Malware protection and defense needs fresh approach
Traditional methods of analyzing malware to produce detection signatures are no longer a viable way to identify and eradicate malicious code on infected machines, according to a noted security expert who is hoping his research will prompt the security industry to change its ways.
Greg Hoglund, a malware expert and founder of HBGary Inc., is pushing a malware analysis method that focuses on malware attribution and fingerprinting techniques to study and document the toolmarks left by hackers within the malicious code. This method is better than traditional malicious code analysis because when malware is executed, it has obfuscated string data that would not be present on a file that is sitting at rest on disk or a file that was acquired in transit over the network, Hoglund said.
If done right, security pros can block certain attacks on their network by preventing them from executing and tracing malware back to their source. URLS used to connect to the command-and-control server and DNS strings can be carried directly over to perimeter security devices. "Input those specific strings into them as IDS signatures and very rapidly you can detect other machines that are infected with that same attack and communicating with the command and control," Hoglund said.
