Security Intelligence for Malware Countermeasures to Support NTT Group’s Security Business

2.1 Honeypots

Malware is collected by using decoy systems called honeypots to accept attacks. By analyzing the communication with honeypots, we can gather evidence about the vulnerabilities that are being used by attackers to spread their malware, and to identify information that is effective for preventing infection.

We are conducting R&D on honeypots that keep up with the trends in malware infection activity. We are currently researching and developing web server honeypots to attract attacks that exploit vulnerabilities in web applications, and honeyclients to attract attacks that exploit vulnerabilities in web browsers and plugins. Here, we introduce a honeyclient that performs a key role in intelligence creation.

In general, honeypots are classified into two categories: low-interaction honeypots that securely gather the minimum amount of information by simulating a vulnerable system, and high-interaction honeypots that collect a lot more information by using an actual vulnerable system. Although high-interaction honeypots are said to run the risk of being infected with malware, we have managed to develop a secure high-interaction honeyclient. Also, low-interaction honeypots are said to be only capable of collecting limited information, but we have managed to develop one with improved information-gathering capabilities. With a honeyclient, it is possible to detect malware infections and identify the URLs of malware sites that infect visitors with malware. Then malware infections can be prevented by prohibiting access to such URLs.

2.2 Dynamic analysis of malware

Malware collected by honeypots is analyzed to shed light on its latent threats by investigating its functions in detail. Furthermore, by analyzing the traffic generated by malware infections to discover information such as the servers they communicate with when obtaining additional malware and the command servers set up by the attackers, it is possible to identify information that is effective for suppressing the damaging effects of malware.

Malware analysis includes dynamic analysis, which clarifies the behavior of malware by actually running it, and static analysis, which deciphers the malware’s program code. Dynamic analysis is introduced here.

Dynamic analysis can be performed either in a closed environment, where the malware is operated in complete isolation, or in an open environment, where the malware can connect to the Internet. In both types of environment, a debugger can be used to closely monitor the malware’s behavior. Furthermore, taint analysis techniques can be used to track the flow of data handled within a system and identify servers prepared by the attackers to send data causing malicious behavior. For example, PCs that have been infected with malware can be discovered by identifying the PCs that access the command server or destination server when acquiring additional malware.

2.3 Honeytokens

During the dynamic analysis of malware collected by a honeypot, it is possible to allow the attacker to tamper with a controlled decoy website by deploying false information for the website administrator’s account in the analysis environment. This makes it possible to collect the latest attack information.

As mentioned previously, the greatest threat of malware infection in recent years has been caused by users unknowingly visiting malware sites. Parts of the malware deployed in these attacks have functions that collect and send out various kinds of account information. Therefore, when a website administrator’s account information is recorded on an infected PC, this information is leaked to the attacker so the website can be manipulated by the attacker, as shown in Fig. 3(a). A honeytoken shows nothing but decoy information. Since the content of a website is often managed via a File Transfer Protocol (FTP) server, fake FTP account information is prepared as a honeytoken. The attacker uses the honeytoken information to log in to a separate fake FTP server and tampers with its content. Checking the falsified content in the honeypot makes it possible to collect security intelligence about the latest attacks initiated by the attacker (Fig. 3(b)).

Fig. 3. Honeytokens.

A paper summarizing this technique [4] was the first Japanese-authored paper in ten years to be accepted at one of the highest-level international conferences and was highly rated all over the world.

2.4 Searching the neighborhood of malware sites

To avoid defenses set up based on security intelligence, attackers construct numerous malignant sites. Since they are reluctant or unable to spend much money on each site, they adopt configurations that enable new malware sites to be set up without incurring much additional cost. In anticipation of this trend, we identify malware sites by searching for web spaces that are highly likely to have been created by attackers.

This search technique is shown in Fig. 4. We first extract URLs with the same path structures as existing malware site URLs in URL groups that exist in the same private domains as the URLs of known malware sites, and then we investigate these URLs using honeypots. An attacker who manages a known malignant site URL will be able to generate such URLs without incurring any cost burden, so with this search technique it is possible to discover malignant URLs prepared by attackers that are intended to avoid security intelligence. This technique was summarized in a paper that achieved global recognition [5] and received the best paper award at a major international conference.

Fig. 4. Neighborhood search of malware sites.