Sifting Files for Cyber

I’ve always considered end-of-file (EOF) to be an effective bumper block for programs – one that helps executing code from over-running its rails. New programmers especially like the condition, as it provides a simple target for defining when a computing task is complete: Read and interpret the file until you’ve hit EOF, at which point you are done. It’s an elegant concept, and it reminds us how important file formats are to the programs that process them.

Cyber security experts understand the critical role of file formats and analysis in preventing malware infections. That is, to avoid being hit with malware, you must first learn to spot it, and file analysis is a useful method for such determination: Read and interpret the file until you’re convinced it’s not malware, at which point you are done. This is foundational in our discipline, but it’s much easier said than done – if only because your adversary knows you’ll be doing it.

I spent a couple of delightful hours recently with the principals of ReversingLabs, a fascinating cyber security company headquartered in Cambridge, Massachusetts. One of the primary focus areas for the company involves high speed automated file analysis that makes analysts and response teams more efficient and effective, but can also be deployed to evaluate millions of email, web and shared files per day in real-time. It’s impressive technology.

The team shared with me their solution approach, which involves storing the results of file analysis in a database to support historical searches by file attribute. The goal is to speed the incident response, analysis, and hunting tasks, which is a critical enterprise requirements. Their unique technology is based on a technique called active file decomposition, which breaks down a file rapidly and supports determination of malware presence at scale.

“We support real-time file and object analysis based on rule definitions that allow analysts to quickly and accurately classify potential malware samples,” explained Mario Vuksan, the Founder and CEO of ReversingLabs. Vuksan, who is a frequent presenter at conferences such as Black Hat, was also previously head of technology development at Bit9. “This capability not only helps the analyst, but also makes existing cyber security product solutions much better.”

One embedded capability is a signature-based open source tool called YARA. Analysts can deploy custom YARA rules using ReversingLabs solutions to pattern-match the contents of files or objects. For example, if law enforcement describes a new malware variant, then analysts can use the description to build YARA rules, and then use ReversingLabs to search for that malware in the local network. They can also use the YARA rule to rapidly update detection and control definitions in their existing security tools.

ReversingLabs offers a variety of appliances including one for malware analysis and hunting, and one for enterprise scale file analysis. Both make use of the company’s TitaniumCore technology for unpacking files and extracting threat indicators at near-real time speeds. It addresses typical blind spots by addressing a broad area of file types, including Windows, Linux, iOS, MacOS, Android, firmware, PDF, and other formats.