Story image

Interview: Diving Into the malware abyss with LogRhythm's Erika Noerenberg

23 Apr 2018

Reverse engineering malware is a job that’s never the same from one day to the next – much like the evolution of malware itself. Even when it’s malware from a variant that already exists, chances are they aren’t identical.

That’s what LogRhythm Threat Research Group’s senior malware analyst and reverse engineer Erika Noerenberg loves about her job, but there much more to it.

SecurityBrief talked with Erika about common themes surrounding vulnerability exploitation, malware, and the Internet of Things (IoT).

Broadly speaking, what do you see as the top challenges in the threat landscape at the moment?

Threat actors are constantly changing and evolving their exploitation and delivery techniques which presents a challenge. However, many older and often-used techniques continue to succeed due to lack of user education, difficulty patching critical systems, and poor security infrastructure (and lack of resources to improve security posture). These challenges are more critical to address than playing "whack-a-mole" with each exploit or threat as they come along. 

There’s a widely believed mantra that most new vulnerabilities and exploits are actually old ones that have found new use cases. From what you have seen, is this accurate and how many vulnerabilities are truly ‘new’?

Although many exploits and vulnerabilities follow the same methodologies (buffer overflows, race conditions, unsanitised inputs, etc.), recently the Meltdown and Spectre flaws affecting most CPU hardware utilised a technique that hadn't been publicly released before.

This side-channel attack took advantage of a processing optimisation called "speculative execution" in order to access memory regions that should not be accessible from an unprivileged process. 

How are both the ‘new’ and re-worked vulnerabilities being used to build destructive malware?

For Meltdown and Spectre, proof-of-concept code has been seen in the wild, but no fully functional malware is known at this time.

Other vulnerabilities continue to be re-used by attackers to perform an initial exploit of a system, but they repackage these exploits using different delivery methods, persistence mechanisms, and command and control (C2) functionality.

The topic of botnets, spying, and cyber attacks affecting IoT devices is becoming more important, particularly as enterprises start to make full use of IoT capabilities.

Are there any particular threats you can think of that really drive home the nature of IoT vulnerabilities?

IoT vulnerabilities are particularly insidious because many users do not realise the dangers of introducing these devices to their networks. When it comes to critical infrastructure environments especially, any IoT or BYOD devices should be carefully evaluated and segregated from production environments.

The increasing use of network connectivity (WiFi, Bluetooth, etc.) in medical devices is also concerning. Attacks against pacemakers, insulin pumps, and other patient devices can have fatal consequences. Furthermore, many medical devices used in hospitals run older operating systems that are still vulnerable to older exploits.

These devices often cannot be easily patched (if at all), have network functionality, and are on the same network as other hospital equipment. This creates an easy entry point for attackers who can use these devices to spread ransomware, exfiltrate patient data, or tamper with other medical devices on the network. 

For a while the argument was that manufacturers and product designers need to take more responsibility for the security of the devices they create. Are those manufacturers now sitting up and taking notice?

While vulnerabilities and exploits of IoT are gaining more publicity, many manufacturers don't have much incentive to change their processes if there are no real consequences for exploitation of their devices. Until consumers start valuing security over the cost of these devices, insecure/vulnerable devices will continue to be produced.

Do you have any advice for enterprises that are thinking of deploying IoT and what security controls they should consider?

IoT devices should be carefully evaluated before being introduced into any environment and heavily segregated from any critical infrastructure.

Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.