Dynamic Spyware Analysis
|
|
|
- Rhoda Harrison
- 8 years ago
- Views:
Transcription
1 Dynamic Spyware Analysis M. Egele 1 & C. Kruegel 1 & E. Kirda 1 & H. Yin 2,3 & D. Song 2 1 Secure Systems Lab Vienna University of Technology 2 Carnegie Mellon University 3 College of William and Mary USENIX Annual Technical Conference, June 21, 2007
2 spyware - a threat to internet users Spyware is malware that is installed on a computer to monitor user actions Spyware is an important threat to the security and privacy of Internet users An analysis by Webroot and Earthlink showed that a large portion of Internet-connected computers are infected with spyware Spyware also degrades performance and causes unexpected side-effects BHOs are a very popular kind of spyware (Weng et al, 90 of 120 spyware samples use BHO architecture)
3 spyware - a threat to internet users Spyware is malware that is installed on a computer to monitor user actions Spyware is an important threat to the security and privacy of Internet users An analysis by Webroot and Earthlink showed that a large portion of Internet-connected computers are infected with spyware Spyware also degrades performance and causes unexpected side-effects BHOs are a very popular kind of spyware (Weng et al, 90 of 120 spyware samples use BHO architecture)
4 spyware - a threat to internet users Spyware is malware that is installed on a computer to monitor user actions Spyware is an important threat to the security and privacy of Internet users An analysis by Webroot and Earthlink showed that a large portion of Internet-connected computers are infected with spyware Spyware also degrades performance and causes unexpected side-effects BHOs are a very popular kind of spyware (Weng et al, 90 of 120 spyware samples use BHO architecture)
5 spyware - a threat to internet users Spyware is malware that is installed on a computer to monitor user actions Spyware is an important threat to the security and privacy of Internet users An analysis by Webroot and Earthlink showed that a large portion of Internet-connected computers are infected with spyware Spyware also degrades performance and causes unexpected side-effects BHOs are a very popular kind of spyware (Weng et al, 90 of 120 spyware samples use BHO architecture)
6 spyware - a threat to internet users Spyware is malware that is installed on a computer to monitor user actions Spyware is an important threat to the security and privacy of Internet users An analysis by Webroot and Earthlink showed that a large portion of Internet-connected computers are infected with spyware Spyware also degrades performance and causes unexpected side-effects BHOs are a very popular kind of spyware (Weng et al, 90 of 120 spyware samples use BHO architecture)
7 drawbacks of existing signature-based tools A number of signature-based anti-spyware products exist that share some drawbacks of that approach Unable to detect previously unknown threats Need continuous signature updates Often require human analysis before creating signatures
8 drawbacks of existing signature-based tools A number of signature-based anti-spyware products exist that share some drawbacks of that approach Unable to detect previously unknown threats Need continuous signature updates Often require human analysis before creating signatures
9 drawbacks of existing signature-based tools A number of signature-based anti-spyware products exist that share some drawbacks of that approach Unable to detect previously unknown threats Need continuous signature updates Often require human analysis before creating signatures
10 behavior-based detection To overcome the shortcomings of signature-based detectors We implemented a behavioral-based detection technique That classifies a program as spyware if 1 It monitors user behavior 2 And then leaks the gathered information to a third party (the attacker)
11 behavior-based detection To overcome the shortcomings of signature-based detectors We implemented a behavioral-based detection technique That classifies a program as spyware if 1 It monitors user behavior 2 And then leaks the gathered information to a third party (the attacker)
12 behavior-based detection To overcome the shortcomings of signature-based detectors We implemented a behavioral-based detection technique That classifies a program as spyware if 1 It monitors user behavior 2 And then leaks the gathered information to a third party (the attacker)
13 behavior-based detection To overcome the shortcomings of signature-based detectors We implemented a behavioral-based detection technique That classifies a program as spyware if 1 It monitors user behavior 2 And then leaks the gathered information to a third party (the attacker)
14 our approach Focus of analysis on BHOs We use dynamic analysis to monitor BHO for presence of malicious behavior Two challenges need to be solved 1 Track the flow of sensitive data throughout the system 2 Observe what actions are performed by the BHO under analysis
15 our approach Focus of analysis on BHOs We use dynamic analysis to monitor BHO for presence of malicious behavior Two challenges need to be solved 1 Track the flow of sensitive data throughout the system 2 Observe what actions are performed by the BHO under analysis
16 our approach Focus of analysis on BHOs We use dynamic analysis to monitor BHO for presence of malicious behavior Two challenges need to be solved 1 Track the flow of sensitive data throughout the system 2 Observe what actions are performed by the BHO under analysis
17 our approach Focus of analysis on BHOs We use dynamic analysis to monitor BHO for presence of malicious behavior Two challenges need to be solved 1 Track the flow of sensitive data throughout the system 2 Observe what actions are performed by the BHO under analysis
18 our approach Focus of analysis on BHOs We use dynamic analysis to monitor BHO for presence of malicious behavior Two challenges need to be solved 1 Track the flow of sensitive data throughout the system 2 Observe what actions are performed by the BHO under analysis
19 our approach Our solution features three key components 1 URLs and page contents considered to contain sensitive information 2 The propagation of this data throughout the system is observed by taint tracking 3 By monitoring system calls, attempts of leaking sensitive information can be identified
20 our approach Our solution features three key components 1 URLs and page contents considered to contain sensitive information 2 The propagation of this data throughout the system is observed by taint tracking 3 By monitoring system calls, attempts of leaking sensitive information can be identified
21 our approach Our solution features three key components 1 URLs and page contents considered to contain sensitive information 2 The propagation of this data throughout the system is observed by taint tracking 3 By monitoring system calls, attempts of leaking sensitive information can be identified
22 analysis output The system classifies BHOs as spyware or legitimate software. Additionally comprehensive reports File actions Network actions Interprocess communication Operating system actions Enrich the reports with more details when sensitive data is involved
