1 1 00:00:00,120 --> 00:00:00,960 In this lesson, 2 2 00:00:00,960 --> 00:00:03,180 we're going to talk about sandboxing. 3 3 00:00:03,180 --> 00:00:04,260 Now, signature-based tools 4 4 00:00:04,260 --> 00:00:05,730 are becoming less and less effective 5 5 00:00:05,730 --> 00:00:08,460 in their ability to automatically block malware execution, 6 6 00:00:08,460 --> 00:00:09,450 because malware creators 7 7 00:00:09,450 --> 00:00:11,100 are getting more advanced in their techniques 8 8 00:00:11,100 --> 00:00:13,500 to disguise their malicious intent all the time. 9 9 00:00:13,500 --> 00:00:15,750 Now, in order to compete with this advancing malware, 10 10 00:00:15,750 --> 00:00:18,150 malware analysts need to keep improving their techniques 11 11 00:00:18,150 --> 00:00:20,040 and their ability to conduct manual analysis 12 12 00:00:20,040 --> 00:00:21,420 of that malware. 13 13 00:00:21,420 --> 00:00:23,220 To do this, they often have to run malware 14 14 00:00:23,220 --> 00:00:25,590 in a controlled environment to observe its effects, 15 15 00:00:25,590 --> 00:00:28,230 but they don't want to infect their own networks or systems, 16 16 00:00:28,230 --> 00:00:31,140 so we use a technique known as sandboxing. 17 17 00:00:31,140 --> 00:00:33,030 Sandboxing is a computing environment 18 18 00:00:33,030 --> 00:00:34,620 that's isolated from the host system 19 19 00:00:34,620 --> 00:00:35,850 to guarantee that the environment 20 20 00:00:35,850 --> 00:00:38,040 runs in a controlled and secure fashion, 21 21 00:00:38,040 --> 00:00:39,210 and that the communication links 22 22 00:00:39,210 --> 00:00:42,780 between the sandbox and the host are completely prohibited. 23 23 00:00:42,780 --> 00:00:45,210 Now, most often you're going to see a sandbox environment 24 24 00:00:45,210 --> 00:00:47,220 created by using something like a virtual machine 25 25 00:00:47,220 --> 00:00:48,720 or virtual box. 26 26 00:00:48,720 --> 00:00:51,300 This allows us to install whatever operating system we want, 27 27 00:00:51,300 --> 00:00:53,670 set up the parameters we need, take a snapshot, 28 28 00:00:53,670 --> 00:00:55,530 and then we can load up the malware inside of it 29 29 00:00:55,530 --> 00:00:57,090 and run that malware, 30 30 00:00:57,090 --> 00:00:59,400 and then we'll be able to find out things about that malware 31 31 00:00:59,400 --> 00:01:00,360 based on what we see 32 32 00:01:00,360 --> 00:01:02,749 when we run it inside that virtualized environment. 33 33 00:01:02,749 --> 00:01:04,530 For example, let's say I run 34 34 00:01:04,530 --> 00:01:06,480 a malicious file inside of a sandbox. 35 35 00:01:06,480 --> 00:01:09,090 I can then determine if that file really is malicious 36 36 00:01:09,090 --> 00:01:11,370 and determine any effects it's going to have on the system, 37 37 00:01:11,370 --> 00:01:13,170 and we can also identify any dependencies 38 38 00:01:13,170 --> 00:01:15,600 within the files on that host that may exist 39 39 00:01:15,600 --> 00:01:17,700 whenever you're running that piece of malware. 