Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

9/27/2018
12:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Alphabet's Chronicle Releases VirusTotal Enterprise

Chronicle, the cybersecurity business under Alphabet, releases a major update to VirusTotal geared toward corporate threat hunters.

Chronicle, the independent cybersecurity business under Alphabet, today is releasing a major update to VirusTotal, dubbed VirusTotal Enterprise. The new offering combines VirusTotal's existing capabilities with new tools, features, and an interface for corporate security pros.

Alphabet, the parent company of Google, Nest, and other ventures, announced Chronicle in January. At the time, Chronicle was the latest program to graduate from X, Alphabet's tech incubator. It was created to help tech pros detect cyberattacks before they did harm through the combination of a security analytics platform and VirusTotal, which Google bought in 2012.

Chronicle has expressed a focus on enterprise security from the start. This marks VirusTotal's first major release since Chronicle made its debut earlier this year. Under Alphabet, the platform has grown from increased scalability of data collection, processing, and search. Now, it's leveraging this expansion to help businesses detect, organize, and address security alerts.

"We're bringing enterprise expertise in Chronicle to make the product more useful for the cases enterprises are going to be facing," says Mike Wiacek, Chronicle co-founder and chief security officer.

Security pros can use the tool to search for malware samples with VirusTotal Intelligence, look for future malware samples using VT Hunt with YARA, analyze malware relationships using VT Graph, and automate all of this with VirusTotal's API. Below, a description of what's new:

Private Graph
Businesses using
VirusTotal Enterprise will have access to Private Graph, a feature VirusTotal announced earlier this year to create visualizations of malware relationships while integrating internal corporate information and keeping it all private from other VirusTotal users.

In studying different forms of malware, Wiacek explains, security pros want to know how different forms of malware relate to one another. They can build a giant mesh of which files relate to one another, which relate to different IP addresses, which link to different forms of malware, and how all of their behaviors interrelate. This is all possible with VirusTotal Graph.

"They're trying to use that knowledge to discover new malware and new features and functionality related to it," Wiacek says.

But practitioners don't always want to share enterprise assets (people, departments, machines) publicly, so they requested a way to keep some graphs hidden from the VirusTotal community. Unlike traditional graphs, private graphs aren't visible to other users on the platform.

Enterprise users on VirusTotal have different concerns than security researchers, Wiacek explains. "An enterprise analyst has different concerns around privacy and data," he adds. A university researcher looking into an attack might not have the same concerns around keeping the process under wraps as someone trying to protect customers' information.

With Private Graph, security teams can create investigations restricted to the people collaborating on it. They can add their own data elements, combined with VirusTotal data, to visualize threats and compare internal and external data. For example, if someone's machine was infected, you can enter it on a graph and compare that threat with others seen in the wild.

Private graphs can automatically identify and extract threat commonalities from nodes to pinpoint indicators of compromise. Owners of private graphs can share their graphs with other private groups, Wiacek adds.

Ramping Up Malware Search
Chronicle reports VirusTotal Enterprise increases search speed by 100x using new malware n-gram content searches and improves search accuracy by looking for additional parameters: spam emails with a common visual layout, for example, or common icons across files.

"Traditionally, if you're a commercial customer, you can write custom malware signatures to match files, and match files to see a particular malware strain you're looking for," Wiacek explains. "Really, you can enhance and improve speed with which researchers use the VirusTotal corpus to compare malware at scale," he adds, noting that the new capabilities in VirusTotal Enterprise can accelerate searches from a few hours to seconds.

Malware analysis is also getting an update: Users will have access to more details about uploaded files, included embedded domains, IP addresses, and interest-ranked strings. The search tool lets them look for links across files, behaviors, and relationships, says Wiacek.

Enterprise Management Tools
VirusTotal is adding another layer of security with this release by letting customers use their existing two-factor authentication to access VirusTotal Enterprise accounts. A new API management for corporate groups will keep internal user directories synced with VirusTotal.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-6287
PUBLISHED: 2020-07-14
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create a...
CVE-2020-6289
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site.
CVE-2020-6290
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID.
CVE-2020-6291
PUBLISHED: 2020-07-14
SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration
CVE-2020-6292
PUBLISHED: 2020-07-14
Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration.