Re-invented Zeus malware Terdot, defied explanation, but cannot defeat detection

December 6, 2017



Author: Nithen Naidoo, Founder and CEO (Snode)

 

During October 2017, Snode's cybersecurity platform (Guardian) found an increasing trend in SA networks being infected by the well-known Zeus malware. Although the Zeus Trojan (discovered back in July 2007) is still considered one of the most prolific malware variants affecting the Internet today; the retro plague perplexed our analysts.

The finding’s fallacy is that most (if not all) traditional anti-malware controls today can reliably defend against the Zeus malware threat. At the time, we could not explain how a 10-year-old Trojan was (as reported by our learning machine) effortlessly propagating through large SA corporate networks; unhindered and undetected.

A fitting explanation was later provided courtesy of the global security technology firm, Bitdefender.

Bitdefender’s researchers released a paper (mid November 2017) on the discovery of a new “Zeus inspired” Trojan, called Terdot. A surprising insight from their research is that they first discovered the Trojan in October 2016; which highlights a challenge in our machine-assisted analytics.

You see, the machine-learnt Zeus malware's "pattern of behaviour" was now mimicked by Terdot. As a matter of fact, Snode's learning machine could only learn to accurately identify Terdot, by unlearning everything it knew about the Zeus malware. Hence why our learning machine is augmented by our (human) analysts as it allowed us to reliably distinguish between these two malware variants.

Now, it is not often that a cybersecurity vendor will openly discuss the flaws in their machine learning and pattern recognition software. However, at Snode we do not build software, we deliver solutions (and we value transparency). This is why our machine-assisted analytics is backed by (and never delivered without) our human intelligence.

Something to keep in mind, if you believe that AI-supported threat detection (neural network based pattern recognition) software will transcend your security posture to a cybersecurity nirvana, it won't, at least not yet. However, by enhancing your posture with such technology (defence in depth), you wont get trapped in a false sense of security, solely relying on the latest antivirus signatures to save you. Keep in mind that Terdot, was circulating in the wild for an entire year without signature-based detection.

I would like to thank and give credit to the Bitdefender Research Labs for making the Terdot discovery. For more information, you can find the full research paper here.

Previous

Why a well-designed HCI is critical to your AI driven cybersecurity solution

November 24, 2017

Author: Nithen Naidoo, Founder and CEO   Most readers of this post will know Deep Blue, the computer that beat chess champion Garry Kasparov in 1996. Since then, and more so recently, Artificial Intelligence (AI) has been an industry buzzword and “the Tao” of the future. I love everything about AI, but I believe in Intelligence Amplification (IA). IA is the synergy of human and machine (as opposed to the substitution), augmenting our capabilities (not replacing them). So, why do I think IA is better? Let’s begin with a lesser known story, about a lesser known chess competition. Eight years after Deep Blue, Kasparov competed in another chess competition which allowed humans to pair up with computers. Naturally, you would expect the best human-computer duo to dominate. Actually, amateur chess players with suboptimal computing platforms won. The upset was credited to a well-designed interface between a well-trained human and a data-rich computing platform. So, having a data-rich platform with effective AI capability is important – but meaningless, if you (the analyst) can’t rapidly navigate, correlate, contextualise and gain insight from your data. Hence, we developed Snode’s cybersecurity solution with - data fusion at scale and machine-assisted analytics. However, more importantly, we designed a frictionless Human-Computer-Interface (HCI) - prioritising, maximising and galvanising the synergy between human and machine.

Next

Young Minds Prepare For #SS18 Hack

April 21, 2018

Author: Alastair Waldeck, Head of Marketing (Snode)   A group of motivated young men and women gathered in the offices of The Business Clinic in Johannesburg CBD early on Saturday morning for the 2nd Annual #SS18Hack Ideathon. The Ideathon provided these aspiring cybersecurity and IT professionals with an opportunity to meet and greet with some of the top minds in the industry as well as to learn a thing or two from the four main workshops presented on the day. The Ideathon serves as pre-selection event for the larger, main event; the #SS18 Hackathon which will be held at Vodaworld in Midrand on the 22-23 May. The day began with an introduction from Mr Lucky Litelu (Executive Chairman and CEO of ICRD GROUP) and the sponsorship team of Tiyani Ngonyama (COO, Geekulcha), Allyson Towle (Senior Conference Director, ITWeb Events) and Alastair Waldeck (Head of Marketing, Snode). Our first speaker of the day was Ridewaan Hanslo from the CSIR who gave the attendees a comprehensive overview of Web App Security by providing several examples of different types of attacks, attackers, interactive examples how to practically identify and prevent these attacks as well as how to ensure that your next application is created with security as a priority. Second up was our very own Founder and CEO, Nithen Naidoo. He provided an introduction to the AI and Infosec industry by discussing the latest tools and methods within the cybersecurity and data analytics industry as well as how to analyse vast quantities of data in real-time in order to pull various insights, detect anomalies and trends and to be able to predict and defend against ever-evolving cyberattacks. After a quick break where the guys were able to refuel, get to know one another, ask questions and discuss ideas with the presenters, sponsors and other attendees, we returned to our seats for the 3rd workshop of the day. Francois Mouton from the CSIR was up next. Francois gave us a presentation on Ethical Hacking with a focus on his speciality, social engineering. By providing us with some simple, everyday examples of how human’s inherent trust can be our own downfall, he made us realise how simple a cyberattack can really be and how our perception of a cybercriminal being a person in a hoodie hiding behind a laptop is far from the truth. Last, but certainly not least, Kimoon Kim from Siatik spoke us through the concepts of Big Data and Machine Learning. By focusing on powerful platforms that are readily available for us to use such as Google Cloud and BigQuery, the attendees discovered how to easily analyse all their data, regardless of size, in real-time. The rest of the day was spent brainstorming ideas, absorbing even more information and inspiration from the mentors and speakers, and coming up with ideas that will not only take them through to the next round in Midrand, but also to potentially win them top spot at the #SS18 Hackathon later next month! The top three teams with the ideas that showed most potential were: - Bro-Coders - CleverKleva - TechnoGeeks - A special mention went to team Nosey. We look forward to seeing everyone again in a month’s time and would like to thank all the sponsors and speakers for their involvement in making this event successful!   Sponsors for the event: Snode, ITWeb, Geekulcha, The Business Clinic, Northern Cape Department of Economic Development and Tourism.