Common Malware Enumeration

This article describes the Common Malware Enumeration project. CME is a sister project to Mitre's Common Vulnerabilities and Exposures (CVE) initiative. CME will "assign unique identifiers to high priority malware events." This is a great idea, because anti-virus vendors, security researchers, and OS/application vendors will be able to refer to a common name rather than their internal representations for malware. DHS is funding the CME project.

Comments

Anonymous said…
I am fairly skeptical on how successful this approach will be.

- This takes away the media blitz when something like Bagle or Slammer can be announced in the media. Saying CME-635 wrecked havoc really steals away from the news drama. News media will still use the namig scheme from researchers and vendors.

- This takes away marketing from security and AV companies for much the same reason. Maybe we can identify common threats, but researchers and vendors will not change their naming conventions.

- Making this automated is a terrible idea. How do you draw relationships between variants released weeks apart? The numbers will tell you nothing. What if three real viruses are released in an hour? Vendors will be frustrated by the 2 hour "no submission" period...and so will researchers. How does one company know that CME-234 is also the virus they have? Will code be released? Will someone be looking at the code submissions behind the scenes to determine duplicate entries? What if one company participates, but just resubmits everything they find, duplicated or not? "We have submitted 4,564 CME viruses..."

- After having read the most excellent virus book, The Art of Computer Virus Research and Defense by Peter Szor (http://www.bookpool.com/ss?qs=virus+research&x=0&y=0), I have come to understand the issues of naming worms, and the naming conventions themselves. I doubt I will ever use CME-234, but rather use the much more immediately informative W32@MMBagle.G (I might have that wrong, but it immediately tells me a memorable name, the platform, mass-mailing, and it is a variant).

Bottom-line, even if this takes off, I think item #3 in my list will be the one that kills this project in its current form.

-LonerVamp
1:32 PM
Anonymous said…
Strike that about the automated part. I was confused. It appears there will be a research team behind submissions. At any rate, I hope this will not slow down response times with this added layer of work. Also, I hope they stick strictly to assigning a CME to particular code and match a description of what that code does, thus eliminating all the subjective threat ratings and other stuff. Everything else should be done by the vendors. This is like the Dewey Decimal Systems in libraries where the system doesn't care how good or important or small a book is, it just assigns it a number and a category and away she goes.
-LonerVamp
1:39 PM
Richard Bejtlich said…
Hi LonerVamp,

I think the media will continue to use whatever catchy name a vendor applies to malware. I think the CME will appear more "behind the scenes" to ensure researchers and analysts are all referring to the same piece of code.
1:43 PM
Anonymous said…
This comment has been removed by a blog administrator.
4:04 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more