Sometimes as an analyst,
you really need to move your items or
potential malware into an environment that really encapsulate
it in such a fashion that it can't impose itself on other systems,
whether it be operations or different applications or in general
to be able to touch other systems as a whole.
In that process, we're really referring to as sandboxing.
Sandboxing is the art of moving something or putting
a piece of software application or even potential malware
into a position where it truly cannot communicate with
the other systems or networking utilities on your network.
In this episode,
we're gonna talk and discuss about how malware
can be tested and identified in an environment
where it really can't cause harm to other
applications or systems as part of your network.
Sandboxing is truly the isolation of one network from another.
Meaning that I'm taking a environment where I don't have internet access.
It's not connected to other uh
uh other systems or network devices.
It's truly isolated from the network as a whole.
Sandboxing allows for an isolated network in order to test or
to go forward in the process of identifying the functions or the
functionality of a specific application or even an operating system that
may have had malware introduced upon it in this controlled environment,
we can actually test our systems or that application
to figure out how it's interacting with the other
environments in which we would normally see it on.
That means that we could take a malware or a
piece of application that may be affected by malware.
We can run it through dynamic analysis and see what's going on across the board.
We can go through the processes, we can go through the uh uh environment.
In which case, we can identify everything that it touches along the way
we can monitor the different aspects of which that
malware or that application is actually moving forward.
Meaning that we can analyze everything that comes into play with, we can identify,
hey, is this piece of software interacting with something it shouldn't be,
is it going through in the word document when it has
no process or understanding or need to access that specific application?
And this way we can identify what is the malware doing on
our system and how it's imposing its will on other applications.
If it's a negative consequence,
we can also look in a different environment how that piece of
application or that piece of software is interacting on a legitimate basis.
Sometimes we want to sandbox a new patch or a new structure
in such a way that we can see. Hey, we have both proprietary software.
Yet,
Microsoft just came up with a new patch before we
roll out that patch to all our other systems.
Let's see how it reacts
our system in a sandbox environment.
So we can understand, are we going to have repercussions by applying that patch?
This provides us a way to identify and analyze how that software
is actually encoded or how it's moving across our entire system.
The first one I want to talk about in terms of malware
analysis is actually a program or an application called Joe Sandbox.
Now, Joe Sandbox is, is a virtual environment on the cloud,
meaning that we don't have to actually have it on our software systems.
We can go online and we can provide a piece of malware or an infected item onto
their virtual environment and then it will go through
and actually test that software for peripheral problems.
We're going to go more in depth than this in the future
episode and really kind of show you how this actually works.
The other one I want to talk about is
cuckoo sandbox.
Cuckoo Sandbox is a standalone environment that sandboxes itself.
This means that you have to provide that virtual environment,
but you can download the software and turn say a nauta
machine
into a sandbox environment where it's not touching other things.
And the software actually goes through and analyzes what it can
for you so that you can identify whether the powerpoint,
the Excel document maybe that software application
may have malware embedded in it.
Now, it's not 100% guaranteed that it's going to find everything,
but it does provide an environment in which case we can go through
and we could probably analyze it without the need for inducing
our other systems or applications to a potential piece of malware.
We can utilize it within our source or our scene platforms to provide
a detailed and customized report to identify
exactly what's going on in that environment
and our holistic security environment.
Throughout this episode, we talked about how a sandbox environment can use,
not only for legitimate processes but also potential malware or applications.
We also identified how it could be
introduced in an aspect of analysis and identification
both
in Joe Sandbox and
Ku.
Throughout your cys a testing environment,
I would expect to see a high level overview of both sandboxes
in relation to different aspects at a high level.
They're not going to go through and ask you to go through and uh specifically
go through the process.
They're not going to ask you to go through and identify specific malware,
but they would expect you to understand
I can use
cuckoo sandbox or I could use Joe sandbox.
And this is the properties in which case I might use both where cuckoo
is a standalone environment that we're controlling and Joe
Sandbox is a virtual environment on the cloud.
It really depends on the aspects of what direction you want to
go in and the process that we might want to utilize.
For instance,
Joe Sandbox is more in relation to
the theoretical concepts of different operating systems.
And I could download a file or a folder that may be properly infected a text document
and then just upload it to the virtual
environment and then ask questions about that.
It all will close into play where we're looking at specific URL S or files where Ku
sandbox is more
of a Linux only environment.
Yes, we can do windows environment stuff on there,
but it's not going to provide us the holistic view that we're looking for.
However, where Kutta
real strength is within the seam or within a sore environment because it's actually
part of our environment as a whole and it can grab those logs,
it can grab that information and analysis directly from our systems.
One definitely has a better property and a holistic viewpoint ie
where one is more of a standalone environment. Ie Joe sandbox
expect to see questions specifically related to those two environments
in which you might use in a scenario based context.
One over another.