

\documentclass{beamer}

%     Copyright (c)  2001,2002,2003,2004,2005  Alexandre Dulaunoy <adulau@foo.be>
%     Permission is granted to copy, distribute and/or modify this document
%     under the terms of the GNU General Public License, Version 2.0
%     or any later version published by the Free Software Foundation;


%\usetheme{PaloAlto}
%\usetheme{Goettingen}

\usetheme[compress]{Dresden} %%OK
\usecolortheme{crane}

\usepackage[english]{babel}
\usepackage[latin1]{inputenc}
\setbeamertemplate{blocks}[rounded][shadow=true]
\setbeamercovered{transparent}


%
% The following info should normally be given in you main file:
%


\title{Honeynet data capture - practical analysis of rootkits}
\subtitle {}
\keywords {security analysis}
\subject {Honeynet data capture - practical analysis of rootkits}
\author{Alexandre Dulaunoy}
\institute{
  ASBL CSRRT-LU (Computer Security Research and Response Team Luxembourg)\\
  http://www.csrrt.org/}


\begin{document}


\frame{\titlepage}

\section*{Malware/... analysis}

\subsection{Introduction}

\frame[containsverbatim]{
  \nameslide{Introduction}
  \frametitle{Introduction}

After the "basic" network analysis, you have now a better understanding of what happened in the network. 
Not everything is clear (it's impossible to reach the truth) but you are facing various part of 
the attacks and you would like to dig into the components used 
during the attacks. Some components seem to be software but how to make analysis ?

}

\subsection{Analysis approach}

\frame{
  \nameslide{Analysis approach}
  \frametitle{Analysis approach}

There are two ways to analyze unknown components on a compromised
system. The dynamic analysis approach and the static analysis approach.
Static analysis is the most difficult way and takes a lot time to be properly
done but the results can be very good. On the other side, the dynamic
analysis is often faster to realize and give sometimes sufficient results but introduce
more potential risks.

}


\subsection{Dynamic analysis}

\frame[containsverbatim]{
  \nameslide{Dynamic analysis}
  \frametitle{Dynamic analysis}
Dynamic analysis means that you are analyzing software during its execution
on a computer or in a virtual machine.
\begin{itemize}
\item "Black box approach". You are studying the component without digging the internal but only the flows (input/output) of the program, its
interactions with the external interface (read/write access to files) or
its effects on the environment (e.g. smart-card and power usage).
\item "Post mortem approach". You are studying the effect on the system
after the execution of the component. Effects can be memory effects,
file access, temporary data created in the file system,...
\item  "Conventional approach". You are studying the execution of the component actively with system call tracker, memory analyzer, real time
 debugger/wrapper, open files tracker, ...
\end{itemize}

}


\subsection{Static analysis}

\frame[containsverbatim]{
  \nameslide{Static analysis}
  \frametitle{Static analysis}

\begin{itemize}
\item "Classical static analysis" is the method to look at the component
without any execution on the component itself. You can look a the
string contained in the binary, compares the hashes fingerprint of the
software,
\item  "Disassembly analysis" is to recover the machine-language code of a
 component. This can be a complex and long task to analyze large
 software but realivility small software can be disassembled.
\item "Decompilation analysis" is to recover the source code of the compo-
nent from machine-language. Sometimes compiler (from source code
to machine-language) adds a lot of information in the compiled pro-
gram.
\end{itemize}

}


\section*{Q and A}

\frame {

\nameslide {Q and A}
 \frametitle {Q and A}

\begin{itemize}
\item Thanks for listening.
\item http://www.csrrt.org.lu/
\item adulau@foo.be
\end{itemize}
%%\includegraphics[scale=0.50]{Hack2005lu-banner.png}
}

\end{document}


