Welcome Guest. | Log In | Register | Membership Benefits

HBGary Responder Pro 2.0.5 S Improves Ability to Detect And Counter Adaptive, Persistent Threats In The Enterprise

Responder Pro delivers malware analysis, memory analysis, and malware detection on a single, integrated platform

Nov 30, 2011 | 02:13 PM | 


November 29, 2011, Sacramento, CA, In a move to significantly improve incident response teams’ ability to detect – and counter – adaptive, persistent threats and other targeted attacks in the enterprise, today HBGary announced Responder™ Pro 2.0.5, the latest version of the de facto industry standard in Windows' physical memory and automated analysis.

Responder™ Pro 2.0.5 provides faster, more targeted visibility about Advanced Persistent Threats (APT) and other adaptive, persistent adversaries so investigators can quickly determine scope of infection, contain and then remove the attackers from the network. Using Responder™ Pro, incident responders can complete their investigation in minutes instead of days as with conventional tools.

“This release offers a number of new features designed to help our customers analyze threats faster and more efficiently. In today’s corporate networks, threats evolve quickly and the sheer scope of information can often overwhelm security professionals. We are consistently working to develop new technologies to successfully detect and counter these attackers and help reduce the load on the customer.” said Martin Pillion, Senior Software Engineer for HBGary, Inc.

Leveraging HBGary’s Digital DNA™ core technology, Responder™ Pro delivers malware analysis, memory analysis and malware detection on a single, integrated platform. Responder™ Pro allows incident responders to quickly find the “smoking gun” in an infected Windows' system including malware, chat sessions, registry keys, socket information, passwords in clear text, rootkits, Trojans, unencrypted data, and open files.

Responder™ Pro is used by cybersecurity professionals in many industries including financial, technology, energy, manufacturing, healthcare, and services as well as government.

New features and upgrades to existing features in Responder™ Pro 2.0.5 include:

Full Binary Analysis Graph Feature: Allows you to quickly and easily see what is occurring in a binary sample. You can visually browse a graph and determine how it functions so you can focus on the section you are interested in immediately.

Improved Binary Information: Important information about a binary is now labeled or automatically generated. This includes hashes, timestamps, header information, structures, and additional labeling of disassembled code.

At-a-Glance Cross-References: Cross-references are automatically disassembled and presented inside the strings and symbols list. You can save a tremendous amount of time while reverse engineering code without having to manually examine every cross-reference. Also, data and call cross-references are now followed through multiple indirections to propagate symbol and function names.

Improved Disassembly: The automated disassembler has been improved to handle certain complex code structures. You can now automatically generate cross-references in addition to being able to create function and code blocks anywhere in the binary. Also, alignment and debug blocks are more accurately labeled.

Hierarchical Process View: This view provides an easier way for analysts to view parent- child relationships of programs and interactions on the system. You can toggle between a flat list or a hierarchical tree. This makes it easier to spot some malware infections visually when looking at the Objects Tab – Global View of all Processes.

Binary View: The binary view now supports advanced display options allowing you to customize your preferences. The default settings make it much easier to identify the critical pieces of information in a binary.

Search Details: Search results show more detail about the containing processes and module if available.

Memory Map Packages: You can now create a package out of any memory page or region in the Memory Map and then analyze that package as if it were a regular module.

Automatic Labeling of GUIDs: A large list of GUIDs are now automatically identified and labeled.

You can customize this list to include any additional GUIDs that you want.

Depth Control for Auto-Label Operands: You can control the depth of the auto label operation in the preferences, and you can abort the auto label command during operation if it takes longer than you want.

About the Responder™ Windows' Memory Investigation Platform

By tightly coupling physical memory forensics and malware analysis in a workstation analysis system, the HBGary Responder™ platform reliably identifies all digital objects on a computer and provides valuable intelligence on what bad guys are doing. Responder automatically reconstructs and displays all informational objects stored in RAM such as running processes, drivers and modules, strings, symbols, and open registry keys, files, and network connections. HBGary’s core technology, Digital DNA, is an optional software subscription for Responder™ Pro. Responder helps incident response professionals understand malware fast. It provides human readable information and contextual graphics, while traditional binary reverse engineering tools require deciphering esoteric assembly code.



