Introduction
Malware Analysis
CSCI 4976 - Fall 2015
Branden Clark
Malware - 09/01/2015 Introduction 1
Lecture Overview
1. Syllabus
2. Course Overview
3. Basic Analysis
Malware - 09/01/2015 Introduction 2
Course Details
• Malware Analysis
– Course Number: CSCI 4976
– Credit Hours: 4
– Semester / Year: Fall 2015
– Meeting Days: Tuesday/Friday 12-2PM
– Room Location: Sage 2112
– Course Website: TODO
• [Link]
• [Link]
– Prereqs:
• CSCI 2500 - Computer Organization
• ECSE 2660 - Computer Architecture, Networks, and
Operating Systems
Malware - 09/01/2015 Introduction 3
Instructor
• Instructor: Dr. Bülent Yener
– Office: Lally 310
– Email: yener@[Link]
Malware - 09/01/2015 Introduction 4
Malware Mentors
Branden Aaron Austin
(Clark) (Aidielse) (Lense)
Malware - 09/01/2015 Introduction 5
• Good to see lots of familiar faces!
• RPISEC meetings are Friday 5-7 PM in DCC 324
• Come learn other topics in computer security
– Web hacking
– Malware analysis
– Reverse Engineering
– Digital Forensics
– So so much more
• Meet people from industry, get internships/jobs
• Read more - [Link]
Malware - 09/01/2015 Introduction 6
Office Hours
• Office hours:
– Wed 7-10 PM @ Sage 5101
• Come hang out at RPISEC hack nights!
– Ask questions, get extra help with the
class
– Collaborate on Projects/Labs
– Work on security projects, challenges,
etc
Malware - 09/01/2015 Introduction 7
Digital Office Hours (IRC)
• The RPISEC IRC - [Link]
– server: [Link]
– port: 6667 (6697 for SSL)
– room: #rpisec
• Way faster than emailing back and forth
• Some of us are usually on at ridiculous
hours
– basically a 24/7 channel
Malware - 09/01/2015 Introduction 8
Options of Last Resort
• Email us
– malware_ta@[Link]
• temporarily down
– malware_ta@[Link]
• use this for now
Malware - 09/01/2015 Introduction 9
Required Textbooks
• Practical Malware Analysis by Michael Sikorski and
Andrew Honig
– ISBN 978-1593272906
Malware - 09/01/2015 Introduction 10
Suggested Textbooks
• Practical Reverse Engineering by Dang, Gazet,
Bachaalany
– ISBN 978-1118787311
• Rootkits: Subverting the Windows Kernel by Hoglund,
Butler
– ISBN 978-0321294319
Malware - 09/01/2015 Introduction 11
Grade Breakdown
• Labs - 48%
– 12 labs @ 4% each
– Lab attendance is MANDATORY as the first part is due and
must be checked off in person
• Malware Analysis - 42%
– 3 Projects @ 10% each
– Final Project @ 12%
– Like a big lab, but over a few weeks
• Quizzes - 10%
– 10 quizzes @ 1% each
– Small, quick, easy, from the reading
Malware - 09/01/2015 Introduction 12
Syllabus
• READ THE SYLLABUS
• Well written, full of details
• It’s on the course website
[Link]/malware
Malware - 09/01/2015 Introduction 13
Lecture Overview
1. Syllabus
2. Course Overview
3. Basic Analysis
Malware - 09/01/2015 Introduction 14
A typical (RPISEC) Class
• Designed and orchestrated by RPISEC
(students)
• Other courses
– CSCI 4968 Modern Binary Exploitation
– CSCI 4971 Secure Software Principles
– CSCI 4972 / 6963 Malware Analysis (Spring 2013)
– CSCI 4974 / 6974 Hardware Reverse Engineering
Malware - 09/01/2015 Introduction 15
Course Roadmap
• Practical Malware Analysis textbook
– Basic analysis, debugging, reverse engineering, Malware
behavior, Windows internals
• Windows Kernel + Rootkits
– kernel basics, debugging, behavior, stealth
• Modern malware threats
– APTs (Advanced Persistent threats), nation-state sponsored
Malware - 09/01/2015 Introduction 16
Goals for This Course
• This will be a very applied, hands on course
– No data structures, algorithms, cryptography, or cyber policy
– Every lecture after this you’re expected to bring your laptop!
• We will cover technically challenging material rarely
touched upon in other classes
• As an individual you will leave with all the skills
necessary to identify, extract, and analyze all features
of modern malicious software.
Malware - 09/01/2015 Introduction 17
Course Terminology
• Machine
– A computer, server, sometimes refers to the actual
CPU
• Binary
– An executable such as an .EXE, ELF, MachO or other
code containers that run on a machine
– Other names: program, application, service
(sometimes)
• Malware
– A piece of software that is intended to perform
unwanted activities on a machine
• More as we go along!
Malware - 09/01/2015 Introduction 18
What is malware?
• Some common names…
– Trojan, virus, worm, RAT, rootkit
– A piece of software that is intended to perform
unwanted activities on a machine
• Some examples of malicious behavior...
– Serving ads, stealing data, consuming resources
– Others?
Malware - 09/01/2015 Introduction 19
Why do people write malware?
• Morris Worm
– On accident
• Purpose: “gauge the size of the internet”
• What happened: Fork bomb
Malware - 09/01/2015 Introduction 20
Why do people write malware?
• In the 90s
– For the lulz / glory
– Spread to other machines & display a message
Malware - 09/01/2015 Introduction 21
Why do people write malware?
• Today
– $$$
• Organizations buy malware
– Steal passwords, credit cards, bank info, ransoms,
intellectual property, trade secrets
– They can use this info or sell it
Malware - 09/01/2015 Introduction 22
Why do people write malware?
• Future?
– Cyber warfare, intelligence gathering
• Nation-states
– Stuxnet
• Highly advanced
• Multiple Windows 0-days
• Targeted and physically destroyed Iranian nuclear centrifuges
– CNO (Computer Network Operations)
• CND - Defense
• CNE - Exploitation
• CNA - Attack
Malware - 09/01/2015 Introduction 23
Malware over time
• 1988 - Morris Worm exploits use of gets() in finger daemon
• 1990 - Mark Washburn develops first polymorphic malware
• 2001 - Code Red worm exploits a MS web server vulnerability to
hit hundreds of thousands of computers
• 2004 - Vundo trojan displays popups and advertising
• 2005 - Sony infects CDs with a rootkit to prevent music piracy
• 2008 - Koobface RAT spreads via infected Facebook and Myspace
profiles
• 2008-2010 - Stuxnet employs four Windows 0days to spread
through Iranian nuclear refinery control system networks
• 2013 - Mandiant publishes evidence on APT1, a Chinese cyber
espionage campaign dating as early as 2005
• 2015 - Duqu2 targets McAfee with advanced, modularized, in-
memory only malware
Malware - 09/01/2015 Introduction 24
Why analyze malware?
• Detect and respond to intrusions
– Threat analysis
• Host & Network signatures
• What’s the damage?
– Who/What is infected?
– Threat prevention
– Threat removal
Malware - 09/01/2015 Introduction 25
Additional Material
• Related Readings:
– Practical Malware Analysis
• Introduction
• Chapter 0. Malware Analysis Primer
Malware - 09/01/2015 Introduction 26
Lecture Overview
• Syllabus
• Course Overview
• Basic Analysis
Malware - 09/01/2015 Introduction 27
