body are made of aluminum your host for
the next two sessions and I see that you
all made it through the night
unbelievable I think you're more awake
than I am anyway we have two brilliant
presentations ahead of us and one of
them is a very interesting story about
virustotal
from Randy Abrams actually I know Randy
Abrams for how many how many years I I
don't know something like that yeah way
too long I think anyway from Microsoft
from ESET and from some other parties
anyway I would go and give the room to
him at this moment Randy go ahead good
morning and thank you for all showing up
first thing in the morning on Fridays
fatah so I'm going to talk to you a bit
about virustotal as you probably guessed
and I'm going to tell you everything you
need to know about virustotal
on one slide I know you think you
understand what you thought you I said
but I'm not sure you realize that what
you heard is what I meant
and for most people using virustotal
that describes it perfectly so just a
little bit about virustotal it was
started by his physec the spanish
company it was acquired by Google in
September 2012 which kind of caused a
ruckus in the security company security
world wondering what's going to happen
it's a cloud-based security resource a
lot of people call it virus total virus
scanning service it's a lot lot more
than that they provide third-party
analysis of files URLs domains hashes
but they also do some of their own
research and augment it with that and
they have a threat intelligence feed so
this is the interface most people are
familiar with Feroze Tom will you tell
it a file URL whatever and you submit it
but there are other ways to do it their
desktop there's a desktop application it
gives you context menu drag-and-drop you
can use email if you put scan in the
subject line it's going to return this
and results like you would expect if you
put scan plus XML you get XML email is
the lowest absolute lowest priority way
to submit something and for example in
researching the presentation two weeks
ago I submitted a file and it's not back
yet so I don't recommend email
virustotal has a public API I encourage
you to sign up for the virustotal
community you'll get a free api key
unless you don't know how to use an api
like me but if you do go look you know
you don't need me to talk about it I
don't show it but there is a private API
that a lot of researchers in the room
use and it returns a much richer data
set there's also an Android application
which I kind of find the little androids
they know it but evidently they don't
know Google yet it's all submit Google
for them so who doesn't love a bunny
rabbit a cute bunny rabbit really tell
if you don't love a cute bunny rabbit
you've never seen a good recipe for a
cute bunny rabbit okay
are all of you familiar with the killer
rabbit of Karen okay Wow route this is
referring to a Monty Python sketch that
little cute harmless bunny rabbit jump
up in the air and grab your throat and
kill you in fact it took a Holy Hand
Grenade to kill that little whatever so
I got an email one day and you know it
says this is a cute little bunny rabbit
and it's got the executable attachment
rabbit dot exe and tells me this is
really funny so of course I mean I'm
gonna open it double click and that's
what would happen when you double click
on it and it's like huh I wonder what
else happened so I submitted to
virustotal and this is interesting
I have only found a couple descriptions
Roos SEL sobs there's a lot of variants
but the couple I have found are things
like bots and dental motors and
keystroke loggers and I mean this this
is pretty
common in this result is all see Trojan
LK win Trojan joke we got two languages
here Trojan and joke what general
variant there's all kinds of detections
here it's all over the place so what is
it you know we've got an Artemis Artemis
is mcafee cloud so you can't tell what
it is eight genetic generic versions of
Zeus II you know it's kind of bad stuff
one generic malware ten detection that
call it a joke somewhere in the name a
risk where nine Trojans actually the
rabbit wasn't one but it included a
Trojan joke to pups and twenty-eight
products did not detect this at all as
anything so I got a riddle here for you
if he is she then who is he and is a dog
of fish is a dog of fish yes no nobody's
answer what language are you speaking if
you're speaking Hebrew then he means she
it's a Hebrew word for what we say she
and who is he and then yes a dog is a
fish actually typically it's spelled D a
a G but it's pronounced so remember that
Trojan joke we're using two different
languages here so if I say I was out
walking my dog in the snow when I ran
into a friend of mine do I mean a dog or
was I out walking my fish in the snow he
was wearing a bikini am i talking about
I could I hope not this is bad or was I
saying she is wearing a bikini I always
knew he was strange am I talking about a
guy are a woman that appears to be from
a different species so is the bunny
funny
Artemis I can't tell I suspect that it's
a false positive but I really can't tell
you if that Artemis is saying it's a
joke or a pup or whatever
Zess II Elza almost certainly a false
positive except maybe some of the
variants are I don't know
generic malware that's a false positive
this is not generic malware joke yes
this is a joke email me if you'd like a
copy of rabbit dot exe it's a lot of fun
to send to people well you can't really
send it an email unless you get them to
unzip it risk we're okay in the
corporate environment imagine that
you're sitting in a call centre and
someone opens this up and ten cubes all
around here hey everybody I'm watching
porno and the real risk is still the
person that sent it there's no job
anymore trust me I don't have a job
trojan it's a false positive yeah you
can say any program can be a Trojan I'll
tell you what you detect formula
actually I think it's for mass comm on
the virus bulletin test false positive
this is not a Trojan pup potentially
unwanted who in here does not want
rabbit dot exe and finally no detection
and no detection is completely valid
there's nothing malicious about this
program there are no bad programs
there's bad people so I'm going to go
into some myths about virus total one of
them is that virus total can be used for
comparative testing and I'm not going to
address up all that virus total address
it they're tired of repeating it's not
used for comparative passing and they're
really really nice they say that if
you're doing that you've got implicit
errors in your methodology which is a
very polite way of saying you kind of
don't know what you're doing at all
another myth that virus total detection
of malware means that the antivirus
scanner can detect the malware well as
virustotal explains the versions they
use our command line and I can tell you
from testing that a command line version
does not necessarily behave
as the version with a GUI and they can
have different techniques having a
command-line does not use the full suite
and all the capabilities to provide
protection or detection you can have
desktop and Gateway solutions on the
same scan and you cannot compare those
for comparative testing that's apples
and oranges or apples and fish and dogs
and then the developers the researchers
can add their own command lines which
can dramatically increase or decrease
your heuristic capabilities more geek
mythology lack of detection means the
file is safe
you don't believe that do you I have to
explain that to anyone in the audience
please say no thank you
well oh I didn't there's some people
don't realize that because they can have
custom detections they can choose not to
detect a file they detect it but they
choose not to because they don't want to
tip their hands to the virus malware
authors that are using virustotal but
you start getting into context let's
assume that this file is completely and
totally clean in fact the one I
submitted is probably completely and
totally clean but that doesn't mean it's
safe if you look at this in the
additional file detail the certificate
was explicitly revoked by the publisher
now I was curious snooper is a weird
copyright usually it's incorporate or
something the research I did led me to
believe that there a valid publisher
they might have revoked the certificate
because it got stolen that's probable I
don't know you could revoke a
certificate because it's got such a bad
security risk you don't want people
installing it but a clean detection it
may be harmless you probably don't want
to run it another one they saw a
certificate out of validity
someone could have forgot to time stamp
it maybe the company went out of
business but this is important
contextual information file not found a
lot of people think this file came in
under suspicious circumstances it's not
found and extrapolate okay nobody
detects this brand new unknown piece of
malware no it just means virustotal
hasn't seen it in one in case that
happened so I went to ops wot to there
meta Defender and it turns out if
virustotal had that sample you would
have seen at least three different
products detecting it so it's always
good to get a second opinion or third or
fourth there's a lot of stuff out there
false positive means false positive and
that isn't exactly true like I said
visit the
senators can withhold they can add high
heuristics but this was really
interesting that several scanners
false-positive on hello world it was a
debug version and Jim Regan I'm Steve
Reagan it was awesome he asked the
vendors why it happened and the
responses were interesting
Iram said that the layers work in
conjunction and since they've only got
the command line that false-positive
could have been mitigated by additional
components doctors been krauser from
CrowdStrike
read the article he has some humorous
stuff in there too but works with
several other layers of defense ROG
don't no one you know that just uses
their dynamic machine learning engine or
a static one they've got dynamic you can
use multiple layers so that
false-positive Garneau from f-secure it
wouldn't have triggered on the customer
machine because they have mitigation and
f-secure like many vendors in this room
also have machine learning vincent wafer
for McAfee it was on the gateway it
probably was a true false positive if
you want to call it that on the Gateway
heuristic aliy I think it's acceptable
but again it's that would have been seen
on the endpoint
I loved how Ryan described this because
it's a valid approach just because it
doesn't do something bad it doesn't mean
you don't detect it it doesn't appear to
do anything good at all and what he's
talking about is application reputation
you get that in smart screen you get
that in Google Safe Search it's a very
valid way of blocking unknown malware
you're gonna get some unknown clean
files developers can get off of the bad
application reputation list here's one
false positive means false positive well
what about this four out of how I mean
you know 57 is it a false positive at
four have it's a I don't care it's
adware up up whatever and
testing that's not a valid sample now as
a consumer I might care I might not want
and I might even say consistently
products detect more pups than others
that their methodology their
decision-making is different I want the
one that gets the pups to but that's
frequently also a configuration thing in
the GUI detection by more scanners is
better coverage oh man that one drives
me nuts the number of scanners that
detect a file are not relevant as much
as how many people in corporations are
actually protected so virustotal here 32
out of 64 is that good coverage bad
coverage mediocre coverage well let's
look at who's got it on lab this speaks
to geographical geography makes a
difference on labs in Korea so we've got
some Korean coverage here Avast has a
large market share I do
China ESET has a large market share
Kaspersky does Malwarebytes does too
however malwarebytes is a bit
interesting because frequently it's used
after the fact it's not unless you have
a paid version that won't protect you as
it comes in but it's good for the
techies that are trying to help a friend
clean up McAfee
Jihu 360 China again rising China China
seems to have really good coverage
Tencent would make it better Trend Micro
so we're seeing a lot of people being
covered but look who missed it Microsoft
and Symantec that's a large number of
people and if Symantec had gotten that
one in this case you could have had 10
scanners that detected it not detect it
and more people are protected in fact in
this case you know 14 out of 58 it looks
