Subject: [mile] Question for malware file exchange using SCI draft

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Tue, 8 Jan 2013 16:05:58 +0000

Hi Take et al,

We were wondering what the community thinks is the best way to exchange malware in an IODEF document. To me it seems either EventReport or  AttackPattern classes are adequate.

Now, how will the malware file be exchanged is another question. I wanted to see if it is possible to add IEEE's MMDEF in one of SCI's  "Candidate Specifications for the IANA Table". MMDEF would be for the exchange of malware files in a secure way. FYI, I believe MMDEF is used as that is posted right on the IEEE site by APWG with IODEF

Rgs,
Panos

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Tue, 8 Jan 2013 12:33:47 -0500

Hi Panos, Take, et al,

Interesting... getting opinions from the list will be very helpful!

I think if the group goes this route, we should pick which of those two classes make the most sense to embed MMDEF in IODEF using the SCI draft.  If folks think this is the best way to include a malware sample (please post opinions!), it should be possible to put this directly in the SCI draft as the first entry for the selected class in the IANA table.  More complex representations for malware could come in the IANA table method later if needed.  The other way to include a file with malware is described in RFC5901, but if APWG has taken this path, it may be the better option.  Copying Pat.  If it is, we'll want to include this in the IODEF guidance document as well for use cases that require the exchange of malware.

As for which class it belongs in, there are some considerations folks may want to weigh in on (and there may be more I don't list):

EventReport is in the Record class of IODEF.

Definition from IODEF Record Class:  The Record class is a container class for log and audit data that

   provides supportive information about the incident.  The source of

   this data will often be the output of monitoring tools.  These logs

   should substantiate the activity described in the document.

Definition of EventReport Class from SCI:  The extension embeds structured event reports.

AttackPattern is contained in the Method class of IODEF.

Definition from IODEF of Method Class: The Method class describes the methodology used by the intruder to
   perpetrate the events of the incident.  This class consists of a list
   of references describing the attack method and a free form
   description of the technique.

Attack pattern Definition from SCI: The extension describes attack patterns of incidents or events.

We can certainly change definitions of the classes in IODEF if that is the right thing to do as well.  Or do folks think one of these is a better fit than the other?

This seems like a solid use case of data commonly exchanged with a possible schema to reference in a standards organization, so maybe this is a candidate for our MTI for the SCI draft?   MMDEF is not a formal standard though because of where it sits in IEEE, but it is a site that can be referenced and the schema is posted publicly.

Thanks!
Kathleen

From: [email-masked] [mailto:[email-masked]] On Behalf Of Panos Kampanakis (pkampana)
Sent: Tuesday, January 08, 2013 11:06 AM
To: [email-masked]
Subject: [mile] Question for malware file exchange using SCI draft

Hi Take et al,

Rgs,
Panos

---

From: "Takeshi Takahashi" <[email-masked]>
Date: Wed, 9 Jan 2013 17:21:28 +0900

Hi Panos, Kathleen, and all,

Thank you very much for raising discussion.
Let me join the discussion here.

> We were wondering what the community thinks is the best way to exchange
malware in an IODEF document. To me it seems either EventReport or
AttackPattern classes are adequate.
> Now, how will the malware file be exchanged is another question. I wanted
to see if it is possible to add IEEE’s MMDEF in one of SCI’s “Candidate
Specifications for the IANA Table”. MMDEF would be for the exchange of
malware files in a secure way. FYI, I believe MMDEF is used as that is
posted right on the IEEE site by APWG with IODEF

I personally think it would be very nice to register MMDEF in the SCI's IANA
Table.
IMHO, I slightly prefer the AttackPattern class since the MMDEF contains the
samples (malware files) that tried to attack the user's asset.

Does the MMDEF metadata XML itself contain actual file data or URI (or any
other pointer)?
I think no. (correct me please if I am wrong.)
If so, I guess we could convey the MMDEF data by setting values as follows:

SpecID <- namespace of MMDEF ver x.x
RawData <- the XML metadata
Reference <- pointer to the sample (malware file)

I might have wrong understanding of MMDEF.
So, please correct me if above is not suitable...

> Attack pattern Definition from SCI: The extension describes attack
patterns of incidents or events.

I think the definitions of the IODEF classes are fine, but the above SCI
class definition could be modified to nicely support MMDEF here.
For instance, it could be rewritten like this: "The extension describes
attack patterns of incidents or events as well as their tools such as
malware."

Meanwhile, the SCI draft should note that the validation (and parsing)
process should be careful if we actually carry a sample (of malware) instead
of its pointer.

Kind regards,
Take

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Moriarty, Kathleen
Sent: Wednesday, January 09, 2013 2:34 AM
To: Panos Kampanakis (pkampana); [email-masked]
Subject: Re: [mile] Question for malware file exchange using SCI draft

Hi Panos, Take, et al,

Interesting… getting opinions from the list will be very helpful!

