Black Hat talk to reveal analysis of hacker fingerprints

Black Hat's most notorious incidents: a quiz

Analysis of the binaries of malware executables also reveals characteristics about the intent of the attack code that could make for more efficient and effective data defenses, says Greg Hoglund, CEO of HBGary, whose briefing "MalwareMalware Attribution: Tracking Cyber Spies and Digital Criminals" is scheduled for the Las Vegas conference. Alles zu Malware auf CIO.de

Hoglund says this analysis uncovers tool marks -- signs of the environments in which the code was written -- that can help indentify code written by a common person or group based on what combination of tools they use.

For example, his research looked under the covers of one malware executable whose fingerprint included use of Back Orifice 2000, Ultra VNC remote desktop support software, and code from a 2002 MicrosoftMicrosoft programming guide. Each program was slightly modified, but the information available amounted to a good fingerprint. Alles zu Microsoft auf CIO.de

The malware was a remote access tool (RAT), and RAT generators such as Poison Ivy could have created unique RAT code for each use, but that's not the route this attacker chose. Identifying this RAT in other instances of malware can link groups of malicious code to a common author or team, Hoglund says.