{"id":21387,"date":"2020-09-01T10:09:35","date_gmt":"2020-09-01T09:09:35","guid":{"rendered":"https:\/\/www.kaspersky.co.uk\/blog\/cybersecurity-expert-training\/21387\/"},"modified":"2020-09-01T10:10:13","modified_gmt":"2020-09-01T09:10:13","slug":"cybersecurity-expert-training","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/cybersecurity-expert-training\/21387\/","title":{"rendered":"The Catcher in the YARA \u2014 predicting black swans"},"content":{"rendered":"

It\u2019s been a long, long time since humanity has had a year like this one. I don\u2019t think I\u2019ve ever known a year with such a high concentration of black swans of various types and forms. And I don\u2019t mean the kind with feathers<\/a>. I\u2019m talking about unexpected events with far-reaching consequences, as per the theory<\/a> of Nassim Nicholas Taleb<\/a>, published in 2007 in his book The Black Swan: The Impact of the Highly Improbable<\/a><\/em>. One of the main tenets of the theory is that, with hindsight, surprising events that have already occurred seem obvious and predictable; however, before they occur, no one predicts them.<\/p>\n

Example: this ghastly virus that\u2019s had the world in lockdown since March. It turns out there\u2019s a whole extended family<\/a> of coronaviridae<\/em> \u2014 several dozen of them \u2014 and new ones are found regularly. Cats, dogs, birds, and bats all get them. Humans get them. Some cause common colds. Others manifest \u2026 differently. So, surely, we need to develop vaccines for them as we have for other deadly viruses such as smallpox, polio, and others. Sure, but having a vaccine doesn\u2019t always help a great deal. Look at the flu \u2014 still no vaccine that inoculates folks after how many centuries? And anyway, even to start developing a vaccine you need to know what you\u2019re looking for, and that is apparently more art than science.<\/p>\n

So, why am I telling you this? What\u2019s the connection to \u2026 well, it\u2019s inevitably gonna be either cybersecurity or exotic travel, right?! Today, it\u2019s the former.<\/p>\n

Now, one of the most dangerous cyberthreats in existence is zero-days<\/a> \u2014 rare, unknown (to cybersecurity folks et al.) vulnerabilities in software that can do oh-my-grotesque<\/em> large-scale awfulness and damage \u2014 but they tend to remain undiscovered up until (or sometimes after) the moment they\u2019re exploited.<\/p>\n

However, cybersecurity experts have ways of dealing with ambiguity and predicting black swans. In this post I want to talk about one such means: YARA<\/a>.<\/p>\n

Briefly, YARA aids malware research and detection by identifying files that meet certain conditions and providing a rules-based approach to creating descriptions of malware families based on textual or binary patterns. (Ooh, that sounds complicated. Read on for clarification.) Thus, it\u2019s used to search for similar malware by identifying patterns. The aim is to be able to say that certain malicious programs look like they were made by the same folks, with similar objectives.<\/p>\n

OK, let\u2019s turn to another metaphor \u2014 like a black swan, another water-based one: the sea.<\/p>\n

Let\u2019s say your network is the ocean, which is full of thousands of kinds of fish, and you\u2019re an industrial fisherman out on the ocean in your ship casting off huge drift nets to catch the fish \u2014 but only certain breeds of fish (malware created by particular hacker groups) are interesting to you. Now, the drift net is special. It has special compartments, and only fish of a particular breed (malware characteristics) get caught in each compartment.<\/p>\n

Then, at the end of the shift, what you have is a lot of fish, all compartmentalized, some of which are relatively new, never-before-seen fish (new malware samples) about which you know practically nothing. But if they\u2019re in a certain compartment \u2014 say, \u201cLooks like Breed [hacker group] X\u201d or \u201cLooks like Breed [hacker group] Y.\u201d<\/p>\n

Here\u2019s a case<\/a> that illustrates the fish\/fishing metaphor. In 2015, our YARA guru and head of GReAT<\/a>, Costin Raiu, went full-on cyber-Sherlock to find an exploit in Microsoft\u2019s Silverlight software. You really should read that article, but, briefly, what Raiu did was carefully examine certain hacker-leaked e-mail correspondence to assemble a YARA rule from practically nothing, but that went on to help find the exploit and thus protect the world from mega-trouble. (The correspondence was from an Italian firm called Hacking Team \u2014 hackers hacking hackers!)<\/p>\n