23 analysis output The system classifies BHOs as spyware or legitimate software. Additionally comprehensive reports File actions Network actions Interprocess communication Operating system actions Enrich the reports with more details when sensitive data is involved
24 analysis output The system classifies BHOs as spyware or legitimate software. Additionally comprehensive reports File actions Network actions Interprocess communication Operating system actions Enrich the reports with more details when sensitive data is involved
25 analysis output The system classifies BHOs as spyware or legitimate software. Additionally comprehensive reports File actions Network actions Interprocess communication Operating system actions Enrich the reports with more details when sensitive data is involved
26 analysis output The system classifies BHOs as spyware or legitimate software. Additionally comprehensive reports File actions Network actions Interprocess communication Operating system actions Enrich the reports with more details when sensitive data is involved
27 system overview Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing
28 system overview Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing
29 system overview Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing
30 system overview Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing
31 system overview Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing
32 system overview Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing
33 qemu x86 system emulator The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Qemu was enhanced to perform additional tasks Perform taint tracking operations Provide hooking capabilities for system / function calls Monitoring capabilities for system actions
34 qemu x86 system emulator The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Qemu was enhanced to perform additional tasks Perform taint tracking operations Provide hooking capabilities for system / function calls Monitoring capabilities for system actions
35 qemu x86 system emulator The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Qemu was enhanced to perform additional tasks Perform taint tracking operations Provide hooking capabilities for system / function calls Monitoring capabilities for system actions
36 taint tracking Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Tainting allows to tag data elements of interest and track their propagation throughout the system. Our system covers Data dependencies (mov %eax, %ebx) Address dependencies (mov %eax, (%ebx, 2, 1)) Control dependencies (if (x == a ) {y = a }) Untainting with simple constant functions (xor %eax, %eax)
37 taint tracking Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Tainting allows to tag data elements of interest and track their propagation throughout the system. Our system covers Data dependencies (mov %eax, %ebx) Address dependencies (mov %eax, (%ebx, 2, 1)) Control dependencies (if (x == a ) {y = a }) Untainting with simple constant functions (xor %eax, %eax)
38 taint tracking Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Tainting allows to tag data elements of interest and track their propagation throughout the system. Our system covers Data dependencies (mov %eax, %ebx) Address dependencies (mov %eax, (%ebx, 2, 1)) Control dependencies (if (x == a ) {y = a }) Untainting with simple constant functions (xor %eax, %eax)
39 taint tracking Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Tainting allows to tag data elements of interest and track their propagation throughout the system. Our system covers Data dependencies (mov %eax, %ebx) Address dependencies (mov %eax, (%ebx, 2, 1)) Control dependencies (if (x == a ) {y = a }) Untainting with simple constant functions (xor %eax, %eax)
40 control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing While data and address dependencies can be handled on a per instruction basis, control dependencies cannot. Instead Whenever a branch depends on tainted data, the scope for this branch is calculated (static analysis) In this scope, targets of all write operations are tainted (independent of taint status of operands) After scope ends, normal taint operations resume It is possible that independent variables become tainted, but no false positives were observed in our experiments
41 control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing While data and address dependencies can be handled on a per instruction basis, control dependencies cannot. Instead Whenever a branch depends on tainted data, the scope for this branch is calculated (static analysis) In this scope, targets of all write operations are tainted (independent of taint status of operands) After scope ends, normal taint operations resume It is possible that independent variables become tainted, but no false positives were observed in our experiments
42 control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing While data and address dependencies can be handled on a per instruction basis, control dependencies cannot. Instead Whenever a branch depends on tainted data, the scope for this branch is calculated (static analysis) In this scope, targets of all write operations are tainted (independent of taint status of operands) After scope ends, normal taint operations resume It is possible that independent variables become tainted, but no false positives were observed in our experiments
43 control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing While data and address dependencies can be handled on a per instruction basis, control dependencies cannot. Instead Whenever a branch depends on tainted data, the scope for this branch is calculated (static analysis) In this scope, targets of all write operations are tainted (independent of taint status of operands) After scope ends, normal taint operations resume It is possible that independent variables become tainted, but no false positives were observed in our experiments
44 cover control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Assume variable t is tainted
45 cover control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Assume variable t is tainted
46 cover control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Assume variable t is tainted
47 cover control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Assume variable t is tainted
48 cover control dependencies The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Assume variable t is tainted
49 bridging the semantic gap The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Some key tasks have to be performed to connect operating system information with hardware level taint information Identify the currently executing task/thread Check if the current instruction is executed in the context of the BHO Monitor operating system actions (task/thread switches) and system calls (creation of new processes,... )
50 bridging the semantic gap The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Some key tasks have to be performed to connect operating system information with hardware level taint information Identify the currently executing task/thread Check if the current instruction is executed in the context of the BHO Monitor operating system actions (task/thread switches) and system calls (creation of new processes,... )
