2017 Day 1 Frank Walsh: Launch, Detect, Evolve

### Overview In this presentation at AusCERT 2017, Frank Walsh, Vice President of Solution Architecture at Malwarebytes, examines the evolving threat landscape, the commodification of cybercrime, and modern defense methodologies. Moving away from early hacktivism, today's malware ecosystem is driven by organized criminal enterprises motivated by profit. Walsh draws heavily upon data gathered from Malwarebytes’ consumer telemetry—encompassing roughly 100 million Windows and Android devices across 200 countries—to illustrate the rapid rate of malware variant creation and highlight specific regional trends, including high rates of banking Trojans and ransomware observed in Australia.

### Key Topics - **Malware Growth and Monetization**: Malicious actors create multi-purpose threats targeting consumers and enterprises, including ransomware, banking Trojans, ad fraud, botnets, Android malware, and cryptocurrency miners. Malwarebytes tracks around 2,100 new families and variants per week (roughly 104,000 annually). - **Lowered Barrier to Entry**: Cybercriminals leverage underground marketplaces providing modular malware builders, ransomware-as-a-service (RaaS), and channel-partner/revenue-share models (e.g., 70/30 splits), reducing the technical expertise needed to launch attacks. - **Evasion and Obfuscation**: Attackers employ crypters, packers, polymorphic modifications, and metamorphic logic restructuring (including junk code and random input) to bypass static signatures and post-execution sandboxes. - **Advanced Delivery and Fileless Attacks**: The abuse of living-off-the-land techniques, exploits in common office and media software, operating system vulnerabilities, and fileless persistence mechanisms in the registry. - **Defense-in-Depth Architecture**: The necessity of combining intelligence-based layers, exploit mitigation, application hardening, machine learning, and post-execution behavioral monitoring, accompanied by robust remediation.

### Technical Details - **Detection Evasion Categories**: Walsh breaks down evasive techniques into polymorphic (altering binary appearance before execution), metamorphic (altering internal logic or behavior), and genetic malware (encrypting payloads using unique host fingerprints so that samples cannot be reverse-engineered or detonated in foreign sandbox environments). - **Command and Control (C2) Resilience**: Attackers leverage Domain Generation Algorithms (DGAs) combined with dynamic cloud infrastructure (e.g., AWS) to invalidate static IP/domain blacklists. Some threats leverage services such as Google Drive or Google Docs to coordinate reactivation. - **Exploitation and Fileless Malware**: The presentation references the recent WannaCry outbreak leveraging the EternalBlue exploit, noting doublepulsar backdoors and Shadow Brokers' planned monthly exploit releases. It highlights Kovter (500,000 infections detected the previous year), which evolved from ad fraud to disabling security tools and deploying ransomware via registry storage. - **Living off the Land (SCF Files)**: Walsh highlights an attack vector utilizing Shell Scrap / SCF files. In Google Chrome, an SCF file could be downloaded without end-user interaction. When the destination folder is viewed in Windows, the operating system attempts to resolve an SMB icon path specified in the SCF file, leaking the logged-in user’s NTLMv2 hash across SMB to a remote IP. - **Target Fingerprinting**: Pre-attack profiling via embedded JavaScript or GIF headers probes victim browsers, referrers, operating systems, and installed security software, allowing adversaries to silently abandon execution if defensive or analysis tools are detected.

### Takeaways - Relying solely on single-layer solutions—such as standalone traditional antivirus or isolated machine learning/AI—is insufficient against sophisticated, mutating adversaries. - Effective endpoint security requires a multi-layered defense model: pre-execution controls (web protection, application hardening, exploit mitigation, application behavior, heuristics, machine learning) paired with post-execution behavioral monitoring (e.g., tracking Volume Shadow Copy/VSS deletion, rapid encryption, restore point tampering) and dedicated remediation capabilities. - Organizations must maintain strong security hygiene and patching while preparing for worms with fewer operational flaws, emerging IoT vulnerabilities, and persistent zero-day exploitation.