40 40 00:01:17,700 --> 00:01:19,020 By using sandboxing, 41 41 00:01:19,020 --> 00:01:20,910 it's going to allow us to quickly test malware 42 42 00:01:20,910 --> 00:01:22,029 in multiple different environments 43 43 00:01:22,029 --> 00:01:24,360 across multiple different operating systems 44 44 00:01:24,360 --> 00:01:26,669 without really affecting our underlying host. 45 45 00:01:26,669 --> 00:01:29,010 Now, to effectively analyze malware, 46 46 00:01:29,010 --> 00:01:31,740 we're going to be using this sandboxing tool, 47 47 00:01:31,740 --> 00:01:33,150 and we're going to use a lot of different features 48 48 00:01:33,150 --> 00:01:34,590 inside of a sandbox. 49 49 00:01:34,590 --> 00:01:37,080 For example, we can monitor any system changes 50 50 00:01:37,080 --> 00:01:38,730 without direct user intervention. 51 51 00:01:38,730 --> 00:01:40,170 So if I run a file, 52 52 00:01:40,170 --> 00:01:41,003 and then all of a sudden 53 53 00:01:41,003 --> 00:01:42,900 something changes inside of that system, 54 54 00:01:42,900 --> 00:01:44,430 such as inside the registry, 55 55 00:01:44,430 --> 00:01:46,230 new files were created, or whatever, 56 56 00:01:46,230 --> 00:01:49,020 we can identify those within the sandbox. 57 57 00:01:49,020 --> 00:01:52,380 Also, I can execute files that are known to be malicious, 58 58 00:01:52,380 --> 00:01:54,000 and that way if I know they're malicious, 59 59 00:01:54,000 --> 00:01:56,040 I can then monitor all the changes that are happening 60 60 00:01:56,040 --> 00:01:58,710 to the processes, to the registry, to the file system 61 61 00:01:58,710 --> 00:02:00,570 on that given sandbox system, 62 62 00:02:00,570 --> 00:02:01,560 and that will help me develop 63 63 00:02:01,560 --> 00:02:04,020 my indicators of compromise or signatures 64 64 00:02:04,020 --> 00:02:05,100 for my other solutions 65 65 00:02:05,100 --> 00:02:08,010 like antimalware or antivirus solutions. 66 66 00:02:08,010 --> 00:02:10,170 Additionally, I can monitor network sockets 67 67 00:02:10,170 --> 00:02:11,430 for attempted connections 68 68 00:02:11,430 --> 00:02:14,250 in a way that can identify any kind of known bad IPs 69 69 00:02:14,250 --> 00:02:16,410 that are being used for command and control nodes 70 70 00:02:16,410 --> 00:02:18,780 or beaconing or something like that. 71 71 00:02:18,780 --> 00:02:20,307 Also, I can use the sandbox 72 72 00:02:20,307 --> 00:02:22,587 to be able to monitor for system calls that are being made 73 73 00:02:22,587 --> 00:02:24,900 or any API calls that are being called 74 74 00:02:24,900 --> 00:02:26,970 by that malicious binary. 75 75 00:02:26,970 --> 00:02:28,740 Another great feature of using a sandbox 76 76 00:02:28,740 --> 00:02:30,990 is what's known as a snapshot feature. 77 77 00:02:30,990 --> 00:02:33,570 Now, a snapshot allows us to take an instant copy 78 78 00:02:33,570 --> 00:02:36,720 or backup of the environment before we run a program. 79 79 00:02:36,720 --> 00:02:38,940 Then we can run that malicious program, 80 80 00:02:38,940 --> 00:02:40,200 and after we see the changes 81 81 00:02:40,200 --> 00:02:43,170 we can roll back to the time before that snapshot. 82 82 00:02:43,170 --> 00:02:44,160 This is much quicker 83 83 00:02:44,160 --> 00:02:46,110 than doing a full backup and restoration 84 84 00:02:46,110 --> 00:02:48,840 that can take several hours sometimes on larger systems, 85 85 00:02:48,840 --> 00:02:52,500 whereas a snapshot can take about 30 to 60 seconds. 