Ründetarkvara intsidentide ja levitamisviiside analüüs graafilise modelleerimise abil
Files
Date
2017
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Tänapäeval peaaegu igas seadmes kasutatav veebilehitseja on soodsaim keskkond kurivara levitamiseks, kuna võimaldab ründeprogrammidel ekspluateerida hulgaliselt erinevaid vahendeid alates veeblihitseja üldisest ülesehitusest ja pluginatest kuni sellega seotud operatsioonisüsteemi eripäradeni. Seega on veebilehitsejates kasutatavad ründetarkvara komplektid üks levinumaid kurivara esinemisvorme ning seetõttu ka märkimisväärseks probleemiks nii digitaalse ekspertiisi spetsialistidele kui kurivara tõrje valdkonnas üldiselt.Kuigi salvestatud võrgupakettidest võib leida indikaatoreid, mis võimaldavad analüütikul tuvastada kurivara olemuse, pole need tihti piisavad süsteemi kompromiteerituse ulatuse määramiseks. Taoliste indikaatorite üksipulgi läbitöötamine on aeganõudev protsess ning intsidendi analüüs ja terviklik ülevaade sõltuvad sealjuures peamiselt kolmandate osapoolte kaudu saadud infost.Analüüsi käigus saab protsesse küll osaliselt automatiseerida kasutades avalikult kättesaadavaid programme nagu VirusTotal, WHOIS ja erinevad (IP, domeeni või veebilehe põhised) mustad nimekirjad. Seda osa protsessist tutvustab ka antud töö esimene pool.Graafiline modelleerimine aitab kaasa erinevatest allikatest pärineva info ja seoste koondamisel ühtsesse ja kergemini hoomatavasse vaatesse. Töö teine osa keskendubki viisidele, kuidas kasutada graafilise modelleerimise võimalusi nii üksikute intsidentide analüüsiks kui konkreetse ründetarkvara erinevate levitamisviiside kuvamiseks täpsema tervikpildi saamise eesmärgil.Töö viimane osa demonstreerib moodusi, kuidas antud lähenemine aitab välja tuua seosed ja seaduspärad, mille põhjal on võimalik teha pahavara tuvastamise ja tõrjumisega seonduvaid otsuseid ja järeldusi.
In today’s threat landscape, the delivery of malware via browser exploit-kits poses specific challenges to the forensics analyst and from a defensive perspective in general. Web browsers offer a large surface of attack through their own implementation, the plugins they offer and the operating systems that they rely on.However, when looking at network traffic captures, they also leave specific traces that the analyst can identify but those still wouldn’t be enough to clearly determine if an infection was successful or not. Isolating these traces currently requires a lot of manual work and a complete analysis will also have to rely on third-party information in order to give a clear picture and understanding of the incident.A great deal of automation can be achieved here by using public APIs such as VirusTotal, whois databases, IP blacklists, etc during the analysis and a first part of our work is dedicated to that.From our perspective, we also see that the use of graph databases can be of a great help when putting together information from different sources that hold relationships with one another and a second part of our work will be to demonstrate that a graph database approach can be used to analyze single incidents as well as the delivery infrastructure of specific exploit-kits or malware campaigns that are spread by specific actors.We will then show that this approach reveals patterns and clusters from which decisions can be made from a defensive perspective.
In today’s threat landscape, the delivery of malware via browser exploit-kits poses specific challenges to the forensics analyst and from a defensive perspective in general. Web browsers offer a large surface of attack through their own implementation, the plugins they offer and the operating systems that they rely on.However, when looking at network traffic captures, they also leave specific traces that the analyst can identify but those still wouldn’t be enough to clearly determine if an infection was successful or not. Isolating these traces currently requires a lot of manual work and a complete analysis will also have to rely on third-party information in order to give a clear picture and understanding of the incident.A great deal of automation can be achieved here by using public APIs such as VirusTotal, whois databases, IP blacklists, etc during the analysis and a first part of our work is dedicated to that.From our perspective, we also see that the use of graph databases can be of a great help when putting together information from different sources that hold relationships with one another and a second part of our work will be to demonstrate that a graph database approach can be used to analyze single incidents as well as the delivery infrastructure of specific exploit-kits or malware campaigns that are spread by specific actors.We will then show that this approach reveals patterns and clusters from which decisions can be made from a defensive perspective.