Narrator: Eradication actions. 2 2
In this lesson, we're going to talk about the three main types 3 3
of eradication actions. 4 4
We've already talked about 5 5
how we're going to sanitize our media, 6 6
but now we're going to focus on reconstruction, 7 7
reimaging and reconstitution. 8 8
When I talk about reconstruction, this is a method 9 9
of restoring a system that has been sanitized 10 10
using scripted installation routines and templates. 11 11
Essentially, I would have some kind of computer 12 12
and we've gone through some sort of an incident. 13 13
We have now sanitized that hard drive, 14 14
and now, we want to restore that system 15 15
back to the way it was. 16 16
To do that, we would run a simple script 17 17
that would copy all the files and bring it back 18 18
to a known good state based on those scripts that we have. 19 19
Now, another way we can do this is what's known 20 20
as reimaging. 21 21
When we deal with reimaging, this is a method 22 22
of restoring a system that has been sanitized completely, 23 23
and this way, we use an image-based backup. 24 24
So, with reconstruction, we're using scripts 25 25
to copy over files or replace files 26 26
that may have been modified, 27 27
but with reimaging, we are doing a bit by bit copy 28 28
of a hard drive based on an image that we have 29 29
that is a known good image 30 30
and bringing it back to that state. 31 31
Now, when we deal with reconstitution, this is a method 32 32
of restoring a system that cannot be sanitized 33 33
using manual removal, reinstallation 34 34
or monitoring processes. 35 35
Now, reconstitution is a lot harder to do 36 36
than reconstruction or reimaging. 37 37
With reconstruction or reimaging, 38 38
we can actually copy over entire files 39 39
or the entire file system in the case of reimaging. 40 40
But with reconstitution, 41 41
we are trying to essentially do surgery with a scalpel here. 42 42
We're trying to pull out exact little bits of code, 43 43
whether it's a single file 44 44
or a single configuration setting, 45 45
and be able to bring ourself back to that known good state. 46 46
Now, to do this, we have seven steps for reconstitution. 47 47
The first step is to analyze processes and network activity 48 48
for signs of malware. 49 49
Essentially, we need to monitor that system 50 50
and find out exactly where all the malware is 51 51
and what it's doing. 52 52
We're going to use things like Wireshark and Sysinternals 53 53
and Process Explorer and things like that 54 54
to identify all the bad things that are existing 55 55
on that system. 56 56
Then, we move into step two, which is terminating 57 57
those suspicious processes and securely deleting them 58 58
from the system. 59 59
This way, we can make sure we get all of those bad processes 60 60
off the system, and hopefully, they won't return. 61 61
Now, if we have data files that are infected, 62 62
we also need to recover information from those files 63 63
before we quarantine or delete them 64 64
because we don't want to lose that information. 65 65
Remember, our goal with reconstitution is getting our system 66 66
back to the known good state, and so, 67 67
we want to make sure we have that data, as well. 68 68
Our third step is to identify and disable 69 69
autostart locations to prevent processes from executing. 70 70
Now, if you remember, 71 71
we've talked about autostart locations before. 72 72
This is places that are inside the file system, 73 73
the registry, and the task scheduler that could then 74 74
bring back malware to maintain persistence. 75 75
So, we want to identify any of those locations 76 76
that may have some kind of process 77 77
that will launch that malware again. 78 78
Our fourth step is to replace contaminated processes 79 79
with clean versions from trusted media. 80 80
Again, if I'm going to go and install 81 81
some new piece of software, 82 82
I want to make sure it's coming from a known good source 83 83
because if I just download it off the internet, 84 84
I might bring additional malware into my system, 85 85
and so I need to make sure 86 86
that I have a known good trusted media source. 87 87
Most companies have what they call 88 88
a definitive media library or DML, 89 89
and this is an area where you store all of your 90 90
CDs and DVDs and hard drives 91 91
with known, trusted, good copies of your software 92 92
for you to use during reconstitution. 93 93
Our fifth step is to reboot the system 94 94
and analyze it for signs of continued malware infection. 95 95
So, we think we've gotten everything out now. 96 96
We're going to go ahead and reboot the system, 97 97
and if we miss something, 98 98
we would then have malware being reintroduced 99 99
into the system. 100 100
If we got it all, that means we're in a good state 101 101
and that means we did our job. 102 102
Then we're going to go into our sixth step. 103 103
If we see a continued malware infection, 104 104
meaning we missed something, we now have to look harder 105 105
and find out how is it staying on that system. 106 106
We're going to have to analyze the firmware 107 107
and any USB devices that are there 108 108
because they may be the source of the infection 109 109
since we already removed the software 110 110
and the processes in our earlier steps. 111 111
Now, under step seven, if all the tests were negative, 112 112
that means we don't have any malware on the system anymore. 113 113
Everything is back to normal. 114 114
So now, we can reintroduce that system back into 115 115
the production environment, 116 116
and that means we have solved this problem 117 117
and we have reconstituted that resource 118 118
and it's ready to go back to doing its job again.