We are proud and happy to announce that a new free malware analysis online service is born.

Malwr.com is based on Cuckoo Sandbox, a project mentored by the Honeynet Project, sponsored by GSoC and developped by Claudio “nex” Guarnieri (@botherder), Dario Fernandes and Alessandro “jekil” Tanasi (@jekil). Malwr.com hosting is provided by ShadowServer.

If you want to test Cuckoo’s flavor before installing it or if you’re too lazy to deploy your own sandbox, just go there ! :-)

GSoC 2011 #8 project’s goal was to add forensics features to the popular Wireshark network analyzer.

Overview

Wireshark is an open source network analyzer widely used for network debugging as well as security analysis. Wireshark provides network analyzer with graphical interface as well as command line tools. Wireshark also provides network protocol decoders and support filters that allow to search through packets with keywords.

GSoC plugins extend Wireshark capabilities when Wireshark is used to analyze network traffic with security and forensic in mind.

In 2011, the Honeynet Project had once again the opportunity to participate in the Google Summer of Code program. In the last few weeks, we wrapped up all projects, beta tested the code, wrote documentation, and prepared releases.

To quickly recap: GSoc (Google Summer of Code) is an annual summer program sponsored by Google, in which Google pairs up students with organizations committed to open-source. Google supports each project with 5000USD of which the students receive the lion’s share. The Honeynet Project has participated in GSoc since 2009. Visit https://honeynet.org/gsoc2009 and https://honeynet.org/gsoc2010 to get an idea on what we have accomplished through this program in the last couple of years.

The Honeynet Project had mentored 12 projects this year for the Google Summer
of Code (GSoC). The 11th project was to extend the SIP module for
Dionaea to handle SIP udp, tcp and even tls. With the TLS part, the
Dionaea can even emulate a Microsoft Lync server. The TLS part was not
part of the original scope, but the hard work made that possible as
well!

[Dionaea] intention is to trap malware
exploiting vulnerabilities exposed by services offered to a network,
the ultimate goal is gaining a copy of the malware. With the SIP
module, you can answer the SIP attacks, record the information. It is
also possible to make “real” users, so the attacker will get different
answers depending on which accounts he tries to hack. If you would
fake a Microsoft Lync installation, you could add some of the real
user names from your server and see if somebody is doing a targeted
attack towards you. (but of course, don’t use the same passwords…. )

The Beta version of HoneySink is out!

What is HoneySink?

HoneySink is an open source network sinkhole that provides a mechanism for detection and prevention of malicious traffic on a given network.

Able to be deployed both internally and externally it is designed to log and respond to incoming requests for a number of network protocols.

With configuration and scalability in mind, HoneySink was designed from the ground up with a non-blocking architecture to handle extremely large amounts of traffic while being able to perform customised interactions and logging.

We’ve set up a demonstration site for HoneyViz (Project #3) at

http://50.16.162.188:6174/

HoneyViz is an interactive java applet which visualizes sensor data (similar to Project #4). The goal of this project has been to allow the end user to select a set of data that is of interest and generate a variety of useful visualizations based off of this selection in realtime.

The site offers some user-level documentation to explain how the tool works and provides suggestions for a few interesting visualizations we have found. Although, the best way to become familiar with the tool is simply to play with it – select different sets of events, make menu or color changes, select regions on the map, etc.

As the deadline of GSOC has passed, I would like to announce the APKinspector Beta1.0. APKinspector is a tool to help Android application analysts and reverse engineers to analyze the compiled Android packages and their corresponding codes. You can review the Alpha version report and the page of this project to know more about it.

Click the picture below to watch a full demonstration video of APKInspector:

Chinese viewers may view the demo at: http://v.youku.com/v_show/id_XMjk3ODAwMzU2.html

Cuckoo Sandbox is a malware analysis system capable to outline the behavior of a malware during its execution. In order to generate such results, Cuckoo performs hooking of a number of selected Windows functions, intercept their calls and after storing the relevant informations and eventually performing additional actions, returns the exection to the original code.

Until now it made use of latest Microsoft Detours Express. Part of the work of this Google Summer of Code was to implement a custom hooking engine to completely replace the old one. The motivations for such change are essentially the following: - Detours implements a single and very simple inline hook, consisting of replacing the first bytes of the functions with a JMP to the new “detouring” function. Consequently it can be very easily detected by just checking for the E9 opcode as following:

The GUI tool for static analysis of Android malware is ready for an alpha release. For more details regarding this project, check here.

In the alpha release, the following features have been finished.

(1) Show the CFG (control flow graph) for a given method
(2) Show the smali codes for a given method.
(3) Show the Java codes for a given java file.
(4) Show the betecodes for a given method.
(5) Show all strings, methods and classes.
(6) Show the APK’s related information.
(7) Drag and zoom in/out the CFG.
(8) Modify the content of nodes in the CFG.

For the forthcoming midterm evaluation of Gsoc2011, I made a lot of progress with the code and now I’m about to publish the alpha release. Before the alpha release is released, I have decided to post a blog to inform everyone about the progress of project 6 (Static Analysis of Android Malware).

Our tool is written by PyQt, which is a great interface to Qt for Python. It is very easy to design the UI by Qt Designer. Qt contains lots of libraries to support pretty UI framework. What’s more, Qt supports cross platform applications.