pack

a. Where you can get it (if known)- iDefense http://labs.idefense.com/labs-software.php?show=8
b. Shareware/Freeware- GPL/Freeware
c.  What it does-
This install package contains a handful of small utility type applications that have proven useful while analyzing malicious code.
These are quick tools designed to meet specific needs while in a malcode testing lab environment. Functionality is tailored specifically to these ends, implementation may be crude at some points but all have proven utility.
This package includes:
       • ShellExt      – explorer shell extensions
       • socketTool    – manual TCP Client for probing functionality.
       • MailPot       – mail server capture pot
       • fakeDNS       – spoofs dns responses to controlled ip’s
       • sniff_hit     – HTTP, IRC, and DNS sniffer
       • sclog – Shellcode research and analysis application
       • IDCDumpFix    – aids in quick RE of packed applications
       • Shellcode2Exe – embeds multiple shellcode formats in exe husk
       • GdiProcs      – used to detect hidden processes

d.  Tips for using it or gotchas- N/A
e.  Is the source of the tool considered trustworthy?– as trustworthy as iDefense is 🙂
f.   Screen Shots of the tool in action (optional)- there is a wmv of the shellcode logger usage on the site (link at bottom of page)
g.   Links to additional resource information about the tool- N/A

2.  RegMon, FileMon, Ethereal:  Submitted by Ronan Rose

a.  Where you can get it (if known)- 
     RegMon, FileMon and TCPView at www.sysinternals.com
     Ethereal: Included with red hat many linux distros
     MSVPC: microsoft.com (trial)
b.  Shareware/Freeware-  unknown – trial versions / freeware
c.  What it does: 

  • RegMon: monitors processes accessing the registry.
  •  FileMon: monitors processes accessing file system.
  •  TCPview: lets you see in real time what applications are listening on your ports.
  •  Ethereal: will give you a good view of what is happening on the network at a packet level.
  •  MSVPC: will allow you to set up a network on your PC. I have a 2.4 ghz, 60GB HD and 750 mb ram which allows me to run 3 VMs simultaneously in a LAN – server2003 to provide dns, ftp, smtp etc,
  • Win2k client as Malware host and to run filemon and reg mon on, and redhat 7.2 vm to use ethereal
d.  Tips for using it or gotchas-
  • In the case of malware with Regmon look for processes polling the “run” keys in the registry . You will need to exclude some processes from both tools (there is quiet alot happening under the bonnet in windows) to improve legability, but if you are still not finding your problem, remember that some malware can inject itself into legit processes, so drop any filters and start again.
  • Filemon should show you any process that is systematically looking for information on your hard drive.
  • TCPview lets you see in real time what applications are listening on your ports.  Some of the newer malware claims to be able to defeat some of the file, registry, tcp view type apps with rootkits etc. When in doubt, check ethereal – if the network is still busy, then you are still infected!
e.  Is the source of the tool considered trustworthy?  All tools are trustworthy and come from a reliable source.
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-

3.  Windows 2000 RAM dump parsing tools:  Submitted by Harlan Carvey

a. Where you can get it (if known)- http://sourceforge.net/project/showfiles.php?group_id=164158
b. Shareware/Freeware-
c.  What it does-
d.  Tips for using it or gotchas-   The tools themselves should be platform-independant, and only require Perl.  I’ve had previous versions tested on Linux, and even a Mac G5.
e.  Is the source of the tool considered trustworthy?
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-

4.  Wireshark, formerly Ethereal

a. Where you can get it (if known)- http://www.wireshark.org/
b. Shareware/Freeware- Free & Open source
c.  What it does-  Analyzes network traffic & packets. Useful for observing if and where malware is attempting to deliver/recieve payload(s) and via which protocol(s).
d.  Tips for using it or gotchas-  
e.  Is the source of the tool considered trustworthy?  Yes, trustworthy, would run it on primary systems if needed. Open source, can compile from source code if desired. Having access to the full source code for scrutiny adds to the level of trust.
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-  Numerous links available on the Wireshark home page,  www.wireshark.org

5.  OllyDbg:  Submitted by Vince Maes

a. Where you can get it (if known)- http://www.ollydbg.de/
b. Shareware/Freeware- OllyDbg is a shareware, but you can download and use it for free.
c.  What it does-  Provides binary code analysis for Windows-based malware.  Some of it’s best features are:

