Hello and welcome to
another discussion on the
application of the minor attack
framework.
Today, we're going to be looking at
software packing.
So let's go ahead and move over to
our objectives.
So today's objectives are as
follows. We're going to describe
what software packing is,
some mitigation techniques, as
well as some detection techniques.
So what is software packing?
Well, it's definitely not the
preparation of software for shipping
to a client.
It is when a threat actor compresses
or encrypts an executable
in an attempt to change the file
signature to avoid
detection.
And so utilities used to perform.
Such actions are called
Packers', which is pretty much in
the name of the
technique. So
looking at a tool or
a set of tools here developed
by a group in Latin America,
a machete
or machete, depending on cyber
espionage toolset.
So this was developed by Spanish
speaking groups.
It is focused primarily
on Latin American countries and
allows them to collect intelligence.
And so that is the main focus of the
use of this tool set.
It is
using Python as a base.
So that is awesome.
I like Python and the downloads
are packed.
And so this is the ultimate
packer for executables,
which is a free tool.
So the great thing about being
a member of the community, that
focus is on penetration testing and
things of that nature.
It's always great to
kind of walk through these different
tools and techniques that these
apps are using
and kind of see the bits and
pieces of things that we're doing,
as well as some some areas that you
may not have considered before.
So there are a number of tools out
there that can be used for software
packing, for the modification of
a hash or a signature.
And it's not always
that you find a person that's aware
of every single tool that's out
there. So I encourage
you, especially when we're going
through some of these different tool
sets and looking at some of these
different threat groups
to look and see what their
techniques entail, what tools
they're using, and see if there's
anything there that could be
beneficial.
Now, mitigation techniques
with respect to this particular area
proscribed as heuristic based
malware detection, which focuses
on both signatures and behaviors
in this case. So.
Essentially, there's not
a way to easily just detect
this type of technique, and so what
you're going to be looking for in
this case is a software
that provides an evaluation
of behaviors on a system
that would be associated with
malicious intent.
So there are a number
of tools out there that
have these functions and features.
And so those would likely be the
ones that we would want to research
and implement to prevent
software packing.
Now, detection techniques, while
not always malicious,
because software packages can be
used for legitimate purposes,
like in a software development
organization or an organization that
actually creates software for
businesses and entities for
legitimate use.
But you can use scanning tools to
look for known software packages or
artifacts of such techniques.
Which could then be investigated
to ensure that they were legitimate
and then if they were not, you
could work to address them.
Now let's do a quick check on
learning true or false?
Software packing is a method in
which vendors pack their software
prior to shipping it to the
customer.
All right. Well, if you need some
additional time, please pass the
video.
Now, we just gave you a little
hint at the beginning of this video,
but this is a method in which threat
actors will attempt to
change the way that software looks
prior to its deployment.
So none of this particular statement
is true with respect to
the content we were looking at and
what we were discussing.
So this is a false
statement.
All right. Let's go ahead and jump
over to our summary.
So today we looked at and
discussed software pecking at eye
level. And what that is, we talked
about some mitigation techniques,
again, focusing really on signature
and heuristic based detection
and prevention methods.
And then with respect to detection
techniques, looking for
indicators that software package was
used, looking for tools.
It may have been loaded on a system
associated with software packing.
Again, this is not foolproof
and by no means if you find software
packing tools on your network, does
it mean that there was a malicious
entity there?
If you have legitimate use for
these types of tools, then
of course you would probably have
them present on your network.
So with that in mind, I want to
thank you for your time today and
I look forward to seeing you again
soon.