-: Reverse engineering.
So, I've talked a little bit about reverse
engineering earlier, but we're gonna cover it
a little more in depth, here.
The idea is that malware authors,
when you find a piece of malware, those guys
aren't gonna explain to you how their software works.
So, I find a virus or Trojan or a worm in the wild,
I really don't know how the thing works,
except for observing it's behavior
and the other problem is, I often don't have the code for it
because the code is written in something like Java or C
that's a compile language,
so, all I have is a series of ones and zeroes.
So, I have to go through the process of what's called
reverse engineering and this technique is something
that will take that finished product that complied software,
and help me understand it's inner workings
through decomposing it and breaking
it down into it's components.
Now, this is conducted either one of two ways.
You can either do it through a dynamic analysis
or a static analysis and both are
helpful for different reasons.
When we talk about a dynamic malware analysis
what we're talking about is taking that malware
and putting it into a virtualized sandbox system
and we're gonna launch the malware and see what it does.
So, for instance, I have another whole course
dedicated to malware analysis, if you're really
interested in this field
but for the CSA plus exam, you don't need to know
how to do it, you just need to know what it is
and with dynamic analysis, we take this malware,
we put it into this virtual box, we click on it,
we run it and then we see what it does.
What beacons does it send out?
What ports does it communicate on?
What websites does it try to talk to?
What registry keys does it change on a machine?
All of these things are what is being done
dynamically on the system.
That's why we call it dynamic analysis
because things that are being done at runtime.
Now, there's a lot of automated solutions out there
that can do this in near real-time
where maybe, your company has paid for a system
like FireEye, where they have it where it will scan
your email, put them into a sandbox, run the attachment,
see if it has bad behavior and if not,
they'll pass the email to you.
That's one of those systems out there.
They also do this for other types of malicious activity
as well, depending on the product you buy.
So, there are some automated solutions
but if you're an instant responder, and this is why
it's covered by the CSA plus exam and you get some place
and you see a new piece of malware and you need to
know what it does, so you can stop it
and put it into the DNA sinkhole, for instance
like we talked about before, you're gonna do it through
dynamic analysis because it's the
quickest way to figure out what effects the malware has.
You may not understand how the malware runs
but at least you know the effect that malware is gonna have.
Now, when we talk about static analysis,
you can do this on software or hardware.
First let's talk about software.
This is when you have the code for the malware
and you can actually look at the code,
so if it's a malware that's written something like,
Ruby or Python or another scripting language,
you can actually read that code,
because it's just an interpretative language.
You'll see every instruction it has
and you can read through it and
figure out what that software does.
Now, as I mentioned earlier, if this is something like
C or C++ or C sharp or Java,
one of these complied languages,
you're gonna have a binary, which is a series
of ones and zeroes for hexadecimal.
Still not real helpful if you're trying to read through it.
Static analysis of that compiled code
is very, very difficult because you have to use
a decompiler to take that binary format
and convert it into something that looks
more normal to you.
So, if you using like a Hex editor,
you can read the hex but now you got to know
what that hex is and how that translated into
assembly code and how that assembly may have
come from the original C program.
It's very, very complicated and it
is very, very time consuming.
So, often, we'll do dynamic analysis first
to figure out what the effect of the malware is
and block that and then we may go through
and try to reverse engineer the malware
and figure out exactly what it was doing
by doing a static analysis, which is more in depth
but much more time consuming.
Now, when you talk about hardware,
there is reverse engineering of hardware, as well.
It's very difficult to perform
because there's a lot of software that's embedded
in the firmware of the device.
So, for example, if you have a Cisco router
it has an OS that's in the firmware
and that can be flashed and re-updated and things like that
but that software can get a bug and it can get malware
embedded in it and this is often done by dynamic analysis
on hardware because you see, this is the known function
and now, if I run it and it performs differently,
you think that might be malware.
So, that's usually the way you'll see this done
on a hardware but there are some static
analysis techniques as well that can be used.
Hardware, the biggest challenge with this,
is making sure that you have hardware from a trusted source
and this becomes part of your supply chain management
and why it's covered here, inside the threat
management course because buying your hardware
from somebody you don't trust can have
people who put bad things in your hardware,
for example, if I need to buy a new iPhone,
it would probably be best to buy it from Apple,
because they're the ones who make iPhones
but if i bought it from some third part seller,
and the iPhone came to them and they embedded
some malware and then sold the phone to me,
how am I to know that?
I wouldn't really have a way to figure that out, right?
Same thing with routers and switches.
You want to buy it direct from the manufacturer,
not from third party sellers or not from somebody
who is selling you a refurbished unit
because there is times that they can put other things in it
and so, malware being inserted during the firmware
of the hardware of the hardware devices being put into it
and then the procurement of that is a
real big danger for you as a company
and you have to consider that.
That is part of risk.
Now, there are companies who can take a piece or hardware
and they can scan it for malware and they can look at it
to see if it's been tampered with
or if the box has been opened or any of that kind of stuff
but it is extremely costly because it uses
very special hardware techniques.
There's a couple of companies in the US that do that now.
The problem is, it's very expensive.
Most companies are not gonna go through that expense.
So, you're better off paying a little more money,
buying the product directly from Cisco,
directly from Apple and hopefully, they
have good supply chain management
that you're not gonna have malware
embedded in their products but it is a risk you're taking
and so, that's part of this threat management
is there can be risks there.
So, just want you to keep that in mind.
When we talk about reverse engineering
we're usually talking about taking the malware
and figuring out what it does, that's dynamic analysis
or how it does it, which is static analysis.
Keep those two things in mind and you'll do great.