Automated Malware Analysis Platform

Kristian Sigtbakken Holm Martin Kvalvåg Nikolai Fauskrud Olav Henrik Hoggen Automated Malware Analysis Platform Bachelor’s project in IT-Operations and Information Security Bachelor’s project Bachelor’s Supervisor: Basel Katt May 2019 NTNU Engineering Communication Technology Communication Department of Information Security and Department of Information Faculty of Information Technology and Electrical Technology of Information Faculty Norwegian University of Science and Technology of Science University Norwegian Automated Malware Analysis Platform Author(s) Kristian Sigtbakken Holm Martin Kvalvåg Nikolai Fauskrud Olav Henrik Hoggen Bachelor in IT-Operations and Information Security 20 ECTS Department of Information Security and Communication Technology Norwegian University of Science and Technology, 20.05.2019 Supervisor Basel Katt Malware Analysis Infrastructure Sammendrag av Bacheloroppgaven Tittel: Automatisert Skadevareanalyse-plattform Dato: 20.05.2019 Deltakere: Kristian Sigtbakken Holm Martin Kvalvåg Nikolai Fauskrud Olav Henrik Hoggen Veiledere: Basel Katt Oppdragsgiver: Kongsberg Defence & Aerospace Kontaktperson: David Lee Andersen, [email protected], 48227979 Nøkkelord: Innholdsanalyse, Antivirus, Infrastruktur som kode, Virus Antall sider: 86 Antall vedlegg: 13 Tilgjengelighet: Åpen Sammendrag: Alle bedrifter trenger en måte å sikre virksomheten deres, og i dagens digitale tidsalder er dette spesielt fokusert mot å beskytte digitale systemer mot skadelige og ondsinnede entiteter. Denne beskyttelsen blir i dag ofte betjent av ett enkelt antivirus i det private domenet. Hva om flere antivirus og andre analyse verktøy ble samlet inn i en spe- sialisert beskyttelse og analyse plattform? Det er ideen bak "open souce", "self-hosted", VirusTotal alternatives: IRMA. IRMA mottar usikre filer, sjekker dem mot et sett av analyse verktøy og forteller oss om de er trygge eller ikke. Vår oppgave var å undersøke denne løsningen, tilpasse den, og følge "open-source" mantraet, slik at den blir tilgjengelig for oppsett for enhver interessert aktør, for sel- skaper eller for privatpersoner. Sluttresultatet ble et modifisert IRMA system for vår infrastruktur med en bland- ing av andre og våre egne analyseverktøy modifisert for IRMA. i Malware Analysis Infrastructure Summary of Graduate Project Title: Automated Malware Analysis Platform Date: 20.05.2019 Authors: Kristian Sigtbakken Holm Martin Kvalvåg Nikolai Fauskrud Olav Henrik Hoggen Supervisor: Basel Katt Employer: Kongsberg Defence & Aerospace Contact Person: David Lee Andersen, [email protected], 48227979 Keywords: Malware, Antivirus, Infrastructure as Code, Analysis Pages: 86 Attachments: 13 Availability: Open Abstract: All businesses need to ensure their security, and in today’s digital age, this need stretches to protecting digital sys- tems against harmful and malicious parties. This protection is often served by a single antivirus in the private domain. What if multiple antiviruses and other analysers were aggregated into a specialised protection- and analysis platform? That is the idea behind the open source, self-hosted VirusTotal alternative: IRMA. IRMA receives insecure files, checks them up against a set of analysers, and tells us whether the files are safe or not. Our task was to research this solution, adapt it, and follow the open source mantra, making it available for setup and usage for any interested actor, be it business or home. The end result was an openly available, modified IRMA with ex- tended security functionality through a variety of analysers, some of which custom-added. i Malware Analysis Infrastructure Foreword Our inspiration to choose this assignment was because we wanted a challenging project with both security and infrastructure aspects. After four months of development we got both a fun and a quite challenging project. We would like to thank Kongsberg for providing us with all the guidance we could ask for, assistance, and always being available to bounce ideas off of and discuss. We would especially like to thank our contact person and product owner, David Lee Andersen. We would also like to thank Basel Katt for guiding us during the project, referring us to multiple practical sources for information, and challenging our view of the project. We would like to thank our families for constant support through the whole academic ordeal. And finally we would like to thank each member of the bachelor group for working hard throughout the project, for compromising when necessary for progress, and rising above conflicts, and for carrying each other the whole way. ii Malware Analysis Infrastructure Contents Foreword ......................................... ii Contents ......................................... iii List of Figures ...................................... vii List of Tables ....................................... ix Glossary ......................................... x 1 Introduction ..................................... 