51 bridging the semantic gap The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Some key tasks have to be performed to connect operating system information with hardware level taint information Identify the currently executing task/thread Check if the current instruction is executed in the context of the BHO Monitor operating system actions (task/thread switches) and system calls (creation of new processes,... )
52 taint sources Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing A taint source defines a portion of data that is sensitive. Two taint sources have been implemented so far The URL that is loaded by the Internet Explorer (IWebBrowser2::Navigate()) Contents of network packages received by the Internet Explorer over TCP connections (NtDeviceIoControlFile)
53 taint sources Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing A taint source defines a portion of data that is sensitive. Two taint sources have been implemented so far The URL that is loaded by the Internet Explorer (IWebBrowser2::Navigate()) Contents of network packages received by the Internet Explorer over TCP connections (NtDeviceIoControlFile)
54 taint sinks Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Taint sinks are parts of the system that are of interest when receiving tainted data. So far, we have taint sinks for the following actions Writing to a file (including memory mapped files) Writing to the registry Writing to network sockets (tcp/udp) Writing to shared memory regions (i.e., for interprocess communication) Certain asm instructions (i.e., (string-)compares)
55 taint sinks Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Taint sinks are parts of the system that are of interest when receiving tainted data. So far, we have taint sinks for the following actions Writing to a file (including memory mapped files) Writing to the registry Writing to network sockets (tcp/udp) Writing to shared memory regions (i.e., for interprocess communication) Certain asm instructions (i.e., (string-)compares)
56 taint sinks Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Taint sinks are parts of the system that are of interest when receiving tainted data. So far, we have taint sinks for the following actions Writing to a file (including memory mapped files) Writing to the registry Writing to network sockets (tcp/udp) Writing to shared memory regions (i.e., for interprocess communication) Certain asm instructions (i.e., (string-)compares)
57 taint sinks Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Taint sinks are parts of the system that are of interest when receiving tainted data. So far, we have taint sinks for the following actions Writing to a file (including memory mapped files) Writing to the registry Writing to network sockets (tcp/udp) Writing to shared memory regions (i.e., for interprocess communication) Certain asm instructions (i.e., (string-)compares)
58 taint sinks Motivation The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing Taint sinks are parts of the system that are of interest when receiving tainted data. So far, we have taint sinks for the following actions Writing to a file (including memory mapped files) Writing to the registry Writing to network sockets (tcp/udp) Writing to shared memory regions (i.e., for interprocess communication) Certain asm instructions (i.e., (string-)compares)
59 automated analysis of BHOs The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing For batch-analysis of multiple BHOs we implemented an automated testing tool First, the browser session of a user is captured (different kinds of web-sites are visited) For every BHO in the batch, replay the captured session and perform the analysis
60 automated analysis of BHOs The Big Picture Modified Qemu Emulator Dynamic Taint Propagation The Problem with Control Dependencies Bridging the Semantic Gap Taint Sources Taint Sinks Automated Browser Testing For batch-analysis of multiple BHOs we implemented an automated testing tool First, the browser session of a user is captured (different kinds of web-sites are visited) For every BHO in the batch, replay the captured session and perform the analysis
61 in Numbers Detailed Results the bare numbers Results for analysis Spyware False Negative Benign Suspicious False Positive Total Spyware Benign Different mechanisms used by spyware to leak sensitive data Network File System Registry Shared Memory Total Automated crawling and analysis ongoing (millions of URLs, hundreds of samples)
62 in Numbers Detailed Results the bare numbers Results for analysis Spyware False Negative Benign Suspicious False Positive Total Spyware Benign Different mechanisms used by spyware to leak sensitive data Network File System Registry Shared Memory Total Automated crawling and analysis ongoing (millions of URLs, hundreds of samples)
63 in Numbers Detailed Results the bare numbers Results for analysis Spyware False Negative Benign Suspicious False Positive Total Spyware Benign Different mechanisms used by spyware to leak sensitive data Network File System Registry Shared Memory Total Automated crawling and analysis ongoing (millions of URLs, hundreds of samples)
64 in Numbers Detailed Results the bare numbers Results for analysis Spyware False Negative Benign Suspicious False Positive Total Spyware Benign Different mechanisms used by spyware to leak sensitive data Network File System Registry Shared Memory Total Automated crawling and analysis ongoing (millions of URLs, hundreds of samples)
65 in Numbers Detailed Results details on false positive and suspicious samples One false positive: PrivacyBird request the w3c/p3p.xml document from same server One suspicious sample: LostGoggles request JavaScript file with referrer set to the visited URL
66 in Numbers Detailed Results details on false positive and suspicious samples One false positive: PrivacyBird request the w3c/p3p.xml document from same server One suspicious sample: LostGoggles request JavaScript file with referrer set to the visited URL
67 in Numbers Detailed Results details on spyware samples zangohook.dll reads the current URL and copies it to a shared memory that is then read by Zango.exe companion process e2give reads the URL of every site and compares it to a list (automatically detected) of URLs stored in the BHO; upon a match, the request is redirected to a different server with the original URL as a parameter stup.dll submits the URLs of all visited pages to a remote server. This BHO is not detected by the latest versions (at the time of writing) of AdAware or SpyBot.
68 in Numbers Detailed Results details on spyware samples zangohook.dll reads the current URL and copies it to a shared memory that is then read by Zango.exe companion process e2give reads the URL of every site and compares it to a list (automatically detected) of URLs stored in the BHO; upon a match, the request is redirected to a different server with the original URL as a parameter stup.dll submits the URLs of all visited pages to a remote server. This BHO is not detected by the latest versions (at the time of writing) of AdAware or SpyBot.