86 86 00:02:52,500 --> 00:02:54,540 Another thing we're able to do inside of our sandbox 87 87 00:02:54,540 --> 00:02:56,700 is to record any file creation or deletions 88 88 00:02:56,700 --> 00:02:59,160 that may be happening when we're running a piece of malware, 89 89 00:02:59,160 --> 00:03:01,080 and we can dump all of the information 90 90 00:03:01,080 --> 00:03:03,690 from that virtual machine's memory in that sandbox 91 91 00:03:03,690 --> 00:03:05,850 so then we can do a full analysis of the program 92 92 00:03:05,850 --> 00:03:08,790 and the contents of memory on that system. 93 93 00:03:08,790 --> 00:03:10,200 This is important because sometimes 94 94 00:03:10,200 --> 00:03:11,940 when we're dealing with a piece of malware, 95 95 00:03:11,940 --> 00:03:14,910 they actually make compress it or pack it or encrypt it, 96 96 00:03:14,910 --> 00:03:16,830 and it won't be unencrypted or decompressed 97 97 00:03:16,830 --> 00:03:18,270 until you run the malware. 98 98 00:03:18,270 --> 00:03:20,670 So when you run it inside a sandbox, 99 99 00:03:20,670 --> 00:03:22,830 we can then have that malware in memory, 100 100 00:03:22,830 --> 00:03:24,630 and when we dump that virtual memory, 101 101 00:03:24,630 --> 00:03:26,460 we can then analyze that virtual memory dump 102 102 00:03:26,460 --> 00:03:30,030 in the unpacked or unencrypted version of that malware. 103 103 00:03:30,030 --> 00:03:31,860 Now, one of the big keys that you have to have 104 104 00:03:31,860 --> 00:03:33,360 when you're dealing with a sandbox 105 105 00:03:33,360 --> 00:03:36,030 is that your sandbox host, which is a virtual machine, 106 106 00:03:36,030 --> 00:03:38,310 should not be used for any other purposes 107 107 00:03:38,310 --> 00:03:40,500 except for your malware analysis. 108 108 00:03:40,500 --> 00:03:42,210 This keeps your sandbox clean, 109 109 00:03:42,210 --> 00:03:43,320 and once it's infected, 110 110 00:03:43,320 --> 00:03:45,480 it keeps the infection from spreading anywhere else 111 111 00:03:45,480 --> 00:03:48,540 because it's isolated inside of the sandbox. 112 112 00:03:48,540 --> 00:03:50,340 Now, there are lots of different tools that we can use 113 113 00:03:50,340 --> 00:03:52,020 when we're doing sandboxing. 114 114 00:03:52,020 --> 00:03:54,630 One of my favorites is actually known as FLARE VM, 115 115 00:03:54,630 --> 00:03:56,040 which is provided by Mandiant. 116 116 00:03:56,040 --> 00:03:57,870 Now, FLARE VM is actually a free program 117 117 00:03:57,870 --> 00:04:00,300 that you can install on top of Windows 10, 118 118 00:04:00,300 --> 00:04:03,180 and this allows you to run a Windows binary on the system 119 119 00:04:03,180 --> 00:04:04,307 and then see what the status is 120 120 00:04:04,307 --> 00:04:07,410 and all the different changes that that malware is doing. 121 121 00:04:07,410 --> 00:04:08,243 All of this can be run 122 122 00:04:08,243 --> 00:04:09,900 in any virtualization program you want, 123 123 00:04:09,900 --> 00:04:12,840 such as VMware or VirtualBox or Parallels 124 124 00:04:12,840 --> 00:04:13,980 or something like that. 125 125 00:04:13,980 --> 00:04:16,320 And this way we have a nice sandbox environment 126 126 00:04:16,320 --> 00:04:17,910 to be able to do malware analysis 127 127 00:04:17,910 --> 00:04:21,330 if you're working as a triage analyst or a malware analyst. 128 128 00:04:21,330 --> 00:04:23,730 Another great tool out there is known as Cuckoo. 