'Digital fingerprints' could help catch virus creators

LAS VEGAS — Security company HBGary today released an open source tool to digitally fingerprint malicious code and help identify the source of the malware. The company announced the new product at the Black Hat Briefings security conference.

“This is something that I’ve invested a lot of time in over the last year,” said Greg Hoglund, the company's chief executive officer. The tool looks for unique artifacts created during the writing and compiling of the malicious software.

“Every component in the [development] tool kit has the ability to leave an identifying mark,” he said. No single tool mark will identify the source of the malicious code by itself, but a collection of marks can create a uniquely identifiable fingerprint, Hoglund said in an interview with GCN. Now, the tool examines 10 to 20 identifiable tool marks in a piece of binary code to produce a fingerprint.

“What I’ve discovered is that you can track an individual’s activities,” sometimes over a period of years, he said.

The tool is available at no cost as open source software, giving users full access to the source code in the hope of speeding the maturity of the technology. “We’re hoping this is something that will be adopted by the security community," Hoglund said.

The issue of attribution of cyberattacks has taken on increased importance with the development of offensive cyber war capabilities by a number of nations and the creation of a defensive and offensive Cyber Command in the U.S. military. The ability to identify an attacker is essential to deterring and responding to a conventional military attack. The House Science and Technology Committee's Technology and Innovation Subcommittee recently held hearings on the challenge of applying attribution to deterring cyberattacks.

“During the Cold War, the United States and the Soviet Union were held in check by the notion that an attack would result in immediate retaliation,” Rep David Wu (D-Ore), the subcommittee chairman, said in a prepared statement. “This was achieved because each country would have been able to precisely identify its attacker.”

But a study for the Defense Department by the Institute for Defense Analyses concluded that “attribution is difficult and inherently limited,” and that “because of the difficulty and uncertainty in performing attribution, computer network defense should not depend on attribution.”

Wu said that development of effective attribution techniques, while not the ultimate solution to cybersecurity, should be “an essential part of our efforts to secure the nation’s cyber space.”

Hoglund said that digital fingerprinting of malicious code is a step in that direction. “Attribution is starting to work in our favor,” he said.

He has been able to determine the time at which a piece of malware used in the theft of data from a defense contractor was compiled. “This is telling me he has been on the site since at least December of last year,” he said.

In another case, he compared a piece of malware supplied to him by the Army's criminal investigation division  in 2005 with malicious code supplied by US-CERT in January of this year. “It had the same tool marks,” he said. “It was the same guy. He’d been around for five years.”

He identified the code as coming from a Chinese source because of the language it was written in. “This source code does not appear anywhere in English form,” he said. The targets of the code were in the Defense Department, but Hoglund said he doubted the creators were working directly for the Chinese government. “They are so sloppy,” he said. “They leave their tracks all over the place.”

Identifying malware from a common source is a comparatively simple matter of comparing the digital fingerprints and finding a match. Identifying the individual or the group that created the code is more complex and will require a combination of human intelligence as well as technology. Spies and researchers still will have to locate, monitor and possibly infiltrate — either in person or online — the groups producing and using the malware.

“This attribution stuff is new,” Hoglund said. Human intelligence and technology still are operating in isolated environments, but “this is an opportunity to bridge the silos. The integration is starting now.”

Fingerprinting also could produce immediate results by implementing it in antivirus and intrusion detection tools. Traditional signatures used to identify known malware can easily be changed, which limits the life of a given signature and the effectiveness of signature based detection. But tool marks in the binary code can go back for years and digital fingerprints from the malware’s source code are less likely to change frequently. This could extend the useful life of a signature from days to years.

Source code can be changed, Hoglund conceded, but economics make it unlikely it will be changed often.

“It takes a long time to get software to work properly,” he said. “So when you get it working you don’t want to change it. So we’ve got that working for us. You’re gong to be able to find the malware until the cows come home.”