Sometimes as an analyst, you really need to move your items or potential malware into an environment
that really encapsulate it in such a fashion that it can't impose itself on other systems, whether
it be operations or different applications, or in general, to be able to touch other systems as a
whole.
In that process we're really referring to is sandboxing.
Sandboxing is the art of moving something, or putting a piece of software application, or even potential
malware into a position where it truly cannot communicate with the other systems or networking or utilities
on your network.
In this episode, we're going to talk and discuss about how malware can be tested and identified in
an environment where it really can't cause harm to other applications or systems as part of your network.
Sandboxing is truly the isolation of one network from another, meaning that I'm taking a environment
where I don't have internet access.
It's not connected to other, uh, other systems or network devices, it's truly isolated from the network
as a whole.
Sandboxing allows for an isolated network in order to test or to go forward, and the process of identifying
the functions or the functionality of a specific application, or even an operating system that may
have had malware introduced upon it.
And this controlled environment, we can actually test our systems or that application to figure out
how it's interacting with the other environments in which we would normally see it on.
That means that we could take a malware or a piece of application that may be infected by a malware.
We can run it through dynamic analysis and see what's going on across the board.
We can go through the processes, we can go through the environment, in which case we can identify
everything that it touches.
Along the way, we can monitor the different aspects of which that malware or that application is actually
moving forward, meaning that we can analyze everything that comes into play with.
We can identify, hey is this piece of software interacting with something?
It shouldn't be?
Is it going through in the word document when it has no process or understanding, or need to access
that specific application?
In this way, we can identify what is the malware doing on our system and how it's imposing its will
on other applications.
If it's a negative consequence, we can also look in a different environment.
How that piece of application or that piece of software is interacting on a legitimate basis.
Sometimes we want to sandbox a new patch or a new structure in such a way that we can see, hey, we
have proprietary software yet.
Microsoft just came out with a new patch.
Before we roll out that patch to all our other systems, let's see how it reacts to our system in a
sandbox environment so we can understand are we going to have repercussions by applying that patch?
This provides us a way to identify and analyze how that software is actually encoded, or how it's moving
across our entire system.
The first one I want to talk about in terms of malware analysis is actually a program or an application
called Joe Sandbox Now, Joe Sandbox is a virtual environment on the cloud, meaning that we don't have
to actually have it on our software systems.
We can go online and we can provide, uh, a piece of malware or an infected item onto their virtual
environment, and then it will go through and actually test that software for different problems.
We're going to go more in depth in this in the future episode, and really kind of show you how this
actually works.
The other one I want to talk about is Cuckoo Sandbox.
Cuckoo sandbox is a standalone environment that sandboxes itself.
This means that you have to provide that virtual environment, but you can download the software and
turn, say, an ubuntu machine into a sandbox environment where it's not touching other things, and
the software actually goes through and analyzes what it can for you so that you can identify whether
or not that PowerPoint, the Excel document, maybe that software application may have malware embedded
in it.
Now, it's not 100% guaranteed that it's going to find everything, but it does provide an environment,
which case we can go through and we can properly analyze it without the need for inducing our other
systems or applications to a potential piece of malware, we can utilize it within our store or our
scene platforms to provide a detailed and customized report to identify exactly what's going on in that
environment and our holistic and security environment.
Throughout this episode, we talked about how a sandbox environment can use not only for legitimate
processes, but also potential malware or applications.
We also identified how it could be introduced in an aspect of analysis and identification, both in
Joe Sandbox and Kiku.
With throughout your Sisa testing environment, I would expect to see a high level overview of both
sandboxes in relation to different aspects.
At a high level, they're not going to go through and ask you to go through and specifically go through
the process.
They're not going to ask you to go through and identify specific malware, but they would expect you
to understand I can use Cuckoo sandbox, or I could use Joe Sandbox.
And this is the properties, in which case I might use both, where Kiku is a standalone environment
that we're controlling, and Joe Sandbox is a virtual environment on the cloud.
It really depends on the aspects of what direction you want to go in and the process that we might want
to utilize.
For instance, Joe Sandbox is more in relation to the theoretical concepts of different operating systems.
And I can download a file or a folder that may be properly infected, a text document, and then just
upload it to the virtual environment and then ask questions about that.
It also comes into play where we're looking at specific URLs or files, where Coccoon sandbox is more
of a Linux only environment.
Yes, we can do windows environment stuff on there, but it's not going to provide us the holistic view
that we're looking for.
However, where cocoon is real, strength is within the Siem or within the Soar environment because
it's actually part of our environment as a whole, and it can grab those logs, it can grab that information
and analysis directly from our systems.
One definitely has a better property and a holistic viewpoint, i.e. where one is more of a standalone
environment, i.e. Joe Sandbox.
Expect to see questions specifically related to those two environments in which you might use in a scenario
based context, one over another.