Determining false positives in Wildfire

[cloughr]

Disclaimer- I am a big fan of Wildfire. Since implementing it the beginning of this month, it has shed much light on malicious activity on our network. Thanks for it!

Like others in related posts, I would like to know more about the criteria for determining the verdict of malware. I received a report this mornting that a Dell BIOS file, DMC521-010111.EXE, was malware. This file came from Dell, and only one anitvirus software, Comodo, recognizes it as malicious.

Is it possible that by nature of a bios update, this exe, while appearing to do malicious things, is actually ok?

I'm also unclear about the process of wildfire- when a file is accessed by a user, I assume the user is allowed to download the unknown file, then it is uploaded to wildfire, then if determined malicious is written to an update. Once the update is applied, no other users can download that file, correct?

Robert

[tettema · Accepted solution]

Thanks for your feedback on WildFire, we're glad it's useful.  Regarding your sample, we looked into it and determined that it was mistakenly labeled as malware because it was analyzed before we added Dell to our list of trusted authors.  The sample you submitted did many suspicious looking things, which can be perfectly legitimate for the type of application that it was.  The issue was corrected, and future submissions from Dell should not run into this issue.

To answer your other questions, yes, the file is delivered to the host without any interruption the first time it is seen.  It is analyzed by WildFire, and a forensics report along with a verdict is made available in the WildFire web portal.  You can use the data in the report to identify the affected host, check host-based AV coverage status, verify infection, and perform remediation, if needed.  If WildFire determines the sample to be malware, an AV signature is automatically generated and included in the next daily AV update, so future instances can be blocked at the firewall.

[mikand]

Im a bit allergic that just because its signed it will be marked clean.

Didnt Realtek got their signing cert stolen a few years ago (and some others last year)?

This way wildfire will fail detecting future stuxnet-like malware.

Perhaps the GUI of wildfire should be upgraded to handle this case?

Like yes this app acts very odd but its signed by a "trusted" issuer.

And where can one see which certs the wildfire trust by default?

I think this can be bad for the reputation of wildfire if badware wont be detected due to that PA for some reason trusts a specific vendor.

[gafrol]

Flame is another good example why you should not trust signed code...

Flame worm was signed by forged Microsoft certificate

[essnet]

Hello,

I totally support your statement about signed executables being excluded.

That being said, most installers and driver software are doing 'nasty' things like install files in system folders , hard drive sectors , changing low level sytem settings and such , so tend to be flagged as malicious ... Or is it just a matter fine tuning wildfire engine ? Is it really possible ?

Anyway, great job on these live sandbox execution and reports.

I've got a silly question : do you also execute EXEs that are installed by an installer itself ? It seems that you aren't at first look.

[mtsa25]

How does a vendor get into that trusted vendor list?