Abstract

ClamAV is an open source anti-virus toolkit for UNIX systems. The main purpose of this software lies in the integration with mail servers enabling mail attachment scanning before the end user receives a virus. As with other anti-virus software, the engine for ClamAV has pattern matching technology at its heart. Updates to the malware signatures are released on a regular basis by ClamAV Researchers.
However, what if no signatures are available to detect a given piece of malware, or if updates are not coming fast enough? Fortunately, ClamAV signatures are “open” and this enables the administrators to fill in the gap for themselves. This presentation covers the methods behind creating effective malware signatures for ClamAV and introduces the new malware “logical signature” format that makes it even easier to write custom detections.
The event will finish with a Q&A session of about 15 minutes.

About the Presenter

Alain Zidouemba studied Mathématiques Supérieures and Mathématiques Spéciales at the Lycée Jacques Amyot in France and Electrical and Computer Engineering at Howard University in the United States. He worked in the area of network modelling and simulation at OPNET Technologies before taking a position at PestPatrol, Inc. as a Spyware Researcher. He later joined Computer Associates to work on intrusion prevention and behavioural malware analysis. Alain is a member of the Vulnerability Research Team (VRT) at Sourcefire and performs research in the areas of intrusion prevention and anti-malware.

How to Hear The Presentation

To register for this webinar please visit https://sourcefire.webex.com/sourcefire/onstage/g.php?d=798010302&t=a.
After you have registered you will receive an email that will contain the instructions on how to listen to the webinar. For most people the procedure is to visit a URL, which will be given, enter in an password (the event password is clamav) and then either listen on the your computer’s speakers, or dial-in to listen over the telephone. The interface you get on the PC will be the same whichever audio method you choose.
The phone numbers for the U.S. and Canada are 866-469-3239 (free), 1-650-429-3300 (charged). To see the worldwide call-in numbers please visit https://sourcefire.webex.com/sourcefire/globalcallin.php?serviceType=EC&ED=111325642&tollFree=1.
To find out about the toll-free dialling restrictions: http://www.webex.com/pdf/tollfree_restrictions.pdf.
The session will be archived and available later from www.clamav.net.

ClamAV detects Downadup, also known as Conficker, as Worm.Downadup. Once on a system it downloads components that ClamAV detects as members of the Trojan.Downloader- family of signatures.

The virus primarily exploits MS08-067; it can also spread through USB sticks. Since the virus is not spread by email we don’t expect to see much activity in our core user-base, which tends to use ClamAV to scan emails. We are, nevertheless, keeping an eye out for it through freshclam’s statistics gathering system – we are yet to see any obvious spike of activity from it. If we hear anything we’ll let you know.

As you may have heard, Sourcefire received an unsolicited offer to acquire the company. This morning Sourcefire announced that our board has rejected that offer. The complete press release is available at: http://investor.sourcefire.com/phoenix.zhtml?c=204582&p=irol-newsArticle&ID=1152071&highlight=

While there have been many downloads of the RC version for 0.93, feedback and bug reports on the RC release were few and far between. As you are aware, very shortly after the release of 0.93 a number of bugs were discovered and reported. We believe that most of these bugs would have been discovered earlier with a more rigorous RC process.

With that in mind, we have written a questionnaire that we are asking you all to take part in. This questionnaire should take no more than 5 minutes of your time and it would be a tremendous help to the ClamAV development team. Greater participation in the RC process will help us to discover and fix bugs earlier, avoid unnecessary patch releases and add new features faster.

The questionnaire is available at https://www.surveymonkey.com/s.aspx?sm=50jD3TV0RLtgwzPAPP4kYg_3d_3d.
You may answer anonymously or, if you choose, you may include your contact information so that I may contact you to further discuss how to improve the RC process. Any contact information provided will be used only for this purpose and will not be shared with any organisation other than the ClamAV team.

Just to say thank you, everyone who completes the survey and provides their contact information will have a chance to win one of three US$50 shopping sprees at: http://www.cafepress.com/clamav. The draw will take place on 21st May 2008.

Thank you agreeing to fill in this questionnaire. Should you have any questions please feel free to email me at nigel dot horne at sourcefire dot com, or phone me on +44 1226 241048 (UK time).

Nigel Horne

Director ClamAV Product Management

Sourcefire, Inc.

Security Governance: A Systematic Approach to Threat Management
Confidentiality, integrity and availability of information should be recognized as a critical business issue rather than the sole domain of IT. In today’s threat environment effective network security is an important part of ITs ability to support the business. IT security governance helps to make sure that the business priorities and opportunities of the company are aligned with the services offered by IT, including security projects. Turn-key solutions that cover both technical and management issues related to information security are available to facilitate a comprehensive network security program. This integrated approach is more effective when compared to occasional network audits, which often fail to account for systemic issues responsible for security weaknesses.

You may also want to see a talk by Georg Wicherski about the Nepenthes Platform: Automated Botnet Detection and Mitigation. A summary of Georg’s talk is below.

Automated Botnet Detection and Mitigation
With the Nepenthes Platform, we are able to collect malware autonomously. Centrally collecting this malware over months yielded to a vast, unmanagable, giant heap of binary data.
We show, how we managed to eventually do something useful with this data, by extracting different information using – sandboxing – recording of attacker information – botnet monitoring and introduce the functionality of the tools, we developed for these means.

The conference is free of charge, however pre-registration is strongly encouraged.

For more information on the conference visit: http://www.atsystemgroup.org/convegni/nss07/

Visit http://www.scmagazine.com/us/awards/categories/26137/best-anti-malware-solution/