Tyler Hudak's guest appearances

Tyler Hudak

Brakeing Down Security Podcast

ITSPmagazine

Kim Crawley

Daniel Cuthbert

Katie Moussouris

Jason Garbis

Khalilah Scott

Mick Douglas

Tracy Maleeff

Georgia Weidman

Patrick Heim

Amanda Berlin

Adam Shostack

Masha Sedova

Chris Hadnagy

Chris Sanders

Dan Borges

OwlTail

Allie Mellen

Sure, there is the cost of paying the ransom — if that is even a legal option — and then, maybe you get your data back. But what if it came with some added surprise? Or you can opt for the cost for the loss of data, systems, and revenue if you don't have a recovery plan. Easy no? No. There's much more to this story.The truth of the matter is that dealing with a ransomware event is far from simple. It potentially involves many people and firms (some of them very expensive), and it sure is not something that you can deal with over the weekend and keep rolling with business-as-usual on Monday morning.More often than not, many teams need to get brought in — internal and external — to negotiate, translate, communicate, remediate, and the list goes on and on, and with each item comes an expense. Some are tangible "easy-to-tally" figures, but some came to be much more subtle and yet still have an heavy impact to the business.Depending on how the situation is handled, this can also significantly impact how customers and partners perceive the company's ability to be honest and have integrity during a time of crisis. This can go beyond the reputational damage of being compromised to a place where real trust issues can creep in, potentially following the company.The list of costs connected with ransomware is long. So long that after we discuss them all, we had to come up with a way to prioritize some and reveal the top three.Any idea what those might be?GuestsAllie Mellen, Analyst Covering Security and Risk at Forrester Research (@hackerxbella on Twitter)Tyler Hudak, Practice Lead, Incident Response at TrustedSec (@secshoggoth on Twitter)This Episode’s SponsorsHITRUST: https://itspm.ag/itsphitwebSemperis: https://itspm.ag/semperis-1rooResourcesInspiring Twitter thread:https://twitter.com/secshoggoth/status/1389645581325320204Ransomware: Survive by Outrunning the Guy Next to You:https://go.forrester.com/blogs/ransomware-survive-by-outrunning-the-guy-next-to-you/Podcast: Understanding Response Risk Relative to Ransomware and DoT Guidelines | Don’t Pay, Can’t Pay, What Next | A Conversation With Dr. Catherine Lotrionte, Adam Hickey, And Stewart Baker: https://itsprad.io/cyber-society-412To see and hear more Redefining Security content on ITSPmagazine, visit:https://www.itspmagazine.com/redefining-securityAre you interested in sponsoring an ITSPmagazine Channel?https://www.itspmagazine.com/podcast-series-sponsorships