129 129 00:04:23,730 --> 00:04:25,860 Now, Cuckoo is a sandboxing program 130 130 00:04:25,860 --> 00:04:27,180 that allows you to automatically run 131 131 00:04:27,180 --> 00:04:29,280 a bunch of different malware samples in it 132 132 00:04:29,280 --> 00:04:31,800 and then see what they do inside of a Linux environment, 133 133 00:04:31,800 --> 00:04:34,440 a Windows environment, or even a Mac environment. 134 134 00:04:34,440 --> 00:04:36,120 Cuckoo is a really good program 135 135 00:04:36,120 --> 00:04:38,010 for providing you with a lot of automation 136 136 00:04:38,010 --> 00:04:40,140 inside of this world of malware analysis, 137 137 00:04:40,140 --> 00:04:41,880 so you don't have to do as much manual analysis 138 138 00:04:41,880 --> 00:04:43,890 as you're going through and doing your triage 139 139 00:04:43,890 --> 00:04:45,990 of a particular piece of malware. 140 140 00:04:45,990 --> 00:04:47,400 The third program we need to talk about 141 141 00:04:47,400 --> 00:04:49,230 is known as Joe Sandbox. 142 142 00:04:49,230 --> 00:04:51,930 Now, Joe Sandbox is another great sandboxing tool 143 143 00:04:51,930 --> 00:04:54,330 that you can use as a cybersecurity analyst. 144 144 00:04:54,330 --> 00:04:57,180 Joe Sandbox is a dynamic malware analysis tool 145 145 00:04:57,180 --> 00:04:59,970 that allows a security research or cybersecurity analyst 146 146 00:04:59,970 --> 00:05:02,700 to analyze and understand the behavior of malware samples 147 147 00:05:02,700 --> 00:05:04,860 in a safe and controlled environment. 148 148 00:05:04,860 --> 00:05:07,860 It's designed to automate the process of analyzing malware, 149 149 00:05:07,860 --> 00:05:09,990 allowing security professionals like you and I 150 150 00:05:09,990 --> 00:05:12,240 to quickly and easily identify potential threats 151 151 00:05:12,240 --> 00:05:14,226 without the need for manual analysis. 152 152 00:05:14,226 --> 00:05:16,950 At its core, Joe Sandbox is going to emulate 153 153 00:05:16,950 --> 00:05:18,660 the environment of a real computer, 154 154 00:05:18,660 --> 00:05:20,160 like a virtual machine would, 155 155 00:05:20,160 --> 00:05:22,410 and allows malware samples to be run and analyzed 156 156 00:05:22,410 --> 00:05:24,450 in a safe isolated environment. 157 157 00:05:24,450 --> 00:05:26,010 It then collects and analyzes data 158 158 00:05:26,010 --> 00:05:27,210 on the malware's behavior, 159 159 00:05:27,210 --> 00:05:29,430 such as which files it's creating are modifying, 160 160 00:05:29,430 --> 00:05:31,050 what network connections are being made, 161 161 00:05:31,050 --> 00:05:32,820 and what changes are being made to the registry 162 162 00:05:32,820 --> 00:05:34,500 and other parts of the system. 163 163 00:05:34,500 --> 00:05:36,026 This information can then be used to identify 164 164 00:05:36,026 --> 00:05:37,650 the malware's capabilities, 165 165 00:05:37,650 --> 00:05:39,720 such as whether it's spyware, ransomware, 166 166 00:05:39,720 --> 00:05:41,460 or some other kind of malware. 167 167 00:05:41,460 --> 00:05:43,590 Now, one of the key features of Joe Sandbox 168 168 00:05:43,590 --> 00:05:45,750 is its ability to detect and analyze malware 169 169 00:05:45,750 --> 00:05:47,370 across multiple platforms, 170 170 00:05:47,370 --> 00:05:50,940 including Windows, Mac OS, Linux, and Android. 