like pretty poor protection but Symantec
got it and that protected a heck of a
lot of people
Jihu and rising that whole
some China you know Kaspersky ISA the
vast so it's not the number of scanners
it's the number of people that they
protect that matters for coverage okay
malicious website means malicious
website another myth
this was an interesting one to me the
detection ratio three site said it's
malicious that's not uncommon even with
really malicious websites that's not
uncommon for just a couple they call it
bad but in this case that site is a
legitimate political party one of the
oldest political parties in Hong Kong
and their site was compromised
and I found this very interesting that
when you go to the URL there's this PHP
file and some of the data you can get
from virustotal is what other file names
have we seen it under and when I'm not
gonna go through the whole step but one
of the other file names I saw was the
name of a tool it ended up with that zip
a zip and a PHP as you know but in the
file name it said arpan and so what's
arpan and arpan is a chinese website and
I don't read Chinese so thank you google
for translating it for me and you see
this Wi-Fi Universal key what could go
wrong so I go click on it and I come to
the app information page QR code you can
just scan it and download it there was
below there a button for download so I
use the button and what could possibly
go wrong so it's interesting that you
can chain events together through the
forensic information virustotal provides
and find out where it ends up at
virustotal is not real time protection
and they stress that the quoted part is
virus told themselves they don't replace
other security products are fantastic
but that's not what they try to do and
so because these presentations are
supposed to be vendor-neutral i'm going
to show a couple other scanning services
jadi actually is the one that's closest
to
virustotal they have fewer scanners but
some people hate virus I hate Google so
they're not going to do that and Giada
is an alternative for me what I really
liked about Johnny when I was
researching this virustotal is rolling
out a new interface it's pretty cool but
it's not throughout the world and I
started with the old interface and I had
to go to different countries for my VPN
in order to get you know the same types
of output and the problem was that I
point my VPN at Spain and everything's
coming back in Spanish now with jadi you
can actually choose what language you
want to see no matter what pop you're
coming out of payloads secure it is
another one they have a hybrid scanner
they call it a strong on heuristics in
virustotal there's a little place where
it has comments and typically these
comments are useless but payloads are
typically really good they provide some
information heuristic information and
it's pretty rich it's like this document
you know risk assessment remote access
fingerprinting the Machine it's you know
it detects stealthiness there's a
variety system security a variety of
heuristic indicators which you combine
those with what virustotal just told you
and now you're getting some forensic
information and I like that they give
most recently submitted because it's
kind of fun to see what's been submitted
most recently what might be attacking me
very soon there's NSS Labs NSS no longer
has the free version of cause which is
too bad it was fun but NSS isn't about
virus scanning they're not about malware
scanning they're really about providing
a threat information and do you have a
threat feed but also down below this is
more global this the bypassing security
products is talking about a specific
profile what products that I choose in
my environment that I want tested so
this was the interface and they don't
scan all file types there they're very
exploit
centric and so you have a limited set
and they're looking for exploits in the
documents etc and so here I have Windows
Defender Barracuda and far Dannette and
you can see these detection czar blocks
they're actually blocks or exploits are
all over the place but at school I can
also choose applications in my
environment Kataria labs own their their
focus actually is on helping protect
website owners and they help get people
off blacklist too which is really
important it's a difficult thing to do
so their product one of their products
is threat sign and this explains
basically any website built manage
hosted on any platform that's what
they're trying to perfect protect it's
just happens that they also have a URL
scanner and they provide information
about like what how many files are being
downloaded at the time they also like
this site has been blacklisted if I'm a
customer I want to know is my site been
blacklisted
you know what was being downloaded clean
files malicious files suspicious files
so that's another resource for you and
of course Ops SWAT met a defender and as
I showed earlier there was a time when
virustotal hadn't seen a file ops what
did and so I got that information and
you're gonna find the reverse of it too
but I mean the standing is just part of
overall service and they have some
really cool free tools that you can use
also and of course you know they've got
a big portfolio so yeah you might call
them competition but they're really not
that's just integration with an existing
infrastructure so you know I want to
conclude with a few bullets virustotal
provides some great information that a
lot of people don't understand is
available they provide threat
intelligence as do other companies I
don't think most companies IT
professionals are going to use only one
threat feed I don't really consider them
competition for companies providing
thread feeds as much as
complementing a lot of contextual
information if you haven't gone to tabs
other than scan oh man go through it
there's really cool stuff you'll get
links to hashes where it'll tell you
more things if I had more time I would
show you this huge chain of events where
a file was clean it's just it showed up
with 30 other malicious files and I
really value virus totaling I'm happy
and grateful that Julio was willing to
review the content for this presentation
and make sure I didn't give you bad
information that you would hammer me on
so if you have any questions Julio's
here