Do malware researchers only write signatures
in malware analysis companies?
I get this question from some people
with that as malware researcher,
what you do in your day-to-day life,
is that your only like, taking like 20 samples,
or 30 samples, and you try to write a signature
for them, or what you're actually doing
inside a malware analysis company.
So to answer that,
you need to know that an antivirus company
is not only the antivirus product
that you see at home.
There's so many different products inside,
in the antivirus company.
There's multiple teams,
and each team is doing a really important role
in protecting the companies they are trying to protect,
or even the end users.
One team is writing signatures,
one team is improving heuristics,
one team is actually doing post effects,
so after there is an attack,
how a company can actually contain this attack.
So, there's an incident response team
in many of antivirus companies.
It comes like as a private sector, incident handling,
and they come to a company after there's an attack
and they get to know how this attack happened,
why it happened, what are the weaknesses
inside this company that led to this attack,
and they also help in containing this attack.
So, these are just some of the teams.
There's also, and this is something I really want
to talk about, because,
in every type of malware that appears in any company,
is not just, oh it's just another malware,
okay, we just scan for amount this machine,
or just separate it from the network.
We also want to understand,
what's the attackers, who is behind this malware,
what's his motivation,
and what is doing for inside any company?
It's not like he's attacking an end user.
Even if he's attacking an end user,
is it like a banking Trojan,
trying to steal your money,
or on someone who is encrypting your files?
Or does he, how does he spreads,
does it spreads though USB,
or he does this, or that?
Does his stealing over social media count?
All of that information is really important
for you to know what you need to contain
and what you need to do
if it's steals your credit card information
then you can directly disable your cards
and make sure that the bank knows
that you have been infected by this malware.
Does he transfer money with your bank account?
It gives you like a fake banking website page
and tries to steal your money,
what exactly he's doing.
So this is important for an end user,
for companies even more,
what exactly he's targeting inside this company.
Is it blueprints, is it ransomware,
is it a ransomware malware?
What's that attacker's way of attacking,
what's the attack vector,
what weaknesses they have been using
inside an organization?
Not only this, antivirus companies,
they have lots of people, lots of companies,
who have their antivirus installed
and they participate in collaborating
with so many companies
in their sector to protect themselves.
So, one company has been targeted by a malware
who's trying to steal their blueprints,
let's say this malware is from China, or North Korea,
and this malware's trying to steal the blueprints,
it's trying to destroy the company,
stealing the client's usernames and passwords,
and release them online to attack the reputation.
This company is actually, let's say, in the banking sector.
So, if this company in the banking sector
has been affected by this attack,
and the antivirus, what it is doing
is that they get this information about this attack,
they get the samples, they analyze them,
they get to know all the information about this attack,
maybe they throw their entrance response team,
or throw their actual antivirus,
and then they collect this information
and they write an intelligence information,
and they give it to all the companies
that are in the same sector.
Let's say, this bank has been attacked,
like Bank of Bangladesh has been attacked
by North Korea, by North Korean government,
with the cyber attack.
They are trying to steal money out of the bank
to the North Korean government.
And it was the first time in the history it happened.
So, and I was actually working,
actually in this attack itself.
I was one of the engineers
who got the link
between the North Korean government and the Bangladesh Bank.
But the most important rule that we're playing
is that if we got this information,
now we know that this bank has been affected.
Now we need to warn different banks in Bangladesh,
in different countries around,
to know that this could be,
the North Korean is attacking other banks
in the countries around as well, including:
South Korea, Philippines for example,
or in any other country in Asia.
And we actually seen multiple attacks
has been happening around in the banking sector,
in these countries.
So, we got to know one attack,
then we can warn the other companies in the same sector.
Let's say Shamoon attack
was against a Qatarian petrol company, or gas company,
can cut our gas or something like that.
And this attack really, really affected the company so much,
it was like they hacked everything,
they wiped everything, they steal lots of information,
but we know that they have targeted this petrol company
they may target other companies,
and then the other companies should be warned about that,
they should know what is their attack vector,
what's the tools they have,
what's their weapons,
and how they can protect against it.
Let's say if its a phishing attack
and this way,
then we can try to have
more awareness trainings for them.
So, what's that virus role,
is to collect all this information.
Collaborate between different companies in that sector,
and analyze the attack, get to know the attackers,
and analyze their types of attacks,
their attack vector, their motivation and everything,
and provide this information
to all the companies in the same sector.
Also, it helps them to,
also the antivirus companies,
they also try to understand which company,
and what's their level of security compared
to all their competitors.
Are they the weakest point,
or are they the strongest one in the whole sector.
And they give this information,
sometimes with serve, to different companies.
So, I advise companies,
they have lots of different teams,
and lots of different roles they play
in helping companies to be more safe
from malware or from attackers.
And, you know as a malware researcher,
depends on which job you will have,
depends on which team,
you will have different roles than just writing signature.
We as threat researchers,
I also working as threat researcher,
who's providing threat intelligence information
to different companies when I was working in Symantec.
In this role, you do analyze an attack,
you also write signatures, maybe Yaro signature.
But the main target is to understand the attackers,
understand their motivation,
and actually provide to different companies
information about this attack,
their attack vector, and how do they spread
through all the network.
And also, all the indication of compromise.
As an incident handler, you will be dealing
with the after attack.
What you should do to deal with this attack,
to understand this attack,
to understand how it actually happened,
and to give them information if it spreads through network,
so they have to isolate the network on just one machine.
If it steals their credentials
then they have to warn their users, and so on.
And so we get to understand this attack
and help them in containing it.
At the same time we also provide this information
to them so that they can know their weaknesses
and they can protect themselves for the next attack.
So, malware researcher,
there is lots of different roles
and different hats we wear when working,
when working as a malware researcher.
I worked as an incident hunter,
I worked as a threat researcher,
and it's completely different roles
and completely different things.
We don't only write signatures,
we have way more things to do
to help companies protect their assets.
That's it for this video,
and see you in the next video, bye-bye.