1 1 00:00:00,330 --> 00:00:02,310 Eradication actions. 2 2 00:00:02,310 --> 00:00:05,130 In this lesson, we're going to talk about the three main types 3 3 00:00:05,130 --> 00:00:06,900 of eradication actions. 4 4 00:00:06,900 --> 00:00:07,800 We've already talked about 5 5 00:00:07,800 --> 00:00:09,420 how we're going to sanitize our media, 6 6 00:00:09,420 --> 00:00:11,296 but now we're going to focus on reconstruction, 7 7 00:00:11,296 --> 00:00:14,040 reimaging and reconstitution. 8 8 00:00:14,040 --> 00:00:16,560 When I talk about reconstruction, this is a method 9 9 00:00:16,560 --> 00:00:18,870 of restoring a system that has been sanitized 10 10 00:00:18,870 --> 00:00:22,050 using scripted installation routines and templates. 11 11 00:00:22,050 --> 00:00:24,720 Essentially, I would have some kind of computer 12 12 00:00:24,720 --> 00:00:26,640 and we've gone through some sort of an incident. 13 13 00:00:26,640 --> 00:00:28,710 We have now sanitized that hard drive, 14 14 00:00:28,710 --> 00:00:30,660 and now, we want to restore that system 15 15 00:00:30,660 --> 00:00:32,130 back to the way it was. 16 16 00:00:32,130 --> 00:00:33,720 To do that, we would run a simple script 17 17 00:00:33,720 --> 00:00:36,210 that would copy all the files and bring it back 18 18 00:00:36,210 --> 00:00:39,690 to a known good state based on those scripts that we have. 19 19 00:00:39,690 --> 00:00:41,670 Now, another way we can do this is what's known 20 20 00:00:41,670 --> 00:00:42,990 as reimaging. 21 21 00:00:42,990 --> 00:00:44,910 When we deal with reimaging, this is a method 22 22 00:00:44,910 --> 00:00:48,150 of restoring a system that has been sanitized completely, 23 23 00:00:48,150 --> 00:00:50,760 and this way, we use an image-based backup. 24 24 00:00:50,760 --> 00:00:52,697 So, with reconstruction, we're using scripts 25 25 00:00:52,697 --> 00:00:55,440 to copy over files or replace files 26 26 00:00:55,440 --> 00:00:56,790 that may have been modified, 27 27 00:00:56,790 --> 00:00:59,650 but with reimaging, we are doing a bit by bit copy 28 28 00:00:59,650 --> 00:01:02,520 of a hard drive based on an image that we have 29 29 00:01:02,520 --> 00:01:03,840 that is a known good image 30 30 00:01:03,840 --> 00:01:06,060 and bringing it back to that state. 31 31 00:01:06,060 --> 00:01:08,880 Now, when we deal with reconstitution, this is a method 32 32 00:01:08,880 --> 00:01:11,400 of restoring a system that cannot be sanitized 33 33 00:01:11,400 --> 00:01:13,710 using manual removal, reinstallation 34 34 00:01:13,710 --> 00:01:15,630 or monitoring processes. 35 35 00:01:15,630 --> 00:01:18,240 Now, reconstitution is a lot harder to do 36 36 00:01:18,240 --> 00:01:20,430 than reconstruction or reimaging. 37 37 00:01:20,430 --> 00:01:22,170 With reconstruction or reimaging, 38 38 00:01:22,170 --> 00:01:24,300 we can actually copy over entire files 39 39 00:01:24,300 --> 00:01:27,480 or the entire file system in the case of reimaging. 40 40 00:01:27,480 --> 00:01:28,980 But with reconstitution, 41 41 00:01:28,980 --> 00:01:31,950 we are trying to essentially do surgery with a scalpel here. 42 42 00:01:31,950 --> 00:01:34,800 We're trying to pull out exact little bits of code, 43 43 00:01:34,800 --> 00:01:36,090 whether it's a single file 44 44 00:01:36,090 --> 00:01:38,160 or a single configuration setting, 45 45 00:01:38,160 --> 00:01:41,340 and be able to bring ourself back to that known good state. 46 46 00:01:41,340 --> 00:01:44,940 Now, to do this, we have seven steps for reconstitution. 47 47 00:01:44,940 --> 00:01:48,390 The first step is to analyze processes and network activity 48 48 00:01:48,390 --> 00:01:49,890 for signs of malware. 49 49 00:01:49,890 --> 00:01:52,200 Essentially, we need to monitor that system 50 50 00:01:52,200 --> 00:01:54,813 and find out exactly where all the malware is 51 51 00:01:54,813 --> 00:01:56,520 and what it's doing. 52 52 00:01:56,520 --> 00:01:59,063 We're going to use things like Wireshark and Sysinternals 53 53 00:01:59,063 --> 00:02:01,590 and Process Explorer and things like that 54 54 00:02:01,590 --> 00:02:04,320 to identify all the bad things that are existing 55 55 00:02:04,320 --> 00:02:05,820 on that system. 56 56 00:02:05,820 --> 00:02:08,370 Then, we move into step two, which is terminating 57 57 00:02:08,370 --> 00:02:10,943 those suspicious processes and securely deleting them 58 58 00:02:10,943 --> 00:02:12,630 from the system. 59 59 00:02:12,630 --> 00:02:15,780 This way, we can make sure we get all of those bad processes 60 60 00:02:15,780 --> 00:02:19,290 off the system, and hopefully, they won't return. 