So, about these YARA rules\u2026<\/p>\n

We\u2019ve been teaching the art of creating YARA rules for years. The cyberthreats that YARA helps uncover are rather complex, that\u2019s why we always ran the courses in person \u2014 offline \u2014 and for only a narrow group of top cybersecurity researchers. Of course, since March, offline training has been tricky because of lockdown; however, the need for education has hardly gone away, and indeed we\u2019ve seen no dip in interest in our courses.<\/p>\n

That\u2019s only natural: Cyber-baddies continue to think up ever-more-sophisticated attacks \u2014 even more so<\/a> under lockdown. Accordingly, keeping our specialized know-how about YARA to ourselves during lockdown would have been just plain wrong. Therefore, we\u2019ve (1) transferred our training format from offline to online, and (2) made it accessible to everyone. It\u2019s not free, but for such a course at such a level (the very highest), the price is very competitive and market-level.<\/p>\n

Introducing<\/a>:<\/p>\n

\"Hunt<\/a><\/p>\n

What else?<\/p>\n

Ah, yes.<\/p>\n

Now, given the ongoing virus-related troubles the world over, we\u2019re continuing our assistance to those on the front lines. We started helping out at the start of the whole corona thing by giving free licenses to healthcare organizations<\/a>. Now we\u2019re adding to that helping out a variety of nonprofit and nongovernmental organizations fighting for rights in various causes or focusing on making cyberspace a better place (the full list is here<\/a>). For them, our YARA training will be free.<\/p>\n

Why? Because NGOs work with very sensitive information that can be hacked in targeted attacks<\/a>, and not all NGOs can afford the luxury of a department of IT experts.<\/p>\n

\"Cybersecurity<\/a><\/p>\n

A quick run-through of what\u2019s included in the course:<\/p>\n

100% online, self-paced training. You can do the course intensely in a few evenings or spread it out over a month.<\/p>\n

A combination of both theory and hands-on tasks. There\u2019s a virtual lab for training in writing rules and searching for malware samples in our collection.<\/p>\n

Practical exercises based on examples of real cyberespionage attacks.<\/p>\n

A module about the art of looking for something about which you\u2019ve no precise knowledge, when intuition tells you cyberevil is lurking somewhere but you don\u2019t know where or which cyberevil in particular.<\/p>\n

A certificate on completion confirming your new status as a YARA ninja. As previous graduates have told us, it really does help in their career.<\/p>\n

\"Cybersecurity<\/a><\/p>\n

So, there you have it, folks: another extremely useful potential string in your bow for fighting highly sophisticated cyberthreats. Meanwhile, it\u2019s business as usual here at K<\/em>, where we continue our cyberdetective work so we\u2019ll be able to share still more of our very latest know-how and practical experience in fighting the good fight.<\/p>\n","protected":false},"excerpt":{"rendered":"

Kaspersky introduces an online cybersecurity expert training series that starts with an extensive course on YARA.<\/p>\n","protected":false},"author":13,"featured_media":21394,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2027],"tags":[72,584,1613,2128],"class_list":{"0":"post-21387","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-special-projects","8":"tag-eugene-kaspersky","9":"tag-great","10":"tag-training","11":"tag-yara"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/cybersecurity-expert-training\/21387\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/cybersecurity-expert-training\/21829\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/cybersecurity-expert-training\/17294\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/cybersecurity-expert-training\/23192\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/cybersecurity-expert-training\/20019\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/cybersecurity-expert-training\/23775\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/cybersecurity-expert-training\/22708\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/cybersecurity-expert-training\/29006\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/cybersecurity-expert-training\/8760\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/cybersecurity-expert-training\/36887\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/cybersecurity-expert-training\/15576\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/cybersecurity-expert-training\/15992\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/cybersecurity-expert-training\/13936\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/cybersecurity-expert-training\/25061\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/cybersecurity-expert-training\/29154\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/cybersecurity-expert-training\/26019\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/cybersecurity-expert-training\/22799\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/cybersecurity-expert-training\/28123\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/cybersecurity-expert-training\/27953\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.uk\/blog\/tag\/training\/","name":"training"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/21387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=21387"}],"version-history":[{"count":3,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/21387\/revisions"}],"predecessor-version":[{"id":21393,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/21387\/revisions\/21393"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media\/21394"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=21387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=21387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=21387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}