69 in Numbers Detailed Results details on spyware samples zangohook.dll reads the current URL and copies it to a shared memory that is then read by Zango.exe companion process e2give reads the URL of every site and compares it to a list (automatically detected) of URLs stored in the BHO; upon a match, the request is redirected to a different server with the original URL as a parameter stup.dll submits the URLs of all visited pages to a remote server. This BHO is not detected by the latest versions (at the time of writing) of AdAware or SpyBot.
70 in Numbers Detailed Results summary Taint-tracking-based, behavioral spyware analysis Focus is on BHOs Covers data-, address-, and control dependencies Able to detect previously unknown spyware instances
71 in Numbers Detailed Results summary Taint-tracking-based, behavioral spyware analysis Focus is on BHOs Covers data-, address-, and control dependencies Able to detect previously unknown spyware instances
72 in Numbers Detailed Results summary Taint-tracking-based, behavioral spyware analysis Focus is on BHOs Covers data-, address-, and control dependencies Able to detect previously unknown spyware instances
73 in Numbers Detailed Results summary Taint-tracking-based, behavioral spyware analysis Focus is on BHOs Covers data-, address-, and control dependencies Able to detect previously unknown spyware instances
74 in Numbers Detailed Results Thank You Questions?
Dynamic Spyware Analysis
Dynamic Spyware Analysis Manuel Egele, Christopher Kruegel, Engin Kirda Secure Systems Lab Technical University Vienna {pizzaman,chris,ek}@seclab.tuwien.ac.at Heng Yin Carnegie Mellon University and College
Dynamic Spyware Analysis
Dynamic Spyware Analysis Manuel Egele, Christopher Kruegel, Engin Kirda, Heng Yin, and Dawn Song Secure Systems Lab Technical University Vienna {pizzaman,chris,ek}@seclab.tuwien.ac.at Carnegie Mellon University
Automated Spyware Collection and Analysis
Automated Spyware Collection and Analysis Andreas Stamminger, Christopher Kruegel, Giovanni Vigna 1 and Engin Kirda 2 1 University of California, Santa Barbara {as,chris,vigna}@cs.ucsb.edu 2 Institut Eurecom,
Host-based Intrusion Prevention System (HIPS)
Host-based Intrusion Prevention System (HIPS) White Paper Document Version ( esnhips 14.0.0.1) Creation Date: 6 th Feb, 2013 Host-based Intrusion Prevention System (HIPS) Few years back, it was relatively
Behavior-based Spyware Detection
Behavior-based Spyware Detection Engin Kirda and Christopher Kruegel Secure Systems Lab Technical University Vienna {ek,chris}@seclab.tuwien.ac.at Greg Banks, Giovanni Vigna, and Richard A. Kemmerer Department
Guideline for Prevention of Spyware and other Potentially Unwanted Software
Guideline for Prevention of Spyware and other Potentially Unwanted Software Introduction Most users are aware of the impact of virus/worm and therefore they have taken measures to protect their computers,
Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis
Panorama: Capturing System-wide Information Flow for Malware Detection and Analysis Heng Yin hyin@ece.cmu.edu Dawn Song dawnsong@cs.berkeley.edu Manuel Egele, Christopher Kruegel, and Engin Kirda {pizzaman,
Automated Spyware Collection and Analysis
Automated Spyware Collection and Analysis Andreas Stamminger 1, Christopher Kruegel 1, Giovanni Vigna 1, and Engin Kirda 2 1 University of California, Santa Barbara {as,chris,vigna}@cs.ucsb.edu 2 Institut
LASTLINE WHITEPAPER. In-Depth Analysis of Malware
LASTLINE WHITEPAPER In-Depth Analysis of Malware Abstract Malware analysis is the process of determining the purpose and functionality of a given malware sample (such as a virus, worm, or Trojan horse).
Business ebanking Fraud Prevention Best Practices
Business ebanking Fraud Prevention Best Practices User ID and Password Guidelines Create a strong password with at least 8 characters that includes a combination of mixed case letters, numbers, and special
Kaspersky Fraud Prevention: a Comprehensive Protection Solution for Online and Mobile Banking
Kaspersky Fraud Prevention: a Comprehensive Protection Solution for Online and Mobile Banking Today s bank customers can perform most of their financial activities online. According to a global survey
A Survey on Automated Dynamic Malware Analysis Techniques and Tools
A Survey on Automated Dynamic Malware Analysis Techniques and Tools MANUEL EGELE Vienna University of Technology THEODOOR SCHOLTE SAP Research, Sophia Antipolis ENGIN KIRDA Institute Eurecom, Sophia Antipolis
Application of Data Mining based Malicious Code Detection Techniques for Detecting new Spyware
Application of Data Mining based Malicious Code Detection Techniques for Detecting new Spyware Cumhur Doruk Bozagac Bilkent University, Computer Science and Engineering Department, 06532 Ankara, Turkey
LASTLINE WHITEPAPER. The Holy Grail: Automatically Identifying Command and Control Connections from Bot Traffic
LASTLINE WHITEPAPER The Holy Grail: Automatically Identifying Command and Control Connections from Bot Traffic Abstract A distinguishing characteristic of bots is their ability to establish a command and
COMPUTER-INTERNET SECURITY. How am I vulnerable?
COMPUTER-INTERNET SECURITY How am I vulnerable? 1 COMPUTER-INTERNET SECURITY Virus Worm Trojan Spyware Adware Messenger Service 2 VIRUS A computer virus is a small program written to alter the way a computer
Business Internet Banking / Cash Management Fraud Prevention Best Practices
Business Internet Banking / Cash Management Fraud Prevention Best Practices This document provides fraud prevention best practices that can be used as a training tool to educate new Users within your organization
CS 558 Internet Systems and Technologies
CS 558 Internet Systems and Technologies Dimitris Deyannis deyannis@csd.uoc.gr 881 Heat seeking Honeypots: Design and Experience Abstract Compromised Web servers are used to perform many malicious activities.
