A Technical History of the SEI

Malicious Code Analysis
The Challenge: Malicious Code
Malicious code, 33 or malware, has affected the DoD, including the Pentagon and federal agencies,
for well over a decade [Brewin 1999, Verton 1999, Ruppe 2001]. Retail businesses, banks, and a
stock exchange have all been victims. Attackers have developed hundreds of thousands of pieces
of malicious code; some well-publicized early ones were known as Melissa, LoveLetter, Nimda,
and Code Red. Viruses have affected an estimated two-thirds of Fortune 500 companies and cost
victims billions of dollars in productivity [Frontline 2000].
Malicious code exploits software vulnerabilities. However, in the 1990s, the community had not
matured to the point of sharing tools and techniques, and doing cross mentoring. Only a few people
had strong skills in reverse engineering malicious code to understand how it works; and rather
than work together, they seemed to compete.
A Solution: Malicious Code Database and Analysis
In the late 1990s, the CERT/CC at the SEI began studying the malicious software that got into systems
through vulnerabilities and social engineering—tricking people into actions that allowed malware
onto their computers. The CERT/CC security experts had already become skilled at analyzing
software vulnerabilities. The malicious code work was prompted by CERT/CC incident responders’
seeing the role malware played in computer security incidents. By 2000, malicious code was exploding,
and the staff began more thorough analysis efforts [Bair 1999]. In dissecting malware, they
compiled a wealth of information not only about malicious code but also about how technology
fails, what assets adversaries target, how they acquire targets, and who the adversary is.
The CERT/CC began building a database, which became known as the Artifact Catalog, 34 a repository
of malicious code and related analysis that informs triage decisions and provides a basis for
cross-threat analysis. The malware analysts also worked to establish relationships within the security
community: for example, by raising awareness at professional conferences and by working
with experts through email. This visibility led to government interest and funding for the SEI malicious
code work. Congress had become interested in solving the problem of malicious code and
heard testimony on the subject. One of those testifying was tasked with “doing something” regarding
malware, and the CERT Artifact Catalog proved to be the answer to that charge. Funding
subsequently followed, allowing the work to grow.
The CERT/CC created a separate, focused malicious code team, which had these primary goals:
(1) improve approaches to reverse engineering, (2) bring those doing reverse engineering together
into a community that would work collaboratively and learn from each other, and (3) reduce duplicate
work in the community to make effective and efficient use of limited resources, as well as
33 Malicious code is a form of cyber “tradecraft” used by adversaries to subvert the security posture
and compromise the assets of organizations.
34 The original intent of the catalog was to collect things left behind on an attacked machine, which
the staff referred to as artifacts. These artifacts included malicious code but also logs and other
files or items left behind by an intruder.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 173
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.