Sure, there is the cost of paying the ransom — if that is even a legal option — and then, maybe you get your data back. But what if it came with some added surprise? Or you can opt for the cost for the loss of data, systems, and revenue if you don't have a recovery plan. Easy no? No. There's much more to this story.The truth of the matter is that dealing with a ransomware event is far from simple. It potentially involves many people and firms (some of them very expensive), and it sure is not something that you can deal with over the weekend and keep rolling with business-as-usual on Monday morning.More often than not, many teams need to get brought in — internal and external — to negotiate, translate, communicate, remediate, and the list goes on and on, and with each item comes an expense. Some are tangible "easy-to-tally" figures, but some came to be much more subtle and yet still have an heavy impact to the business.Depending on how the situation is handled, this can also significantly impact how customers and partners perceive the company's ability to be honest and have integrity during a time of crisis. This can go beyond the reputational damage of being compromised to a place where real trust issues can creep in, potentially following the company.The list of costs connected with ransomware is long. So long that after we discuss them all, we had to come up with a way to prioritize some and reveal the top three.Any idea what those might be?Guests <a href="https://www.linkedin.com/in/hackerxbella/" rel="nofollow" target="_blank">Allie Mellen</a>, Analyst Covering Security and Risk at Forrester Research (<a href="https://twitter.com/hackerxbella" rel="nofollow" target="_blank">@hackerxbella</a> on Twitter)<a href="https://www.linkedin.com/in/tylerhudak/" rel="nofollow" target="_blank">Tyler Hudak</a>, Practice Lead, Incident Response at TrustedSec (<a href="https://twitter.com/secshoggoth" rel="nofollow" target="_blank">@secshoggoth</a> on Twitter)This Episode’s SponsorsHITRUST: <a href="https://itspm.ag/itsphitweb" rel="nofollow" target="_blank">https://itspm.ag/itsphitweb</a>Semperis: <a href="https://itspm.ag/semperis-1roo" rel="nofollow" target="_blank">https://itspm.ag/semperis-1roo</a>Resources Inspiring Twitter thread: <a href="https://twitter.com/secshoggoth/status/1389645581325320204" rel="nofollow" target="_blank">https://twitter.com/secshoggoth/status/1389645581325320204</a>Ransomware: Survive by Outrunning the Guy Next to You: <a href="https://go.forrester.com/blogs/ransomware-survive-by-outrunning-the-guy-next-to-you/" rel="nofollow" target="_blank">https://go.forrester.com/blogs/ransomware-survive-by-outrunning-the-guy-next-to-you/</a>Podcast: Understanding Response Risk Relative to Ransomware and DoT Guidelines | Don’t Pay, Can’t Pay, What Next | A Conversation With Dr. Catherine Lotrionte, Adam Hickey, And Stewart Baker: <a href="https://itsprad.io/cyber-society-412" rel="nofollow" target="_blank">https://itsprad.io/cyber-society-412</a>To see and hear more Redefining Security content on ITSPmagazine, visit: <a href="https://www.itspmagazine.com/redefining-security" rel="nofollow" target="_blank">https://www.itspmagazine.com/redefining-security</a>Are you interested in sponsoring an ITSPmagazine Channel? <a href="https://www.itspmagazine.com/podcast-series-sponsorships" rel="nofollow" target="_blank">https://www.itspmagazine.com/podcast-series-sponsorships</a>

The True Costs (Yes, Plural) Of Ransomware May Not Be So Obvious | Redefining Security With Allie Mellen And Tyler Hudak

This week, Tyler gave us a great deal of information on where to start if you wanted to become a malware researcher. He also gave us websites where you can get malware and ways to analyze it.  We asked Tyler what blue teams can do when they are infected, and he gave us some excellent advice... I also recite some prose from a classic horror author, so come for the malware, stay for the prose! :) ***NOTE: I guess now would be a good time to mention that many of the links below have unsafe software and actual malware payloads, so use with extreme caution. Especially do not download anything from these sites unless it's in a VM that is not on your companies assets.*** http://www.hopperapp.com/ - Disassemble OSA binaries http://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers - other Disassemblers http://vxheaven.org/ - Virus Heaven http://www.malwaredomainlist.com/ - Find websites serving malware http://oc.gtisc.gatech.edu:8080/ - Georgia Tech malware repository Sandboxie - http://www.sandboxie.com/ KoreLogic - http://www.korelogic.com/ (lots of great tools here) http://secshoggoth.blogspot.com/ - Tyler's Blog

This week, Tyler gave us a great deal of information on where to start if you wanted to become a malware researcher. He also gave us websites where you can get malware and ways to analyze it.  We asked Tyler what blue teams can do when they are infected, and he gave us some excellent advice... I also recite some prose from a classic horror author, so come for the malware, stay for the prose! :) ***NOTE: I guess now would be a good time to mention that many of the links below have unsafe software and actual malware payloads, so use with extreme caution. Especially do not download anything from these sites unless it's in a VM that is not on your companies assets.*** <a href="http://www.hopperapp.com/" rel="nofollow" target="_blank">http://www.hopperapp.com/</a> - Disassemble OSA binaries <a href="http://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers" rel="nofollow" target="_blank">http://en.wikibooks.org/wiki/X86_Disassembly/Disassemblers_and_Decompilers </a>- other Disassemblers <a href="http://vxheaven.org/" rel="nofollow" target="_blank">http://vxheaven.org/</a> - Virus Heaven <a href="http://www.malwaredomainlist.com/" rel="nofollow" target="_blank">http://www.malwaredomainlist.com/</a> - Find websites serving malware <a href="http://oc.gtisc.gatech.edu:8080/" rel="nofollow" target="_blank">http://oc.gtisc.gatech.edu:8080/</a> - Georgia Tech malware repository Sandboxie - <a href="http://www.sandboxie.com/" rel="nofollow" target="_blank">http://www.sandboxie.com/</a> KoreLogic - <a href="http://www.korelogic.com/" rel="nofollow" target="_blank">http://www.korelogic.com/</a> (lots of great tools here) <a href="http://secshoggoth.blogspot.com/" rel="nofollow" target="_blank">http://secshoggoth.blogspot.com/</a> - Tyler's Blog

