4 ms·

Get cheap baremetal cloud server. Pay hourly. Avoid all risks.(at expense of cloud server provider :)

toomuchtodo 9y ago
I wonder if there's a need for a malware tear down service; submit a JSON request with the binary defined as part of the request, a spot instance spins up, allows the malware to run, and then all of the MITM network traffic and the instance memory snapshot is dropped into S3 for forensic exploration and collaboration. Forensic malware analysis as a service.
- Kalium 9y ago
  That's a very interesting idea! Certainly it's an interesting take on the sandbox, and might allow for access to analysis tools even for those without the required tools or skillset. Malware is a threat to us all, and anything offering to democratize analysis is well worth considering. With that said, I can perhaps see a couple of potential sources of additional complexity. First, a spot instance can't really offer the required level of sandboxing. A typical analysis scenario exploits the privileged position a VM host has over the guest to further analysis and safety. Attempting to do so from a peer position is more difficult and may put you in a more limited position to observe all potential behavior as you lose the ability to easily fake DNS, alter the clock, and more. Second, it's possible that cloud hosting service providers might run services designed to look for and shut down malware-infected hosts. It would certainly be in their general interest and probably in the general interest of most of their customers. In such a scenario, it's very possible that a service like that you describe might find all analysis attempts shut down instantly rather that be able to even attempt to gather useful behavioral evidence. Your idea is great! It's well worth exploring and holds amazing potential. It may perhaps be best done with the above caveats in mind.
  - toomuchtodo 9y ago
    Thank you! I'll explore the use of ephemeral VPCs for this tonight; that should allow for the level of network isolation (and possibly traffic routing through another VPC with network traffic inspection tooling) necessary.
    - Kalium 9y ago
      I fear you misinterpret me. You may want to consider doing this in a strictly local manner with Docker hosts first. Playing with malware in public is not something to be done lightly, and potentially very dangerous (to others as well as you!) in situations where your control is any less than nigh-total. I beg of you, please do not in any way, shape, form, or manner interpret my above comment as encouragement to place the systems of others at risk.
      - toomuchtodo 9y ago
        [removed] Noted.
        Kalium 9y ago
        What you have described leads me to think that you want to execute malware in a live cloud environment where you do not have a host/guest advantage and trust to man-in-the-middle attacks on live traffic. I was channeling Dale Carnegie so as to not completely discourage someone. I can see that this was the wrong approach. Have you tried Cuckoo Sandbox?
    - sillysaurus3 9y ago
      I'd like to work on this. Do you want to collaborate? I think running it on e.g. DigitalOcean is fine. In particular, "Playing with malware in public is not something to be done lightly, and potentially very dangerous (to others as well as you!)" is rather overblown. Doing it locally via Docker, on the other hand, is asking for trouble. Docker isn't a security mechanism. We could offer a service where we can spin up a honeypot image (e.g. a fairly typical Windows installation + a few installed apps and some browsing history). The deal is, you can submit your malware to us, we'll spin up the image, run the malware, and provide real-time feedback about what it's doing. One strategy for pricing would be $hosting_fee*markup per hour. Honestly it's one of the better ideas that's been tossed around, so if you're considering this as potentially more than a side project, hit me up.
      - 9y ago
- j_s 9y ago
  Among others: https://malwr.com/ https://malwr.com/ - Free analysis with an online Cuckoo Sandbox instance source: https://github.com/rshipp/awesome-malware-analysis#online-scanners-and-sandboxes https://github.com/rshipp/awesome-malware-analysis#online-sc...
- BrainInAJar 9y ago
  That's basically what ThreatGRID did
wila 9y ago
..and pretty sure you would violate the contract you agreed with when signing up for the virtual server.

I wonder if there's a need for a malware tear down service; submit a JSON request with the binary defined as part of the request, a spot instance spins up, allows the malware to run, and then all of the MITM network traffic and the instance memory snapshot is dropped into S3 for forensic exploration and collaboration. Forensic malware analysis as a service.

Kalium 9y ago
That's a very interesting idea! Certainly it's an interesting take on the sandbox, and might allow for access to analysis tools even for those without the required tools or skillset. Malware is a threat to us all, and anything offering to democratize analysis is well worth considering. With that said, I can perhaps see a couple of potential sources of additional complexity. First, a spot instance can't really offer the required level of sandboxing. A typical analysis scenario exploits the privileged position a VM host has over the guest to further analysis and safety. Attempting to do so from a peer position is more difficult and may put you in a more limited position to observe all potential behavior as you lose the ability to easily fake DNS, alter the clock, and more. Second, it's possible that cloud hosting service providers might run services designed to look for and shut down malware-infected hosts. It would certainly be in their general interest and probably in the general interest of most of their customers. In such a scenario, it's very possible that a service like that you describe might find all analysis attempts shut down instantly rather that be able to even attempt to gather useful behavioral evidence. Your idea is great! It's well worth exploring and holds amazing potential. It may perhaps be best done with the above caveats in mind.
- toomuchtodo 9y ago
  Thank you! I'll explore the use of ephemeral VPCs for this tonight; that should allow for the level of network isolation (and possibly traffic routing through another VPC with network traffic inspection tooling) necessary.
  - Kalium 9y ago
    I fear you misinterpret me. You may want to consider doing this in a strictly local manner with Docker hosts first. Playing with malware in public is not something to be done lightly, and potentially very dangerous (to others as well as you!) in situations where your control is any less than nigh-total. I beg of you, please do not in any way, shape, form, or manner interpret my above comment as encouragement to place the systems of others at risk.
    - toomuchtodo 9y ago
      [removed] Noted.
      - Kalium 9y ago
        What you have described leads me to think that you want to execute malware in a live cloud environment where you do not have a host/guest advantage and trust to man-in-the-middle attacks on live traffic. I was channeling Dale Carnegie so as to not completely discourage someone. I can see that this was the wrong approach. Have you tried Cuckoo Sandbox?
  - sillysaurus3 9y ago
    I'd like to work on this. Do you want to collaborate? I think running it on e.g. DigitalOcean is fine. In particular, "Playing with malware in public is not something to be done lightly, and potentially very dangerous (to others as well as you!)" is rather overblown. Doing it locally via Docker, on the other hand, is asking for trouble. Docker isn't a security mechanism. We could offer a service where we can spin up a honeypot image (e.g. a fairly typical Windows installation + a few installed apps and some browsing history). The deal is, you can submit your malware to us, we'll spin up the image, run the malware, and provide real-time feedback about what it's doing. One strategy for pricing would be $hosting_fee*markup per hour. Honestly it's one of the better ideas that's been tossed around, so if you're considering this as potentially more than a side project, hit me up.
    - 9y ago
j_s 9y ago
Among others: https://malwr.com/ https://malwr.com/ - Free analysis with an online Cuckoo Sandbox instance source: https://github.com/rshipp/awesome-malware-analysis#online-scanners-and-sandboxes https://github.com/rshipp/awesome-malware-analysis#online-sc...
BrainInAJar 9y ago
That's basically what ThreatGRID did

wila 9y ago

..and pretty sure you would violate the contract you agreed with when signing up for the virtual server.