Creating a new piece of malware is easy: Find something that suits your needs, then tweak the code to bypass firewalls and trick anti-virus software. Hackers are doing this everywhere but by analyzing the provenance of code \u2014\u00a0a broader look at style rather than just substance \u2014\u00a0defenders are disrupting the reuse cycle and making the adversary’s life harder.<\/p>\n\n\n\n
Thomas Ruoff, director of technology innovation and mission integration for the Department of Homeland Security, likened provenance to a professor trying to determine whether a student actually wrote a paper or whether it was <\/span>plagiarized it.<\/p>\n\n\n\n By breaking down the code and comparing certain attributes to other forms of known malware that have been seen before<\/span>, defenders can identify see\u00a0<\/span>patterns that tell them the signs to watch for<\/span>. From there, through statistical analysis, they can assign a trust score to the traffic coming from certain sources or bearing certain signatures of malicious intent.<\/p>\n\n\n\n While this tactic isn’t perfect \u2014\u00a0true zero-days pop up all the time \u2014\u00a0it is a fast and efficient tool DHS and others are using to identify and block a large swath of attacks, Ruoff said during a panel discussion at the 2016 RSA Conference in San Francisco.<\/p>\n\n\n\n “It enables us to rapidly make a probability [determination] of authorship, probability of intent,” he said. Furthermore, “it also allows us to think about the reuse of code and how the actors readily reuse malware, change it a little bit \u2014\u00a0therefore change the hash \u2014\u00a0that approach is somewhat nullified if you have to change a tremendous amount of the object to make it not attributable \u2026 It means the economics and the sweat equity of the bad guy are changing.”<\/p>\n\n\n\n DHS is working with the FBI, Justice Department, National Security Agency and others to pull in and analyze more code to build better provenance profiles. But, as the private-sector work in this area continues to grow, the government is also looking to industry to provide additional data.<\/p>\n\n\n\n Some of that will come through information sharing \u2014\u00a0the framework of which is just being established \u2014\u00a0while other data will be purchased directly from companies trading in threat intelligence, according to Phyllis Schneck, deputy undersecretary for cybersecurity and communications within the DHS National Protection and Programs Directorate (NPPD)<\/span>.<\/p>\n\n\n\n Using multiple sources of information enables analysts to build a more comprehensive trust score, adding in indicators and knowledge from all angles.<\/p>\n\n\n\n Even then, the system is far from perfect. But it is effective at identifying software at the far ends of the spectrum, Schneck said.<\/p>\n\n\n\n “Probabilities on this tend to be very reliable on the good end and on the really bad end and that’s what we’re most concerned with. The middle is a science project that we’re looking at,” she explained. “But it’s the ability to clear some of the ridiculous noise out of the Internet; to make it less easy for the adversary so that we can start to hunt and find the really sophisticated stuff.”<\/p>\n\n\n\n Schneck compared it to a bank robber making a slight costume change and then attempting to rob the same bank. He might not be the smartest robber out there, but he needs to be stopped and this is one way to do it.<\/p>\n\n\n\n “To truly cause pain to this adversary we have to cut the business model and make sure they stop reusing and just tweaking software and they get right back at us and get in,” she said. Creating a robust provenance and attribution system gives agencies “the ability to absolutely destroy the model where the adversary simple takes a piece of software and sends it back out again.”<\/p>\n","protected":false},"excerpt":{"rendered":" Top Homeland Security cybersecurity officials explain how understanding where malware comes from can disrupt the attack cycle.<\/p>\n","protected":false},"author":7,"featured_media":54312,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":15,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[15,94,21,28],"tags":[],"coauthors":[2349],"class_list":["post-18608","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-management","category-rsa","category-show-reporters","category-smr"],"acf":{"subheadline":"","legacy_arc_id":"GYGVW53UV5ATRBOQ2RMZ6FEPTI","arc_canonical_url":"\/management\/2016\/03\/03\/how-big-data-info-sharing-make-hackers-lives-harder\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n