Talos Intelligence Blog

It is totally awesome that function similarity is seeing the light of day. Google bought Zynamics way back when and their work has evolved a lot since then.

This sort of work has big implications in signature generation for malware samples, for clustering families of samples as well as finding common functions to generate detections on. You couldn't necessarily throw this into a detection engine, because we don't have a fast (dedicated) function recovery tool for binaries, but you can absolutely use it to generate byte based detection from a seed of a few samples.

Rather than having hash based signatures you could generate signatures that cover many samples (and likely new ones) in bulk. Normally a good signature like that requires manual effort from an analyst, this is a step toward machines doing it. As well, a central authoritative name database that could say "this is Petya" could force some sane naming convention on the industry (every AV wouldn't just be like "it's Zbot lol").

This stuff can even aid manual reverse engineering. You could build a function naming database that uses this. Maybe a new engine for Talos FIRST. [1] Then if you opened up a file without debug symbols this could match it to known functions and really speed up reverse engineering efforts.

I look forward to reading it in more detail tomorrow. Thanks to Halvar for putting this out.

1. https://www.talosintelligence.com/first

First, you need to set up the technical side: rDNS, SPF, DKIM, DMARC, no IPv6, TLS, etc. Lots of guides on the internet for that.

After setting up the technical side (which you can test with a site like https://www.mail-tester.com), you need an IP (v4) without a bad reputation. This is the hardest part, because it's less easy to control.

If your IP has been used to send spam, or sometimes even the neighbouring IP's, you won't get through to a lot of providers.

These are the best places (in my experience) to check IP reputation:

https://talosintelligence.com/reputation_center/lookup
https://senderscore.org
https://www.barracudacentral.org/lookups/lookup-reputation

And also check for blacklists, for example with https://mxtoolbox.com/blacklists.aspx.

If your IP is on a blacklist, you can remove is most of the time by requesting it via their (90's looking) websites.

Also, if you send a lot of mail, Microsoft and Google have programs for senders to monitor reputation:

https://sendersupport.olc.protection.outlook.com/snds/
https://www.gmail.com/postmaster/

But... even with an IP with a neutral reputation, your mails may be sent to the spambox. You need some volume of legitimate email over time to build trust (this is called warming up an IP).

I'm not an analyst, but I'm in the field. It's broad, and not many good targeted communities exist that I know of. Here is my current list of places to check regularly. Let me know if you know of others!

## Social
https://www.reddit.com/user/goretsky/m/security/ - compliation of 90-100 security subreddits.

## Security / Tech News
https://www.darkreading.com/
https://www.bleepingcomputer.com/
https://news.ycombinator.com/
https://nakedsecurity.sophos.com/
https://threatpost.com/
https://blog.erratasec.com/
https://krebsonsecurity.com/
https://medium.com/mitre-attack
https://threatpost.com/

## Threat updates / SOC
https://www.securitywizardry.com/radar.htm - dashboard - virus news, latest alert feeds
https://www.talosintelligence.com/ - reputation lookup for networks & vuln reports

## Podcasts
http://defensivesecurity.org/
https://securityledger.com/
https://securityweekly.com/
https://risky.biz

## Slack Communities
OWASP - owasp.slack.com
DFIR IR - dfircommunity.slack.com - mostly around the Demisto products, but some other discussion as well
Hangops Infosec - hangops.slack.com - infosec channel

It's sloppy writing. They mean it is the empty string in /etc/shadow.

Following some links from the CVE, you can find the details (from https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782):

> In builds of the Alpine Docker Image (>=3.3) the /etc/shadow file contains a blank field in place of the encrypted password

> ...

> The net result of a blank sp_pwdp field is that the system will treat the root user as having no password, rather than a 'locked' account if a ! or is explicitly specified.*

For those not super familiar with how Unix/Linux password files work, if the field is non-empty, the system will collect a password, hash it, and compare for a match. If the field is empty, the system will just skip prompting for a password and log you in after entering a username.

Arguably, this is crappy design and a better design for /etc/shadow would be to require some kind of explicit, very obvious value like "NO-PASSWORD-REQUIRED".

Google and Gmail account for a very small amount of the global mail-flow and have even less of an impact on standards. In fact they only appear as a contributor/author on RFC8617 (ARC).

No standard says, or even suggest, that “residential ips are not valid.” However, reputation is an important par of mail security. Most, if not all residential IPs won’t be sending enough mail to even register a reputation (look up your own on https://talosintelligence.com/). This is the main challenge for self-hosters. That and a significant majority of residential ISPs block SMTP traffic, for very obvious reasons. This isn’t some Google/Microsoft conspiracy. SMTP is fundamentally a plain text format that has been abused for the last 30 or so years - 30, because that’s when MIME became a thing.

Ask those users who the vendor of the firewall is (or have them ask their IT department) and reach out to them. It's probably one specific vendor. It might not even be on any kind of list, could easily be some kind of heuristic matching some traffic pattern or even it not liking your domain name or IP somehow.

You can check your domain in things like https://talosintelligence.com/reputation_center/lookup?search=crewsum.com or other domain reputation engines. But nothing seems wrong with it.