171 171 00:05:50,940 --> 00:05:52,546 This allows us the security professionals 172 172 00:05:52,546 --> 00:05:56,010 to analyze malware samples on all these different platforms 173 173 00:05:56,010 --> 00:05:57,480 where they're most likely to be to be encountered, 174 174 00:05:57,480 --> 00:05:58,920 and provide us a comprehensive view 175 175 00:05:58,920 --> 00:06:01,110 of that particular malware's behavior. 176 176 00:06:01,110 --> 00:06:02,910 Now, another great thing about Joe Sandbox 177 177 00:06:02,910 --> 00:06:05,394 is that it provides a user-friendly interface for us to use 178 178 00:06:05,394 --> 00:06:06,990 to easily view and analyze 179 179 00:06:06,990 --> 00:06:09,720 the data being collected from these malware samples. 180 180 00:06:09,720 --> 00:06:11,460 The interface then displays the information 181 181 00:06:11,460 --> 00:06:13,380 in an organized and intuitive manner, 182 182 00:06:13,380 --> 00:06:15,150 and allows cybersecurity professionals like us 183 183 00:06:15,150 --> 00:06:16,890 to quickly identify potential threats 184 184 00:06:16,890 --> 00:06:18,960 and take the appropriate actions. 185 185 00:06:18,960 --> 00:06:20,625 Another important feature of Joe Sandbox 186 186 00:06:20,625 --> 00:06:23,100 is the ability to automatically classify malware 187 187 00:06:23,100 --> 00:06:24,540 based on its behavior, 188 188 00:06:24,540 --> 00:06:27,750 so we can actually identify malware based on its family, 189 189 00:06:27,750 --> 00:06:29,550 tracking the evolution of a piece of malware 190 190 00:06:29,550 --> 00:06:31,260 or identifying similarities 191 191 00:06:31,260 --> 00:06:32,970 between different types of malware samples 192 192 00:06:32,970 --> 00:06:35,670 that we're analyzing inside of Joe Sandbox. 193 193 00:06:35,670 --> 00:06:37,710 Now, because the CySA+ exam 194 194 00:06:37,710 --> 00:06:39,360 is considered to be vendor neutral, 195 195 00:06:39,360 --> 00:06:40,890 they're not going to go into too much detail 196 196 00:06:40,890 --> 00:06:42,240 on any specific tool, 197 197 00:06:42,240 --> 00:06:45,300 such as FLARE VM, Cuckoo, or Joe Sandbox, 198 198 00:06:45,300 --> 00:06:46,590 but I am mentioning them here 199 199 00:06:46,590 --> 00:06:48,570 because they're really good tools for you to know about 200 200 00:06:48,570 --> 00:06:50,670 when you're working as a cybersecurity analyst, 201 201 00:06:50,670 --> 00:06:53,280 a triage analyst, or a malware analyst. 202 202 00:06:53,280 --> 00:06:55,800 Now, if you want to do more complex analysis, though, 203 203 00:06:55,800 --> 00:06:58,140 you're going to need to create a honeypot lab, 204 204 00:06:58,140 --> 00:06:59,970 and this will have multiple sandbox machines 205 205 00:06:59,970 --> 00:07:01,110 and internet access, 206 206 00:07:01,110 --> 00:07:03,750 so you can actually study the malware and its C2 structure 207 207 00:07:03,750 --> 00:07:05,010 as it starts communicating out 208 208 00:07:05,010 --> 00:07:06,900 with lots of other things on the network. 209 209 00:07:06,900 --> 00:07:09,330 But again, creating this type of honey net or honeypot 210 210 00:07:09,330 --> 00:07:12,000 is beyond the scope of the CySA+ exam. 211 211 00:07:12,000 --> 00:07:14,580 But if you find yourself working as a malware analyst, 212 212 00:07:14,580 --> 00:07:16,890 then you may be asked to set one of these up and use it 213 213 00:07:16,890 --> 00:07:19,823 as you're performing your job functions during your career.