-Attaches to running programs
-Analyzes complex code constructs such as call to jump to procedure
-Sets conditional, logging, memory and hardware breakpoints
-Traces execution and logs arguments of known functions.
-And lots more…
d.  Tips for using it or gotchas-  
e.  Is the source of the tool considered trustworthy? 
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool- 

6.  IDA Pro:  Submitted by Vince Maes

a. Where you can get it (if known)- http://www.datarescue.com/
b. Shareware/Freeware- Cost of standard edition is $439  This tool is worth the cost.
c.  What it does-  Disassembler and debugger with an assortment of community developed plug-ins. Supports a multitude of processors. Use a graphic interface. It allows you to step through malicious code. Best to run in a virtual machine with no network access.
d.  Tips for using it or gotchas-  
e.  Is the source of the tool considered trustworthy? 
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-

7.  Holodeck:  Submitted by Vince Maes

a. Where you can get it (if known)- http://www.securityinnovation.com/holodeck/
b. Shareware/Freeware- Cost of single user license $1495.00
c.  What it does-  Basically a great fuzzing tool. Automated point-and-click fault scenarios, function call logging, operation intercepts, network packet logging, and a debugger just to name a few. There is a book by the developers that contains a light version of the product: How to Break Software Security.
d.  Tips for using it or gotchas-  
e.  Is the source of the tool considered trustworthy? 
f.   Screen Shots of the tool in action (optional)-
g.   Links to additional resource information about the tool-

WEBSITE LINKS:
1.  Pedram’s site:   http://pedram.redhive.com/   Submitted by  Vince Maes

OSSEC version 0.9-3 (0.9 update 3) is available

OSSEC is an Open Source Host-based Intrusion Detection System. It performs log analysis, integrity checking, rootkit detection, time-based alerting and active response.

It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows.

New in this release:

  • Added support for Windows firewall logs
  • Improved pix rules
  • More named rules
  • Fixed description with typos
  • Fixed command line options for list_agent
  • Changed logcollector behavior for checking file rotation
  • Changed logcollector behavior for checking if the file has more data. We are now forcing an fgetc and looking for EOF (old method using stats was broken on some Windows versions)
  • Fixed problem with Endianess on some platforms (specially Linux sparc)
  • Fixed rotation issue for log files with a variable name
  • Windows agent should not exit if syscheck is disabled
  • Fixed alert level on e-mail messages
  • Added more modsecurity rules
  • Added support for HP-UX
  • Added support for Microsoft FTP logs
  • Added support for Microsoft Exchange logs (IIS SMTP)
  • More rules for sendmail (rejected due to pre-greeting)

To download the new version:
http://www.ossec.net/en/downloads.html

More information at:
http://www.ossec.net

Computer Security Podcasts That Don’t Suck

Special thanks to Chris Brunner for cataloguing all these security podcasts. From the blog posting:

Over the last several months, I’ve done my best to seek out every podcast related to computer security concepts. I started with a list of just under fifty podcasts and gradually eliminated the ones that consistently failed to offer interesting ideas or were simply too watered down. I’m left the following list of podcasts that I feel are worth listening to. Since each podcast certainly isn’t for everyone, I’ve included some details to make it easier to pick that ones that would most likely interest you the most. This list is in a blatantly-subjective order.

Name: PaulDotCom Security Weekly
Main Subject: anything related to computer security
Format: Casual
Approx. Updates Per Month: 4 to 5
Recent Subjects Covered: mobile malware, hacking ATM machines, tool that allows for hosts to communicate over wireless without being associated, Spamhaus in trouble, Filtering IM for kids, Hacking Web 2.0 Applications with Firefox
Justification: All kinds of good stuff week after week.  Highly recommended.
Rss Link: http://pauldotcom.com/podcast/psw.xml

Name: Security Now!
Main Subject: computer security and basic technology concepts
Format: Formal
Approx. Updates Per Month: 4 to 5
Recent Subjects Covered: Parallels, Virtual PC, Application Sandboxes, Blue Pill, Vista's Virgin Stack
Justification: Despite the fact that Steve Gibson is a total tool who proves repeatedly that he knows alot less than he thinks he does, the show still touches on a number of interesting subjects that are worth tuning in for.
Rss Link: http://leoville.tv/podcasts/sn.xml