Tyler Hudak (@secshoggoth) Discusses incident respose, and DIY malware research

Tyler Hudak (@secshoggoth) came to discuss with us the process of doing analysis on malware binaries. We talk about MASTIFF, his malware framework.  We also discuss how to gain information from malware program headers, and some software that is used to safely analyze it. Helpful Links: Ida Pro: https://www.hex-rays.com/products/ida/ Process Monitor - http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx Mastiff White Paper: http://digital-forensics.sans.org/blog/2013/05/07/mastiff-for-auto-static-malware-analysis Mastiff latest: http://sourceforge.net/projects/mastiff/files/mastiff/0.6.0/ cuckoo sandbox: www.cuckoosandbox.org Anubis: https://anubis.iseclab.org/   PE Headers: http://en.wikipedia.org/wiki/Portable_Executable ELF: http://fr.wikipedia.org/wiki/Executable_and_Linkable_Format REMnux- reverse engineering linux distro:https://remnux.org/   Inetsim: http://www.inetsim.org/     Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (incompetech.com) Licensed under Creative Commons: By Attribution 3.0http://creativecommons.org/licenses/by/3.0/

Tyler Hudak (@secshoggoth) came to discuss with us the process of doing analysis on malware binaries. We talk about MASTIFF, his malware framework.  We also discuss how to gain information from malware program headers, and some software that is used to safely analyze it. Helpful Links: Ida Pro: <a href="https://www.hex-rays.com/products/ida/" rel="nofollow" target="_blank">https://www.hex-rays.com/products/ida/</a> Process Monitor - <a href="http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx" rel="nofollow" target="_blank">http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx</a> Mastiff White Paper: <a href="http://digital-forensics.sans.org/blog/2013/05/07/mastiff-for-auto-static-malware-analysis" rel="nofollow" target="_blank">http://digital-forensics.sans.org/blog/2013/05/07/mastiff-for-auto-static-malware-analysis</a> Mastiff latest: <a href="http://sourceforge.net/projects/mastiff/files/mastiff/0.6.0/" rel="nofollow" target="_blank">http://sourceforge.net/projects/mastiff/files/mastiff/0.6.0/</a> cuckoo sandbox: <a href="http://www.cuckoosandbox.org" rel="nofollow" target="_blank">www.cuckoosandbox.org</a> Anubis: <a href="https://anubis.iseclab.org/" rel="nofollow" target="_blank">https://anubis.iseclab.org/</a> PE Headers: <a href="http://en.wikipedia.org/wiki/Portable_Executable" rel="nofollow" target="_blank">http://en.wikipedia.org/wiki/Portable_Executable</a> ELF: <a href="http://fr.wikipedia.org/wiki/Executable_and_Linkable_Format" rel="nofollow" target="_blank">http://fr.wikipedia.org/wiki/Executable_and_Linkable_Format</a> REMnux- reverse engineering linux distro:<a href="https://remnux.org/" rel="nofollow" target="_blank">https://remnux.org/</a> Inetsim: <a href="http://www.inetsim.org/" rel="nofollow" target="_blank">http://www.inetsim.org/</a> Intro "Private Eye", transition "Mining by Moonlight", and Outro "Honeybee" created by Kevin MacLeod (<a href="http://incompetech.com" rel="nofollow" target="_blank">incompetech.com</a>) Licensed under Creative Commons: By Attribution 3.0http://<a href="http://creativecommons.org/licenses/by/3.0/" rel="nofollow" target="_blank">creativecommons.org/licenses/by/3.0/</a>

Tyler Hudak discusses malware analysis