length: 00:24:49

1^st episode audioparasitic mcafee podcast..

Take a close look of the issue and trend- what driving the industry…  beat that issue into submission with 2 very opinionated hosts.

If you look for malware /news wrong podcast.. but if you look highly caffeinated commentary – welcome to  AudioParasitic

Nordea Bank phishing –largest most successful malware threat

The developers behind it is very very capable and aware with signature based AV

It was a specific trojan bought for this specific target – that managed to say active for a window period of time..

But on the other stuff – it is not different from what we have seen for many many years.

Don’t trust email from someone you don’t know..

Password stealer – 1.1 million dollar.. pretty big amount of money lost in a very short time..

I don’t know if we are going to see more and more  password stealer…

But I do know the complexity to avoid AV will increase.

Nordia attack is  almost like chest game – the figure 4-5-6 steps ahead…

This is fascinating as tread but not as malware…

The information gather from multiple victim was taken from multiple servers and countries..

One of the only thing nordia could have done is to inform customer that they are not going to use internet for password..etc..

People has to treat internet as really bad neighborhood…

Discussion on information disclosure

How much information do we share with customer – or other vendor… if you put 2 security researchers in the room askthis question – they will start to fight… this is a very volatile discussion

Joined by:

Joe Telafici – Fich since mid 90 with Symantec.. running AV

Kevin Beets – foundstone  -  starting with Admin with pix & CP – move to foundstone.. acquired by

2 different position..

Joe Telafici  more close information minded – because of historical and recent reasons..

Kevin Beets I am full disclosure side following the responsible disclosure!! I don’t think hiding the information is the way to go ..

What level? Is there a minimum level that we can share?

In AV industry – we only share only to people who know personally – people that we trust  - people that we are confident if we give them a sample they are not going to share with anybody else… and NOT get infect other people in any shape or form…this is not a company effort but people effort…

All cooperation of AV – occurs at personal level – AV company on researcher in McAfee trust someone at Symantec or kaspersky – trust them that they can hand a loaded gun and not pointing back…

That being said.. there has been a lot of changing.. there are many groups starting to share information…

Kevin we should share them all…

On the malware side – not a lot of that is shared – many is closely shared

In the vulnerability side – it it public and it is outhere..

There is difference between disclosing vulnerability and posting malware exploit… there is different level of damage that can be done…

Analogy: describing how to build bomb is one way

Giving someone else a bomb is a different way…

It depends!!!

Also depend if the malware is replicating or not – a single accident or many people

All these rules were put in place because end of 80s early 90s researchers are sending sample wildly.. accidentally in good faith.. running sample in the lab, not realizing the FW is open and infecting other people..

Fitch – I never touch a single piece of malware since becoming VP in McAfee because I am not uptodate any more..

And accident happen- I watched people with 10-15 years of experience accidentally doubleclick a piece of malware..  launch a piece of malware.. if you don’t both  technological and physical policies to handle this – because bad things is going to happen eventually

We don’t have to only know how to handle properly BUT also how to remediate problem..

Kevin and Fich both agree on how disclosure

PoC disclosure – you need a little skill set to cause damage..

It is interesting when you have 2 people who think they are on different position but actually there are in a pretty close position ..

Does the information we share gives people ideas???
Kevin : I don’t think so! If you are interested in security..

Fich: thinks it depends who the people we give information..

Dave: Fitch you are not allowed to use “it depends” anymore!! J

If this simple – I would not have a job..

I have watched this happen… I was standing next to Greg Hoglund when he started to write first anti rootkit

We do a lot of things with AV behavior.. but we don’t ever discussed about it…  because we don’t want people to know what we are doing..

Certainly we anybody can pickup a good debugger to reverse engineer it.

We can make it hard –very hard – but we cannot make it impossible to reverse engineer!!

I watched techniques that are  fairly simple – trivially simple but it took 4-5 years for the malware community to figure out work around –because they don’t know why are doing it…

But one a smart guy found it…discuss it in the discussion forum.. today that feature is useless..

If we talked about it –it would have not lasted a year.. it would have not provided any benefit!!

We have detected 100k malwares.. without lifting a finger!!

If you look at my doom – the first mydoom was written by someone that we never caught- but then he released the source code… and weeks later many variants came to live..

We caught a kid who wrote the variant.

This kid would never wrote anything on that scale on his own!!!!

We still get mydoom variant floating around – as the result of that source code being released..

Yes –once the genie is out the bottle we cant put it back. But we can make is difficult for ourselves or we can make it really difficult for ourselves!!!!

The foundstone is available for people…