61 61 00:02:19,290 --> 00:02:21,420 Now, if we have data files that are infected, 62 62 00:02:21,420 --> 00:02:23,566 we also need to recover information from those files 63 63 00:02:23,566 --> 00:02:26,010 before we quarantine or delete them 64 64 00:02:26,010 --> 00:02:27,900 because we don't want to lose that information. 65 65 00:02:27,900 --> 00:02:31,170 Remember, our goal with reconstitution is getting our system 66 66 00:02:31,170 --> 00:02:32,970 back to the known good state, and so, 67 67 00:02:32,970 --> 00:02:35,400 we want to make sure we have that data, as well. 68 68 00:02:35,400 --> 00:02:37,770 Our third step is to identify and disable 69 69 00:02:37,770 --> 00:02:41,490 autostart locations to prevent processes from executing. 70 70 00:02:41,490 --> 00:02:42,323 Now, if you remember, 71 71 00:02:42,323 --> 00:02:44,580 we've talked about autostart locations before. 72 72 00:02:44,580 --> 00:02:46,680 This is places that are inside the file system, 73 73 00:02:46,680 --> 00:02:49,320 the registry, and the task scheduler that could then 74 74 00:02:49,320 --> 00:02:51,810 bring back malware to maintain persistence. 75 75 00:02:51,810 --> 00:02:53,417 So, we want to identify any of those locations 76 76 00:02:53,417 --> 00:02:55,650 that may have some kind of process 77 77 00:02:55,650 --> 00:02:57,960 that will launch that malware again. 78 78 00:02:57,960 --> 00:03:00,930 Our fourth step is to replace contaminated processes 79 79 00:03:00,930 --> 00:03:03,600 with clean versions from trusted media. 80 80 00:03:03,600 --> 00:03:04,830 Again, if I'm going to go and install 81 81 00:03:04,830 --> 00:03:06,210 some new piece of software, 82 82 00:03:06,210 --> 00:03:08,970 I want to make sure it's coming from a known good source 83 83 00:03:08,970 --> 00:03:10,560 because if I just download it off the internet, 84 84 00:03:10,560 --> 00:03:13,440 I might bring additional malware into my system, 85 85 00:03:13,440 --> 00:03:14,430 and so I need to make sure 86 86 00:03:14,430 --> 00:03:17,010 that I have a known good trusted media source. 87 87 00:03:17,010 --> 00:03:18,690 Most companies have what they call 88 88 00:03:18,690 --> 00:03:21,540 a definitive media library or DML, 89 89 00:03:21,540 --> 00:03:23,310 and this is an area where you store all of your 90 90 00:03:23,310 --> 00:03:25,500 CDs and DVDs and hard drives 91 91 00:03:25,500 --> 00:03:28,290 with known, trusted, good copies of your software 92 92 00:03:28,290 --> 00:03:30,630 for you to use during reconstitution. 93 93 00:03:30,630 --> 00:03:32,760 Our fifth step is to reboot the system 94 94 00:03:32,760 --> 00:03:36,000 and analyze it for signs of continued malware infection. 95 95 00:03:36,000 --> 00:03:38,010 So, we think we've gotten everything out now. 96 96 00:03:38,010 --> 00:03:39,840 We're going to go ahead and reboot the system, 97 97 00:03:39,840 --> 00:03:41,310 and if we miss something, 98 98 00:03:41,310 --> 00:03:43,050 we would then have malware being reintroduced 99 99 00:03:43,050 --> 00:03:44,070 into the system. 100 100 00:03:44,070 --> 00:03:46,710 If we got it all, that means we're in a good state 101 101 00:03:46,710 --> 00:03:48,420 and that means we did our job. 102 102 00:03:48,420 --> 00:03:49,864 Then we're going to go into our sixth step. 103 103 00:03:49,864 --> 00:03:52,320 If we see a continued malware infection, 104 104 00:03:52,320 --> 00:03:54,990 meaning we missed something, we now have to look harder 105 105 00:03:54,990 --> 00:03:57,540 and find out how is it staying on that system. 106 106 00:03:57,540 --> 00:03:59,190 We're going to have to analyze the firmware 107 107 00:03:59,190 --> 00:04:00,780 and any USB devices that are there 108 108 00:04:00,780 --> 00:04:02,638 because they may be the source of the infection 109 109 00:04:02,638 --> 00:04:04,410 since we already removed the software 110 110 00:04:04,410 --> 00:04:07,140 and the processes in our earlier steps. 111 111 00:04:07,140 --> 00:04:09,810 Now, under step seven, if all the tests were negative, 112 112 00:04:09,810 --> 00:04:12,330 that means we don't have any malware on the system anymore. 113 113 00:04:12,330 --> 00:04:14,130 Everything is back to normal. 114 114 00:04:14,130 --> 00:04:16,950 So now, we can reintroduce that system back into 115 115 00:04:16,950 --> 00:04:18,180 the production environment, 116 116 00:04:18,180 --> 00:04:20,550 and that means we have solved this problem 117 117 00:04:20,550 --> 00:04:22,980 and we have reconstituted that resource 118 118 00:04:22,980 --> 00:04:25,430 and it's ready to go back to doing its job again.