Story image

Interview: Diving Into the malware abyss with LogRhythm's Erika Noerenberg

23 Apr 2018

Reverse engineering malware is a job that’s never the same from one day to the next – much like the evolution of malware itself. Even when it’s malware from a variant that already exists, chances are they aren’t identical.

That’s what LogRhythm Threat Research Group’s senior malware analyst and reverse engineer Erika Noerenberg loves about her job, but there much more to it.

SecurityBrief talked with Erika about common themes surrounding vulnerability exploitation, malware, and the Internet of Things (IoT).

Broadly speaking, what do you see as the top challenges in the threat landscape at the moment?

Threat actors are constantly changing and evolving their exploitation and delivery techniques which presents a challenge. However, many older and often-used techniques continue to succeed due to lack of user education, difficulty patching critical systems, and poor security infrastructure (and lack of resources to improve security posture). These challenges are more critical to address than playing "whack-a-mole" with each exploit or threat as they come along. 

There’s a widely believed mantra that most new vulnerabilities and exploits are actually old ones that have found new use cases. From what you have seen, is this accurate and how many vulnerabilities are truly ‘new’?

Although many exploits and vulnerabilities follow the same methodologies (buffer overflows, race conditions, unsanitised inputs, etc.), recently the Meltdown and Spectre flaws affecting most CPU hardware utilised a technique that hadn't been publicly released before.

This side-channel attack took advantage of a processing optimisation called "speculative execution" in order to access memory regions that should not be accessible from an unprivileged process. 

How are both the ‘new’ and re-worked vulnerabilities being used to build destructive malware?

For Meltdown and Spectre, proof-of-concept code has been seen in the wild, but no fully functional malware is known at this time.

Other vulnerabilities continue to be re-used by attackers to perform an initial exploit of a system, but they repackage these exploits using different delivery methods, persistence mechanisms, and command and control (C2) functionality.

The topic of botnets, spying, and cyber attacks affecting IoT devices is becoming more important, particularly as enterprises start to make full use of IoT capabilities.

Are there any particular threats you can think of that really drive home the nature of IoT vulnerabilities?

IoT vulnerabilities are particularly insidious because many users do not realise the dangers of introducing these devices to their networks. When it comes to critical infrastructure environments especially, any IoT or BYOD devices should be carefully evaluated and segregated from production environments.

The increasing use of network connectivity (WiFi, Bluetooth, etc.) in medical devices is also concerning. Attacks against pacemakers, insulin pumps, and other patient devices can have fatal consequences. Furthermore, many medical devices used in hospitals run older operating systems that are still vulnerable to older exploits.

These devices often cannot be easily patched (if at all), have network functionality, and are on the same network as other hospital equipment. This creates an easy entry point for attackers who can use these devices to spread ransomware, exfiltrate patient data, or tamper with other medical devices on the network. 

For a while the argument was that manufacturers and product designers need to take more responsibility for the security of the devices they create. Are those manufacturers now sitting up and taking notice?

While vulnerabilities and exploits of IoT are gaining more publicity, many manufacturers don't have much incentive to change their processes if there are no real consequences for exploitation of their devices. Until consumers start valuing security over the cost of these devices, insecure/vulnerable devices will continue to be produced.

Do you have any advice for enterprises that are thinking of deploying IoT and what security controls they should consider?

IoT devices should be carefully evaluated before being introduced into any environment and heavily segregated from any critical infrastructure.

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.