Name: Binary Revolution Radio
Main Subject: hacking, phreaking, computer security
Format: Casual
Approx. Updates Per Month: 4 to 5
Recent Subjects Covered: Toorcon, IPv6, Covert Channels, Phishing, Tunneling
Justification: Less organized but offers fresh information and interesting discussion each week
Rss Link: http://www.binrev.com/radio/podcast/

Name: PLA Radio
Main Subject: Phreaking
Format: Very Casual
Approx. Updates Per Month: 1 to 2
Recent Subjects Covered: Free Phone Calls, Beige Boxing, Deaf Relay Operators (IP Relay), Social Engineering
Justification: Covers topics related to "phone hacking".  While the format is a bit strange, some of the older episodes had me laughing uncontrollably and are worth a listen.
Rss Link: http://www.phonelosers.org/rss.xml

Name: Off The Hook
Main Subject: General technology, phreaking, politics
Format: Semi-formal
Approx. Updates Per Month: 4 to 5
Justification: This show, hosted by Emmanuel Goldstein, has been running since the 80's and has become somewhat legendary in the Hacking and Phreaking communities as it's been there to document the evolution of technology.  Definitely worth a listen.
Rss Link: http://www.2600.com/rss.xml

Name: SploitCast
Main Subject: new vulnerabilities, exploit code, security and technology news
Format: Casual
Approx. Updates Per Month: 1 to 4
Recent Subjects Covered: Interview with Johnny Long, ping tunneling, sensitive data on stolen laptops, Zfone, high level ISP hacks, darknets
Justification: They haven't been releasing much lately, but their episodes are usually pretty interesting.  I can't find any other podcasts that discuss exploit code in great detail.
Rss Link: http://sploitcast.libsyn.com/rss

Name: Blue Box: The VoIP Security Podcast
Main Subject: VoIP Security, of course
Format: Semi-casual
Approx. Updates Per Month: 3 to 6
Recent Subjects Covered: Skype security news, interviews, VoIP fraud, recent vulnerabilities
Justification: Covers some great VoIP-related security-centered information.
Rss Link: http://feeds.feedburner.com/BlueBox

Name: TWAT Radio
Main Subject: All things technology with a slight security focus
Format: Casual
Approx. Updates Per Month: 10+
Recent Subjects Covered: Newsgroup readers, Wireless attacks for dummies, Eggdrop, Wake On Lan, Network Recon, VPNs, The GIMP, Cygwin
Justification: Covers a great deal of different technology subjects
Rss Link: http://www.twatech.org/wp-feed.php

Name: Basenet Radio
Format: Casual
Approx. Updates Per Month: 2 to 4
Justification: Underground feel, great information
Rss Link: http://www.basenetradio.net/rss2.xml

Name: LugRadio
Main Subject: Linux and Open Source
Format: Casual
Approx. Updates Per Month: 0 to 2
Recent Subjects Covered: the Portland Project, trusted computing, comparison of Linux distributions, Software Freedom Day
Justification: Possibly the most popular Linux-related podcast
Rss Link: http://www.lugradio.org/episodes.rss

Name: The Linux Link Tech Show
Main Subject: The cutting-edge in Linux-based technology
Format: Casual
Approx. Updates Per Month: 4
Recent Subjects Covered: Linux Home Automation, OpenWRT, Asterisk, Debian vs Mozilla, DRM
Justification: Lots of good Linux-related information
Rss Link: http://www.thelinuxlink.net/tllts/tllts.rss

Name: StillSecure, After all these years
Main Subject: All things related to information security with a focus on a business environment
Format: Formal
Approx. Updates Per Month: 2 to 5
Recent Subjects Covered: Interview with Steve Hanna of Juniper Networks, TCG/TNC, The IETF, 3rd party patching
Justification: This podcast includes some great interviews and information centered around enterprise security
Rss Link: http://clickcaster.com/clickcast/rss/1653

Name: Symantec Security Response Podcast
Main Subject: Security updates
Format: Formal
Approx. Updates Per Month: 2 to 4
Justification: A consistent source of security updates – great for people who are charged with defending a network for a living
Rss Link: http://www.symantec.com/content/en/us/about/rss/sr/sr.xml

Name: Network Security Blog
Main Subject: Network Security…
Format: Formal
Approx. Updates Per Month:
Rss Link: http://www.mckeay.net/secure/index.xml

Scroll to top