Full System Emulation:
Full System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware Christopher Kruegel Lastline, Inc. chris@lastline.com 1 Introduction Automated malware analysis systems (or sandboxes)
How Spyware and Anti-Spyware Work
22 PART 1 INTERNET SECURITY CHAPTER 3 How Spyware and Anti-Spyware Work 23 THESE days, the biggest danger you face when you go onto the Internet might be spyware a type of malicious software that can invade
LASTLINE WHITEPAPER. Why Anti-Virus Solutions Based on Static Signatures Are Easy to Evade
LASTLINE WHITEPAPER Why Anti-Virus Solutions Based on Static Signatures Are Easy to Evade Abstract Malicious code is an increasingly important problem that threatens the security of computer systems. The
Understanding Computer Viruses: What They Can Do, Why People Write Them and How to Defend Against Them
Lab Exercises Understanding Computer Viruses: What They Can Do, Why People Write Them and How to Defend Against Them Review Questions 1) In class, we made the distinction between a front-door attack and
4 Steps to Effective Mobile Application Security
Mobile Application Security Whitepaper 4 Steps to Effective Mobile Application Security Table of Contents Executive Summary 3 Mobile Security Risks in Enterprise Environments 4 The Shortcomings of Traditional
Reliance Bank Fraud Prevention Best Practices
Reliance Bank Fraud Prevention Best Practices May 2013 User ID and Password Guidelines Create a strong password with at least 8 characters that includes a combination of mixed case letters and numbers.
LASTLINE WHITEPAPER. Large-Scale Detection of Malicious Web Pages
LASTLINE WHITEPAPER Large-Scale Detection of Malicious Web Pages Abstract Malicious web pages that host drive-by-download exploits have become a popular means for compromising hosts on the Internet and,
Countermeasures against Bots
Countermeasures against Bots Are you sure your computer is not infected with Bot? Information-technology Promotion Agency IT Security Center http://www.ipa.go.jp/security/ 1. What is a Bot? Bot is a computer
Spyware Doctor Enterprise Technical Data Sheet
Spyware Doctor Enterprise Technical Data Sheet The Best of Breed Anti-Spyware Solution for Businesses Spyware Doctor Enterprise builds on the strength of the industry-leading and multi award-winning Spyware
Online Banking Fraud Prevention Recommendations and Best Practices
Online Banking Fraud Prevention Recommendations and Best Practices This document provides you with fraud prevention best practices that every employee at Continental National Bank of Miami needs to know
NTT R&D s anti-malware technologies
NTT R&D s anti-malware technologies Jan. 21, 2015 NTT Secure Platform Laboratories Takeo HARIU Threats causes most of cyber attacks Major infection routes are web browsing, URL links in email messages,
Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities
Towards Automated Malware Behavioral Analysis and Profiling for Digital Forensic Investigation Purposes
Towards Automated Malware Behavioral Analysis and Profiling for Digital Forensic Investigation Purposes Ahmed F.Shosha, Joshua I. James, Alan Hannaway, Chen-Ching Liu and Pavel Gladyshev UCD School of
When you listen to the news, you hear about many different forms of computer infection(s). The most common are:
Access to information and entertainment, credit and financial services, products from every corner of the world even to your work is greater than ever. Thanks to the Internet, you can conduct your banking,
Spyware Analysis. jan.monsch@csnc.ch. Security Event - April 28, 2004 Page 1
Spyware Analysis jan.monsch@csnc.ch Security Event - April 28, 2004 Page 1 Content Definition & types of spyware Statistics Hooks Static vs. dynamic software analysis Test environment for spyware Analysis
How to Deal with Spyware A CyberAngels Quick Tutorial
How to Deal with Spyware A CyberAngels Quick Tutorial Adapted from the US Computer Emergency Readiness Team Spyware and Adware After completing this tutorial, you will be able to: Identify the main risks
WildFire Overview. WildFire Administrator s Guide 1. Copyright 2007-2015 Palo Alto Networks
WildFire Overview WildFire provides detection and prevention of zero-day malware using a combination of malware sandboxing and signature-based detection and blocking of malware. WildFire extends the capabilities
Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 6 Network Security
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 6 Network Security Objectives List the different types of network security devices and explain how they can be used Define network
Detecting the One Percent: Advanced Targeted Malware Detection
Detecting the One Percent: Advanced Targeted Malware Detection Tomer Teller Check Point Software Technologies Session ID: SP02-T19 Session Classification: Intermediate Antivirus 20 th+ Anniversary The
Spyware Linkages to Malware and its Affects A Multi-Layered Approach to Stopping Information Theft
Spyware Linkages to Malware and its Affects A Multi-Layered Approach to Stopping Information Theft Kim Duffy Internet Security Systems Agenda What are the trends? Why should I be concerned? How does Spyware
Behavior-Based Spyware Detection
Behavior-Based Spyware Detection State of the Field Ryan Mord Saint John s University Student Ryan Mord Advisor Dr. Michael Heroux Year 2014 CONTENTS I Abstract 2 II Introduction 3 III Spyware 3 IV Signature
Content Security Gateway Series Real-time Gateway Web Security Against Spyware and Viruses
Content Security Gateway Series Real-time Gateway Web Security Against Spyware and Viruses 1. Why do I need a Web security or gateway anti-spyware solution? Malware attack vector is rapidly shifting from
Uncover security risks on your enterprise network
Uncover security risks on your enterprise network Sign up for Check Point s on-site Security Checkup. About this presentation: The key message of this presentation is that organizations should sign up
WildFire. Preparing for Modern Network Attacks
WildFire WildFire automatically protects your networks from new and customized malware across a wide range of applications, including malware hidden within SSL-encrypted traffic. WildFire easily extends
PROTECT YOUR COMPUTER AND YOUR PRIVACY!
