This talks covers different ways to analyze malware for business purposes and discusses advantages and disadvantages of the approaches. The most common online sandboxes are introduced and compared to sandbox systems that are built indiviudally. Also the basic requirements and the mandatory tool set are defined for building your own sandbox system. The tool set consists of analyzers, unpackers, debuggers and disassemblers and the talk will also mention the steps that are needed for proper analysis of the malware. Finally the countermeasures of the attackers to defeat the analysis process are presented and also some ways to mitigate them.
Michael Thumann is Chief Security Officer and head of the ERNW application security team. He has published security advisories regarding topics like ‘Cracking IKE Preshared Keys’ and Buffer Overflows in Web Servers/VPN Software/VoIP Software. Michael enjoys sharing his self-written security tools (e.g. ‘tomas – a Cisco Password Cracker’, ‘ikeprobe – IKE PSK Vulnerability Scanner’ or ‘dnsdigger – a dns information gathering tool’) and his experience with the community. Besides numerous articles and papers he wrote the first (and only) German Pen-Test Book that has become a recommended reading at german universities.
In addition to his daily pentesting tasks he is a regular conference-speaker (e.g. Blackhat, HITB and RSA Conference) and has also contributed exploit code to the Metasploit Framework. With more than 10 years of experience in computer security Michaels’ main interest is to uncover vulnerabilities and security design flaws from the network to the application level and reverse almost everything to understand the inner working.