New published paper - 2011

I presented my paper in 7th IAS 2011 conference in Melaka last December 2011. The paper now already appears in IEEExplore. Get it here

Since I already transfer my copyright to them, you have to get (paid) access to the paper. If your organization subscribe for them, you'll be able to access the paper.

Most universities have access to IEEExplore, should not be a problem.

To cite my paper, use the following BibTex entry

@INPROCEEDINGS{6122799,
author={Zabidi, Muhammad Najmi Ahmad and Maarof, Mohd Aizaini and Zainal, Anazida},
booktitle={Information Assurance and Security (IAS), 2011 7th International Conference on},
title={Ensemble based categorization and adaptive model for malware detection},
year={2011},
month={dec.},
volume={},
number={},
pages={80 -85},
keywords={},
doi={10.1109/ISIAS.2011.6122799},
ISSN={},}

My talks at the recent HITB 2011 Kuala Lumpur

Abstract:

Malware infects a host with exploiting known and unknown vulnerabilities. Among the list of current detections methods, one of them is by using malware signatures in which it is considered fast and works with acceptable computing overhead. The signature generation begins with analysis done by the malware analysts. Since most antiviruses are commercial, least known to the public the method being done for large scale malware signature detection.

One method of detecting malware is by using dynamic analysis, where the behaviour of malware being monitored. The other one is by using static analysis, where it involves the process of diassembling the binary. Here I will share how we can use Python, a powerful interpreted language to do a malicious call analysis.

Drop page: here

Slides: here

Parsing API calls in Windows binaries

Salaam,

Python could be my closest friend here, it helps a lot when you actually exposed to the richness of Pythonists out there!

Here is the example of getting API calls from calc.exe, a benign software in Windows

Here is the example of getting API calls from a Windows binary.

Next step, hooking the intended API calls using Python with pydbg in PaiMei framework.

This process proved to be working on both Windows 7 and Ubuntu 11.04

Malware Cookbook codes

If you aren't aware, there is a book dedicated to malware researchers/enthusiasts out there, namely "Malware Cookbook" . I haven't get the book in my hand, but the codes used in the book are already in google code, here

I tried several Python scripts written by the author, purposely in order to help my research in malware detection. One tool, pe_scanner.py considered outstanding, since it has support for malware entropy analysis, yara for malware classification and PEID support for PE identification.

I also managed to file bugreports and "patch".. since analyzing 30,000 malware sample is tedious, time consuming and possibly leads to migrain.

http://code.google.com/p/malwarecookbook/issues/detail?id=25&can=1

(not exactly bug report, but the problem faced when a given PE having corrupt header, and I have to segregate into different folder, unable to proceed with this kind of binary)

http://code.google.com/p/malwarecookbook/issues/detail?id=26&can=1

(F-prot AV having different line of reporting... so )

I am yet to commit my customized codes, possibly I'll put in github later on.

ClamAV on Cygwin

In case you're wondering, ClamAntiVirus (ClamAV) exists in Window's Cygwin too. And the update works as in other UNIX environment, $freshclam

Gnuplot script in Dionaea honeypot

Ever use Gnuplot? The support for gnuplot is already in Dionaea, previously I used to parse the data manually before showing it out using gnuplot. Original reference, here

Options:


Usage: gnuplotsql [options]


Options:
  -h, --help            show this help message and exit
  -d DATABASE, --database=DATABASE
  -D DESTINATION, --destination=DESTINATION
  -t TEMPFILE, --tempfile=TEMPFILE
  -p PROTOCOLS, --protocol=PROTOCOLS
                        none




This will create the HTML reports with PNG generated graphs from gnuplot:


najmi@vostro:/opt/dionaea/bin$ sudo ./gnuplotsql -d /opt/dionaea/var/dionaea/logsql.sqlite -p smbd -p epmapper -p mssqld -p httpd -p ftpd

Read!

There are many magazines, e-mag, e-zine - you name it that could help you - or kill your boredom during your spare time. Well - what if you're in security domain and need one to flourish your knowledge?

I would suggest the following:

1. Virus Bulletin, electronic version only, montly http://www.virusbtn.com/ . The appropriate readers would be industrial and academic security researchers.
2. IEEE Security & Privacy, printed and online version, periodically, IEEE S & P . Academic researcher would fit this better.

The rest, for example Phrack underground magazine is Free of Charge.