PROTECT YOUR COMPUTER AND YOUR PRIVACY! Fraud comes in many shapes simple: the loss of both money protecting your computer and Take action and get peace of and sizes, but the outcome is and time. That
A Crawler-based Study of Spyware in the Web. Alex Moshchuk, Tanya Bragin, Steve Gribble, Hank Levy
A Crawler-based Study of Spyware in the Web Alex Moshchuk, Tanya Bragin, Steve Gribble, Hank Levy What is spyware? Broad class of malicious and unwanted software Steal control of a PC for the benefit of
Putting Web Threat Protection and Content Filtering in the Cloud
Putting Web Threat Protection and Content Filtering in the Cloud Why secure web gateways belong in the cloud and not on appliances Contents The Cloud Can Lower Costs Can It Improve Security Too?. 1 The
Taxonomy of Hybrid Honeypots
2011 International Conference on Network and Electronics Engineering IPCSIT vol.11 (2011) (2011) IACSIT Press, Singapore Taxonomy of Hybrid Honeypots Hamid Mohammadzadeh.e.n 1, Masood Mansoori 2 and Roza
Index Terms: Smart phones, Malwares, security, permission violation, malware detection, mobile devices, Android, security
Permission Based Malware Detection Approach Using Naive Bayes Classifier Technique For Android Devices. Pranay Kshirsagar, Pramod Mali, Hrishikesh Bidwe. Department Of Information Technology G. S. Moze
How To Understand What A Virus Is And How To Protect Yourself From A Virus
Viruses, Trojans and Worms Oh My! 2006 Technology Leadership Presentation Series Why is my computer running so slow? What are all of these little windows popping up on my system? Why did my home page change?
Symantec's Secret Sauce for Mobile Threat Protection. Jon Dreyfus, Ellen Linardi, Matthew Yeo
Symantec's Secret Sauce for Mobile Threat Protection Jon Dreyfus, Ellen Linardi, Matthew Yeo 1 Agenda 1 2 3 4 Threat landscape and Mobile Insight overview What s unique about Mobile Insight Mobile Insight
Protecting Organizations from Spyware
A Websense White Paper Protecting Organizations from Spyware Abstract: Once considered only an annoyance, spyware has evolved from a nuisance to a malicious threat. Preventing spyware from infiltrating
CAS : A FRAMEWORK OF ONLINE DETECTING ADVANCE MALWARE FAMILIES FOR CLOUD-BASED SECURITY
CAS : A FRAMEWORK OF ONLINE DETECTING ADVANCE MALWARE FAMILIES FOR CLOUD-BASED SECURITY ABHILASH SREERAMANENI DEPARTMENT OF COMPUTER SCIENCE AND ENGINEERING SEOUL NATIONAL UNIVERSITY OF SCIENCE AND TECHNOLOGY
Ohio University Computer Services Center October, 2004 Spyware, Adware, and Virus Guide
Ohio University Computer Services Center October, 2004 Spyware, Adware, and Virus Guide Definitions Malware is term meaning malicious software. Malware is software designed to disrupt a computer system.
Scui.Int.(Lahore),26(5),2071-2076,2014 ISSN 1013-5316; CODEN: SINTE 8 2071
Scui.Int.(Lahore),26(5),2071-2076,2014 ISSN 1013-5316; CODEN: SINTE 8 2071 ASSESSMENT OF ANTI SPYWARE TOOLS FOR SIGNATURE AND BEHAVIOR BASE TECHNIQUES Nabeel Alam Khattak 1, Dave Chadwick 2, Riaz Ahmed
Mobile App Reputation
Mobile App Reputation A Webroot Security Intelligence Service Timur Kovalev and Darren Niller April 2013 2012 Webroot Inc. All rights reserved. Contents Rise of the Malicious App Machine... 3 Webroot App
ENABLING FAST RESPONSES THREAT MONITORING
ENABLING FAST RESPONSES TO Security INCIDENTS WITH THREAT MONITORING Executive Summary As threats evolve and the effectiveness of signaturebased web security declines, IT departments need to play a bigger,
Fighting Advanced Threats
Fighting Advanced Threats With FortiOS 5 Introduction In recent years, cybercriminals have repeatedly demonstrated the ability to circumvent network security and cause significant damages to enterprises.