1 1.1 Problem area, delimitation, and defining the assignment..........1 1.2 Purpose of the assignment...........................1 1.3 Target audience.................................2 1.4 Students’ backgrounds and qualifications...................2 1.4.1 Nikolai Fauskrud............................2 1.4.2 Kristian S. Holm............................2 1.4.3 Olav H. Hoggen.............................2 1.4.4 Martin Kvalvåg.............................2 1.5 Project scope..................................3 1.5.1 Field of study..............................3 1.5.2 Delimitations..............................3 1.5.3 Project description...........................4 1.6 Other roles...................................4 1.7 Project process.................................5 1.7.1 Central project process.........................5 1.7.2 Theory..................................5 1.7.3 Plan for status meetings and decisions................5 1.7.4 Tools used................................5 1.8 Thesis structure.................................6 2 Requirements .................................... 8 2.1 Initial requirements...............................8 2.1.1 Use Case................................9 2.1.2 High level use case...........................9 2.2 Functional requirements............................ 11 2.3 Operational requirements........................... 11 2.4 External requirements............................. 11 3 Theory and technology ............................... 12 3.1 Malware detection............................... 12 3.1.1 Static detection............................. 12 iii Malware Analysis Infrastructure 3.1.2 Dynamic detection........................... 13 3.1.3 Malware Anti-VM techniques..................... 13 3.2 Analytical Infrastructure............................ 13 3.2.1 Infrastructure Alternatives....................... 15 3.2.2 Chosen framework: IRMA....................... 18 3.2.3 Dynamic Malware Analysis tool.................... 21 3.2.4 Chosen dynamic analysis tool: Cuckoo................ 21 3.3 Configuration Management.......................... 22 3.3.1 Automatic provisioning........................ 22 3.3.2 Push vs pull model........................... 23 3.3.3 Configuration Management Strategy................. 23 3.3.4 Configuration Management Tools................... 25 3.3.5 Configuration Management requirements.............. 26 3.4 Orchestration.................................. 27 3.4.1 Orchestration requirements...................... 27 3.4.2 Packer.................................. 28 3.4.3 Vagrant................................. 29 3.4.4 Virtualisation.............................. 29 4 Implementation ................................... 31 4.1 Configuration and set-up of IRMA....................... 31 4.1.1 Hardware................................ 31 4.1.2 Installation............................... 31 4.1.3 Available configuration......................... 35 4.1.4 Analysers................................ 35 4.1.5 Problems with the setup........................ 36 4.1.6 Automatic provisioning of antivirus and tools............ 37 4.1.7 Activation of analysers and possible bug fixes............ 37 4.2 Configuration and set-up of Cuckoo...................... 42 4.2.1 Adaption for our use case....................... 42 4.2.2 Installation............................... 42 4.2.3 ESXi/vSphere support......................... 45 4.3 Changes made................................. 47 4.3.1 Pipeline................................. 48 4.3.2 Kiosk.................................. 54 4.3.3 Cuckoo as a probe of IRMA...................... 58 4.3.4 NSRL.................................. 58 4.3.5 Packer.................................. 60 5 Testing and Analysis ................................ 63 5.1 Development and testing hardware...................... 63 5.2 Efficiency of deployment............................ 63 iv Malware Analysis Infrastructure 5.3 Bottlenecks................................... 64 5.4 Accuracy of scans................................ 65 5.4.1 Testing of benign files......................... 65 5.4.2 Testing of malicious files........................ 65 5.4.3 Statistics................................. 67 5.5 What is shared?................................. 68 5.5.1 Without internet access........................ 69 5.5.2 With internet access.......................... 69 6 Results and Discussion ............................... 70 6.1 Results...................................... 70 6.1.1 Infrastructure setup.......................... 70 6.1.2 Infrastructure modifications.....................

Load more