Malware Whack-a-Mole: Time to change the game and speed up malware response

No ratings

Presented at AusCERT 2014 by

Jay Tecksingani

Time to change the game and speed up malware response You receive an email with a PDF attachment. Nothing odd about that, except this is a .exe file that only looks like a PDF, complete with realistic icon. You unwittingly click the downloader, which opens a port, pulls down the payload and the rest is history. As are you. What did the malware do? Who is infected? What systems need to be cleaned first? Questions that it takes too many teams too long to answer. Jay believes actions speak louder than words – even when those words are written in assembly language. As such he’ll spend less time talking from slides and more time actually pulling apart this painful piece of malware live on stage, while recounting his war stories from 10 years of reverse engineering, and demonstrating how defeating malware doesn’t have to take all day. The war stories include tips and tricks gleaned from managing the false alerts caused by a Java zero day outbreak as well as targeted emails, carrying seasonal malware in the form of zip and CAB files. Modern malware is multi-faceted, yet security systems traditionally only aim to solve one part of the puzzle. What’s worse, these disparate systems don’t speak to each other. The battle against malware is lost because the weakest link is a lack of interoperability, with different defence systems speaking different languages. Every system claims to be the ultimate solution, but in reality there is no silver bullet and too many security teams are left playing Whack-a-Mole with malware. Join Jay to learn how he plays the game.