Cisco ASA 5500 Series Content Security Edition for the Enterprise
Cisco ASA 5500 Series Content Security Edition for the Enterprise Viruses and other malicious code can overwhelm your IT resources, disrupting business operations and impacting business transactions. The
Anti-Phishing Security Strategy. Angelo P. E. Rosiello
Anti-Phishing Security Strategy Angelo P. E. Rosiello Agenda 1. Brief introduction to phishing 2. Strategic defense techniques 3. A new client based solution: DOMAntiPhish 4. Conclusions Nature of Phishing
Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis
Polyglot: Automatic Extraction of Protocol Message Format using Dynamic Binary Analysis Juan Caballero, Heng Yin, Zhenkai Liang Carnegie Mellon University Dawn Song Carnegie Mellon University & UC Berkeley
Ten Tips to Avoid Viruses and Spyware
Ten Tips to Avoid Viruses and Spyware By James Wilson, CPA (480) 839-4900 ~ JamesW@hhcpa.com Oh, the deck is stacked. Don t think for a minute it s not. As a technology professional responsible for securing
EU FP6 LOBSTER. personal view on the future of ero-day Worm Containment. European Infrastructure for accurate network monitoring
EU FP6 LOBSTER European Infrastructure for accurate network monitoring personal view on the future of ero-day Worm Containment Herbert Bos Vrije Universiteit Amsterdam herbertb _AT_ cs.vu.nl 1 What is
Advancements in Botnet Attacks and Malware Distribution
Advancements in Botnet Attacks and Malware Distribution HOPE Conference, New York, July 2012 Aditya K Sood Rohit Bansal Richard J Enbody SecNiche Security Department of Computer Science and Engineering
Security and Protection in Real-Time
Security and Protection in Real-Time Product White Paper Aug 29, 2006 ParetoLogic Anti-Spyware offers an advanced set of tools designed to protect your computer from spyware threats. There are two lines
Software Engineering 4C03 Class Project. Computer Networks and Computer Security COMBATING HACKERS
Software Engineering 4C03 Class Project Computer Networks and Computer Security COMBATING HACKERS Done By: Ratinder Ricky Gill Student Number: 0048973 E-Mail: gillrr@mcmaster.ca Due: Tuesday April 5, 2005
Keeping you and your computer safe in the digital world.
Keeping you and your computer safe in the digital world. After completing this class, you should be able to: Explain the terms security and privacy as applied to the digital world Identify digital threats
What's the difference between spyware and a virus? What is Scareware?
What's the difference between spyware and a virus? What is Scareware? Spyware and viruses are both forms of unwanted or malicious software, sometimes called "malware." You can use Microsoft Security Essentials
Spyware Meets HIPAA. by Kate Borten, CISSP, CISM. 2005 Webroot Software 1
Spyware Meets HIPAA by Kate Borten, CISSP, CISM 2005 Webroot Software 1 TABLE OF CONTENTS INTRODUCTION...3 SPYWARE MUTATES...4 USING HIPAA'S SECURITY RULE AS A PRESCRIPTION TO FIGHT SPYWARE...5 ABOUT THE
C&G FLUX MARKET Internet Safety
Internet Safety Introduction Viruses, Trojan horses, worms, and spyware are all threats that can damage our computer systems. We know we need to protect our computers, but with so many antivirus programs
The Dirty Secret Behind the UTM: What Security Vendors Don t Want You to Know
The Dirty Secret Behind the UTM: What Security Vendors Don t Want You to Know I n t r o d u c t i o n Until the late 1990s, network security threats were predominantly written by programmers seeking notoriety,
Automatic Network Protocol Analysis
Gilbert Wondracek, Paolo M ilani C omparetti, C hristopher Kruegel and E ngin Kirda {gilbert,pmilani}@ seclab.tuwien.ac.at chris@ cs.ucsb.edu engin.kirda@ eurecom.fr Reverse Engineering Network Protocols
Developing A Successful Patch Management Process
Developing A Successful Patch Management Process White Paper FoxGuard Solutions, Inc. August 2014 Introduction Almost every day, new vulnerabilities are discovered and disclosed to software vendors, who
LASTLINE WHITEPAPER. Using Passive DNS Analysis to Automatically Detect Malicious Domains
LASTLINE WHITEPAPER Using Passive DNS Analysis to Automatically Detect Malicious Domains Abstract The domain name service (DNS) plays an important role in the operation of the Internet, providing a two-way
Laplink PCdefense Reviewer s Guide
Laplink PCdefense Reviewer s Guide TM Reviewer s Guide TM Letter from the CEO Overview Target Markets Features, System Requirements, Pricing & Availability Competitive Advantages Comparison Chart Glossary
Introduction... Error! Bookmark not defined. Intrusion detection & prevention principles... Error! Bookmark not defined.
Contents Introduction... Error! Bookmark not defined. Intrusion detection & prevention principles... Error! Bookmark not defined. Technical OverView... Error! Bookmark not defined. Network Intrusion Detection
User Documentation Web Traffic Security. University of Stavanger
User Documentation Web Traffic Security University of Stavanger Table of content User Documentation... 1 Web Traffic Security... 1 University of Stavanger... 1 UiS Web Traffic Security... 3 Background...
Beginning Open-Source/Free Solutions for Home and Small Business Owners. Robert Baldi, CISSP- ISSEP Robert Clauff
Beginning Open-Source/Free Solutions for Home and Small Business Owners Robert Baldi, CISSP- ISSEP Robert Clauff Open source.efficient.secure TOPICS Antivirus Password Security Spyware Safe Browsing Network
Cisco Advanced Malware Protection Sandboxing Capabilities
White Paper Cisco Advanced Malware Protection Sandboxing Capabilities What You Will Learn How sandboxing is a key part of network security when it operates as an integrated component of a complete solution.
Big Data Analytics in Network Security: Computational Automation of Security Professionals
February 13, 2015 Big Data Analytics in Network Security: Computational Automation of Security Professionals Stratecast Analysis by Frank Dickson Stratecast Perspectives & Insight for Executives (SPIE)
What is Spyware? Daniel Jonasson danjo620@student.liu.se. Johan Sigholm johsi264@student.liu.se. Abstract. 2 Theory.