Currently we allow the following HTML tags in comments:

Single tags

These tags can be used alone and don't need an ending tag.

<br> Defines a single line break

<hr> Defines a horizontal line

Matching tags

These require an ending tag - e.g. <i>italic text</i>

<a> Defines an anchor

<b> Defines bold text

<big> Defines big text

<blockquote> Defines a long quotation

<caption> Defines a table caption

<cite> Defines a citation

<code> Defines computer code text

<em> Defines emphasized text

<fieldset> Defines a border around elements in a form

<h1> This is heading 1

<h2> This is heading 2

<h3> This is heading 3

<h4> This is heading 4

<h5> This is heading 5

<h6> This is heading 6

<i> Defines italic text

<p> Defines a paragraph

<pre> Defines preformatted text

<q> Defines a short quotation

<samp> Defines sample computer code text

<small> Defines small text

<span> Defines a section in a document

<s> Defines strikethrough text

<strike> Defines strikethrough text

<strong> Defines strong text

<sub> Defines subscripted text

<sup> Defines superscripted text

<u> Defines underlined text

Dark Reading encourages readers to engage in spirited, healthy debate, including taking us to task. However, Dark Reading moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing/SPAM. Dark Reading further reserves the right to disable the profile of any commenter participating in said activities.

Disqus Tips To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.
Subscribe to RSS



Advanced Threats Reports

report How Did They Get In? A Guide to Tracking Down The Source of an APT
If you think that your organization hasn't been affected by an advanced persistent threat, you probably haven't looked hard enough. Identifying that your organization is under attack is difficult enough; determining the scope of infiltration and damage presents a whole new level of challenge. To effectively protect against APTs, security pros will need to employ an arsenal of tools in a coordinated fashion, as well as develop new understandings of and approaches to system and data exploits. Here's a short and simple guide to this challenge.

report Detecting and Defending Against Advanced Persistent Threats
APTs are a growing problem for enterprises big and small. Protecting your organization from these targeted threats requires constant vigilance, ongoing employee training and a concerted effort to align security systems to address every phase of an APT. Companies also need to develop a remediation and response plan if, despite best efforts, defenses are breached.

report Smarter, Stealthier, Sneakier Malware
Increasingly sophisticated and targeted attacks are making it more difficult for organizations to detect and defend against the latest malware. In this compendium of recent coverage from Dark Reading, you?ll get a look at some of the newest -- and most dangerous -- malware on the Web, and what you can do to stop it.

Other reports from the Advanced Threats Tech Center:

Related Content

MOBILE SECURITY - Mapping an Ecosystem of Risk
This white paper highlights the various considerations for defending mobile applications-from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.

Software Security Delivered in the Cloud
This Solution Guide details the automated, turnkey service that requires no special security assessment expertise. It details HP's market-leading static and dynamic analysis technologies that help organizations worldwide gain insight into the security state of their essential business applications.

SANS Mobility/BYOD Security Survey
This survey, which includes input from more than 500 IT professionals, explores how organizations are managing risk around their end user mobile devices as well as what level of policies and controls enterprises have around mobile usage.

Expert Guide to Application Security - Real-time Hybrid Analysis
Explore the next generation of hybrid security analysis - what it is, how it works, and its benefits. This white paper details how hybrid application security enables organizations to resolve critical software security issues faster and at a lower cost than any other available technology.

A Mainstay Partners Study: Does Application Security Pay?
Measuring the Business Impact of Software Security Assurance Solutions: a study of 17 organizations that implemented solutions from Fortify Software, combining industry research and benchmark analysis to identify, qualify, and quantify the full range of benefits seen from their SSA investments.




Featured Webcasts
Featured Whitepapers
Featured Reports