I think if the group goes this route, we should pick which of those two
classes make the most sense to embed MMDEF in IODEF using the SCI draft.  If
folks think this is the best way to include a malware sample (please post
opinions!), it should be possible to put this directly in the SCI draft as
the first entry for the selected class in the IANA table.  More complex
representations for malware could come in the IANA table method later if
needed.  The other way to include a file with malware is described in
RFC5901, but if APWG has taken this path, it may be the better option. 
Copying Pat.  If it is, we’ll want to include this in the IODEF guidance
document as well for use cases that require the exchange of malware.

As for which class it belongs in, there are some considerations folks may
want to weigh in on (and there may be more I don’t list):

EventReport is in the Record class of IODEF.
Definition from IODEF Record Class:  The Record class is a container class
for log and audit data that
   provides supportive information about the incident.  The source of
   this data will often be the output of monitoring tools.  These logs
   should substantiate the activity described in the document.
Definition of EventReport Class from SCI:  The extension embeds structured
event reports.

AttackPattern is contained in the Method class of IODEF.
Definition from IODEF of Method Class: The Method class describes the
methodology used by the intruder to
   perpetrate the events of the incident.  This class consists of a list
   of references describing the attack method and a free form
   description of the technique.
Attack pattern Definition from SCI: The extension describes attack patterns
of incidents or events.

We can certainly change definitions of the classes in IODEF if that is the
right thing to do as well.  Or do folks think one of these is a better fit
than the other?

This seems like a solid use case of data commonly exchanged with a possible
schema to reference in a standards organization, so maybe this is a
candidate for our MTI for the SCI draft?   MMDEF is not a formal standard
though because of where it sits in IEEE, but it is a site that can be
referenced and the schema is posted publicly.

Thanks!
Kathleen

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Panos Kampanakis (pkampana)
Sent: Tuesday, January 08, 2013 11:06 AM
To: [email-masked]
Subject: [mile] Question for malware file exchange using SCI draft

Hi Take et al,
 
We were wondering what the community thinks is the best way to exchange
malware in an IODEF document. To me it seems either EventReport or
AttackPattern classes are adequate. 
 
Now, how will the malware file be exchanged is another question. I wanted to
see if it is possible to add IEEE’s MMDEF in one of SCI’s “Candidate
Specifications for the IANA Table”. MMDEF would be for the exchange of
malware files in a secure way. FYI, I believe MMDEF is used as that is
posted right on the IEEE site by APWG with IODEF 
 
Rgs,
Panos

---

From: <[email-masked]>
Date: Wed, 9 Jan 2013 20:02:42 +0000

Take,

I too prefer the Attack Pattern class for the same reason you stated.

Thanks.

Kent Landfield

McAfee | An Intel Company
Direct: +1.972.963.7096
Mobile: +1.817.637.8026
Web: www.mcafee.com<http://www.mcafee.com/>

From: Takeshi Takahashi <[email-masked]<mailto:[email-masked]>>
Date: Wednesday, January 9, 2013 2:21 AM
To: Kathleen Moriarty <[email-masked]<mailto:[email-masked]>>, "'Panos Kampanakis (pkampana)'" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [mile] Question for malware file exchange using SCI draft

Attack pattern Definition from SCI: The extension describes attack
patterns of incidents or events.

Kind regards,
Take

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of
Moriarty, Kathleen
Sent: Wednesday, January 09, 2013 2:34 AM
To: Panos Kampanakis (pkampana); [email-masked]<mailto:[email-masked]>
Subject: Re: [mile] Question for malware file exchange using SCI draft

Hi Panos, Take, et al,

Thanks!
Kathleen

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of
Panos Kampanakis (pkampana)
Sent: Tuesday, January 08, 2013 11:06 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [mile] Question for malware file exchange using SCI draft

Hi Take et al,

Rgs,
Panos

_______________________________________________
mile mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mile

---

From: "Moriarty, Kathleen" <[email-masked]>
Date: Sun, 20 Jan 2013 19:46:34 -0500

Take,

With your text additions, I think AttackPattern makes sense.  I did hear from a few other people who said they wanted this added, but did not have a strong preference as both options are reasonable.

Any other opinions on where malware gets included via the SCI draft?  If not, let's go ahead and put this in AttackPattern.

Thank you!
Kathleen
________________________________________
From: [email-masked] [[email-masked]]
Sent: Wednesday, January 09, 2013 3:02 PM
To: [email-masked]; Moriarty, Kathleen; [email-masked]; [email-masked]
Subject: Re: [mile] Question for malware file exchange using SCI draft

Take,

Thanks.

Kent Landfield

Kind regards,
Take

Hi Panos, Take, et al,

Thanks!
Kathleen

Hi Take et al,

Rgs,
Panos