What is Spyware? Daniel Jonasson danjo620@student.liu.se Johan Sigholm johsi264@student.liu.se Abstract During the last few years the term spyware has become increasingly spread. The definition, though,
Integrated Network Vulnerability Scanning & Penetration Testing SAINTcorporation.com
SAINT Integrated Network Vulnerability Scanning and Penetration Testing www.saintcorporation.com Introduction While network vulnerability scanning is an important tool in proactive network security, penetration
Netsweeper Whitepaper
Netsweeper Inc. Corporate Headquarters 104 Dawson Road Suite 100 Guelph, ON, Canada N1H 1A7 CANADA T: +1 (519) 826-5222 F: +1 (519) 826-5228 Netsweeper Whitepaper The Evolution of Web Security June 2010
Taxonomy of Intrusion Detection System
Taxonomy of Intrusion Detection System Monika Sharma, Sumit Sharma Abstract During the past years, security of computer networks has become main stream in most of everyone's lives. Nowadays as the use
A New Approach to Assessing Advanced Threat Solutions
A New Approach to Assessing Advanced Threat Solutions December 4, 2014 A New Approach to Assessing Advanced Threat Solutions How Well Does Your Advanced Threat Solution Work? The cyber threats facing enterprises
PROACTIVE PROTECTION MADE EASY
PROACTIVE PROTECTION AUTHOR: ANDREW NIKISHIN KASPERSKY LAB Heuristic Analyzer Policy-Based Security Intrusion Prevention System (IPS) Protection against Buffer Overruns Behaviour Blockers Different Approaches
Deep Discovery. Technical details
Deep Discovery Technical details Deep Discovery Technologies DETECT Entry point Lateral Movement Exfiltration 360 Approach Network Monitoring Content Inspection Document Emulation Payload Download Behavior
FAKE ANTIVIRUS MALWARE This information has come from http://www.bleepingcomputer.com/ - a very useful resource if you are having computer issues.
FAKE ANTIVIRUS MALWARE This information has come from http://www.bleepingcomputer.com/ - a very useful resource if you are having computer issues. The latest tactic currently being used by malware creators
Cenzic Product Guide. Cloud, Mobile and Web Application Security
Cloud, Mobile and Web Application Security Table of Contents Cenzic Enterprise...3 Cenzic Desktop...3 Cenzic Managed Cloud...3 Cenzic Cloud...3 Cenzic Hybrid...3 Cenzic Mobile...4 Technology...4 Continuous
Malware, Spyware, Adware, Viruses. Gracie White, Scott Black Information Technology Services
Malware, Spyware, Adware, Viruses Gracie White, Scott Black Information Technology Services The average computer user should be aware of potential threats to their computer every time they connect to the
Implementation of Botcatch for Identifying Bot Infected Hosts
Implementation of Botcatch for Identifying Bot Infected Hosts GRADUATE PROJECT REPORT Submitted to the Faculty of The School of Engineering & Computing Sciences Texas A&M University-Corpus Christi Corpus
The evolution of virtual endpoint security. Comparing vsentry with traditional endpoint virtualization security solutions
The evolution of virtual endpoint security Comparing vsentry with traditional endpoint virtualization security solutions Executive Summary First generation endpoint virtualization based security solutions
Guideline on Auditing and Log Management
CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius
Step-by-Step Guide: How to remove spyware By Serdar Yegulalp, author Windows 2000 Power Users Newsletter
Sponsored by Step-by-Step Guide: How to remove spyware By Serdar Yegulalp, author Windows 2000 Power Users Newsletter Step 1. Get familiar with spyware now if not already Spyware is one of the major new
BitDefender for Microsoft ISA Servers Standard Edition
BitDefender for Microsoft ISA Servers Standard Edition Copyright 2006 SOFTWIN Edition 1. How Does It Work? As content entering or leaving your company must meet security policies, it is crucial to choose
Integrated Protection for Systems. João Batista Joao_batista@mcafee.com Territory Manager
Integrated Protection for Systems João Batista Joao_batista@mcafee.com Territory Manager 2 McAfee Overview Proven Expertise And what it means to you Proof of Expertise Impact of Expertise 1 17 100 300
Remote Deposit Quick Start Guide
Treasury Management Fraud Prevention How to Protect Your Business Remote Deposit Quick Start Guide What s Inside We re committed to the safety of your company s financial information. We want to make you
Kaspersky Security Network
Kaspersky Security Network Kaspersky Security Network is a progressive technology implemented in the latest versions of Kaspersky Lab s personal products. When it comes to new malware, it ensures a prompt
Review Study on Techniques for Network worm Signatures Automation
Review Study on Techniques for Network worm Signatures Automation 1 Mohammed Anbar, 2 Sureswaran Ramadass, 3 Selvakumar Manickam, 4 Syazwina Binti Alias, 5 Alhamza Alalousi, and 6 Mohammed Elhalabi 1,
Network Intrusion Detection with Semantics-Aware Capability
Network Intrusion Detection with Semantics-Aware Capability Walter Scheirer and Mooi Choo Chuah Lehigh University Dept. of Computer Science and Engineering Bethlehem, PA 18015 USA {wjs3, chuah}@cse.lehigh.edu
BitDefender Client Security Workstation Security and Management
BitDefender Client Security Workstation Security and Management BitDefender Client Security is an easy to use business security and management solution, which delivers superior proactive protection from
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES. www.kaspersky.com
KASPERSKY SECURITY INTELLIGENCE SERVICES. EXPERT SERVICES www.kaspersky.com EXPERT SERVICES Expert Services from Kaspersky Lab are exactly that the services of our in-house experts, many of them global