I've heard that lawyers and doctors were once skittish about telling people their professions at a cocktail party. When other partygoers would hear, they'd seek medical or legal advice, creating a Vortex of Free Consulting (VoFC). At today's parties, if you mention that you work in the computer security field, a similar VoFC will very likely materialize around you. In the presence of a security guru like you, who can blame your hosts for seeking some help with slow-working PCs or incessant pop-ups?
There are often times when information security professionals need to perform some quick remediation but don't have the luxury of their full toolsets. To that end, in this month's tip we'll discuss how to build a portable software kit for use on malware-infected machines. A huge number of very useful system analysis and malware-fighting tools are available for free on the Internet. I urge you to download them and burn them to a CD or, better yet, write them to a cheap 1 GB USB memory token. Then, carry that USB token with you wherever you go (even to fancy cocktail parties), so you are ready to swoop in like an information security superhero to save people in distress.
Weapon 1: Antivirus and antispyware
First off, you'll need antivirus and antispyware tools that can scan a system, detect malware and eliminate it from the machine. My favorite free antivirus scanner is ClamAV, a tool acquired by Sourcefire in August 2007. Signatures updates, however, should be downloaded regularly.
For antispyware, my favorite free tools include Lavasoft AB's Ad-Aware, Spybot Search and Destroy, and Trend Micro Inc.'s HijackThis. Though commercial vendors are swooping in to ...
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
purchase a number of these tools, as long as they remain free, high-quality and up-to-date, there's nothing wrong with using them.
Weapon 2: Machine analyzers
One of the best sources for in-depth analysis of Windows systems is Sysinternals, an organization acquired by Microsoft in July 2006. I'm hopeful that many of the Sysinternals tools will eventually be incorporated into Windows itself, but until that occurs, downloading them is a great help. Here are some essential Sysinternals tools:
- Process Explorer is everything that Windows Task Manager should have been. It shows all running processes, indicating their hierarchy of relationships, as well as the DLLs that they've loaded.
- Filemon and Regmon record all interactions with the file system and registry, respectively, and do so in real time.
- Process Monitor, a newer addition to the Sysinternals stable, basically combines the three, detailing pretty much all of a machine's running processes.
- The Autoruns program displays all of a system's autostart programs that are activated when the system boots up or when a user logs on. Because spyware often tweaks the autostart directories or registry keys, this program is vital in analyzing the status of a machine.
- TCPView provides a graphical view of TCP and UDP port usage, associating each port to the process that is using it.
- Strings displays a file's character strings on the screen. Malware authors careless enough to leave strings in their code will quite often leave ASCII strings. To make the Sysinternals program look for ASCII, rather than Unicode strings by default, run it using -a.
- Finally, RootkitRevealer looks for a rootkit by determining when a system provides misinformation about which files and registry keys are present.
The insights gleaned from these tools -- with a little search engine help for specific process, DLL and file names -- can help identify malicious activity on a machine.
Weapon 3: Microsoft Baseline Security Analyzer (MBSA)
Microsoft's free handy diagnosis tool looks at hundreds of settings on a Windows machine, determines its security state and makes recommendations. MBSA can reveal weaknesses, like out-of-date patches, that enable malware infections. I also carry around a copy of Netcat, the venerable network communications widget that sends arbitrary data across a TCP connection or over a UDP port. Netcat can move files around (such as the report generated by MBSA or ClamAV) or achieve remote shell access.
Weapon 4: LADS (List Alternate Data Streams)
This freeware tool by Frank Heyne scours NTFS-based file systems for alternate data streams (ADSes), files that are hidden by default and sometimes used by attackers to conceal their evil. A new option has been added to Windows Vista that can display streams using the built-in 'dir' command combined with the /r flag. Since pre-Vista boxes are still a reality, tools like LADS should be another vital component of your toolkit.
Weapon 5: VMware Player/VMware safe browsing appliance
VMware Player is a free virtualization application, which allows a guest machine to run on top of a Windows box. The VMware safe browsing appliance includes a free Ubuntu operating system with a running Firefox browser.
Sometimes Internet access is needed to download an additional tool. If no other machine is handy (we're talking about a cocktail party here), VMware can be installed on the messed-up box. Running the virtual machine will allow access to the Internet.
Once you build your malware-fighting USB arsenal, make sure it is set to read-only. Many USB tokens have a little hardware switch for read-only access. Flip that switch, because the last thing you want is for malware to infect your kit. I simply avoid buying USB tokens that lack such hardware support for read-only access.
Finally, don't let these tools be the limit of a USB analysis kit. Feel free to augment it with other components specific to your own needs. But don't just dump items onto a USB token without understanding what they do; running a tool incorrectly may cause even more damage to a machine. Practice with them in a lab on experimental machines and think carefully about how each tool can help fix an infected box. With a little planning and a lot of practice, a malware-fighting USB token will serve you well.
About the author:
Ed Skoudis is a SANS instructor and a founder and senior security consultant with Intelguardians, a Washington, DC-based information security consulting firm. His expertise includes hacker attacks and defenses, the information security industry and computer privacy issues. In addition to Counter Hack Reloaded, Ed is also the author of Malware: Fighting Malicious Code. He was also awarded 2004, 2005 and 2006 Microsoft MVP awards for Windows Server Security, and is an alumnus of the Honeynet Project. As an expert on SearchSecurity.com, Ed answers your questions related to information security threats.
