Should I go ahead and start with my screen share?
Uh, you can go ahead and share. I'll go ahead and introduce.
OK.
Uh, welcome everybody to master class for tonight 10272022. I've
been doing dates so I don't wanna mess that up for the year.
We do have Scott Tebebi tebebi tebebi.
And you said the right first time.
My said alright, OK, thank you. And break McCann tonight. Who
Yeah.
will be presenting? Starting with Scott. Welcome, everybody.
Glad to see you here and enjoy.
Go ahead.
Alright, alright, alright. So guys, today we're gonna be doing
a presentation around malware analysis. We're gonna kind of go
over what is malware analysis.
No. No purpose of it. I'm gonna tools that go into it and we'll
finish off with some questions as well, alright?
Alright, So what is malware? So malware is just. It's Melissa
software, you know. And for short, they just call it
malware, obviously, if you if you're.
If you're a stickler for English and vocabulary, so I'll malware
is is just. It's kind of like it's like a it's like a disease.
You go to the doctor, you tell the doctor you're symptoms.
Doctor treats your disease.
And that's what malware is so.
Some of the reasons why you would get malware is.
You know, maybe someone wants to rob you of your Bitcoin, or
maybe you want someone wants to get back at you. Maybe as a a
former employee that it's kind of upset or former. Whatever is
upset with someone and they want some retribution.
And that goes for the same with revenge and reputational damage.
The reputational damage is a big one.
Because.
If you give breached with some malware, it could cost you
greatly. I can go into detail a little bit about that a little
bit later on some common examples of malware stuff like
bot Nets which is zombie computers. You've got worms
which replicate themselves across the network.
And now imagine that.
We've got Trojans that kind of they're designed as, as as
something let's say, for example, you might see a, a an
icon on your desktop that says.
Internet Explorer? Nope, that's just the icon. That's something
else running in your background, though, and you got spyware that
it's covertly designed. The steel. Whatever data that they
have, whatever data you got going on, and where, which is
just a bunch of ads popping up all over the place. He got
ransomware well.
Because we do some English here.
They told your your data for ransom.
Alright, next slide.
Alright, So what is malware analysis? Malware analysis is
just.
And it's the investigation of others read where, verbatim
here, investigating the characteristics, functionality,
origin and the effects of malware. To understand this
fundamental parts source code as well as to lessen the threat and
stop future occurrences. So and then analogy that I wanna use
here is.
Umm.
Therefore, you're a scientist in a lab.
And.
You wanna understand how?
Ohh virus works like a actual like a physical virus. One
understand how higher works. What does it do? You know the
effects that it has and then you wanna kind of test it on Guinea
pigs, Lab Rats.
But we'll go into a little bit more detail about that a little
bit later.
OK.
Alright, so static analysis.
So I'll stay static analysis is, is it's it's something that it
takes note of of of the details and the architecture of a file
in question question. So let's say for example.
Let's say you have a a somebody emailed you with document. Let's
say it's a Word document.
For all you know, for all you know, this is a legitimate
document. But.
You know if if somebody takes a.
Figuratively speaking, takes a magnifying glass to it and
analyzes a little bit further, puts it under the microscope. It
can kind of see that this isn't the normal, you know, Word
document. So some of the items that can be in.
On a on a Word document that will any document, any file.
What what we would be looking for in static analysis is things
like hash values, malicious strings embedded in the code you
know.
Things like metadata when when the file was created, you know
the user name of the person that was that was created by, you
know, a little details like that. Think of it as when you
say you take a picture with your phone, you can go on, you can
look at the the date and some phones and some pictures you can
even see like the location of where the picture was taken. So
in a in a nutshell, all static analysis is is it just gathering
the information. That's it.
Just gathering information and.
You know, sometimes this is enough, sometimes it's not. So
in times when it's not.
You would implement.
Uh, dynamic analysis, but we'll get that down. We'll get there
down the road. So some of the tools that we use for a static
analysis or a, you know, virus total.
Hybrid-analysis.com, Jacky, malware scan and screenshot
machine so.
You you start by submitting a file.
And this screenshot right here that we're looking at.
Yeah, it it's it's it's been taken after. No. I uploaded a A
a malicious file. I'll actually go through it live and a live
demonstration here shortly.
And.
What it does is in the in this first screenshot is a is a list
of vendors starting with who found the submitted malicious
files. So you'll see as you can see there, like adware, Al Yak
was just different little vendors that.
People upload.
Uh, malicious files too, and it all kind of works together. They
all kind of work in unison with each other, and then in the in
the following screenshot you see a display of the hash values.
You see a MD5 here you see shy one you see SHA 256.
All these little hashes and.
In a static analysis.
You know a file has been tampered with if.
The file hashes are different. Once those change it's been
tampered with bottom line. So let's say I send somebody a.
Let's say I'm sending somebody a Word document.
And.
You know, all they do is view it. If they send it back to me.
And I checked the hash values, it should match the same as when
I sent it. Now those hash values changed. That means that it's
been mocked, the doctor's been modified to some degree now to
what it can be non malicious. It could be malicious, you never
know. But that think of that as like part of the DNA.
Then in the last screenshot it just shows like the process tree
of what happens when you know the file is open or what where
the where the path is and whatnot.
So after static analysis, we're gonna move on over to dynamic
analysis and the point of dynamic analysis is to observe
the behavior of malware in a runtime state. So.
Let's think of.
Let's think of static analysis. As you know you you just
gathering information and you may have you may develop a
theory from the information that you have, but then OK, now you
gotta go and do you know a a trial and see exactly what
happens, let's say. And I don't know if you've ever heard of
those.
Umm. Study groups, where they're gonna do a test.
To test that theory, to see how that works, that's kind of more
like what I've done. That dynamic analysis is so in a
dynamic analysis, you would do things like run code, you're
trying to find out what does it do? When does it do it, and how
it's doing whatever it does. And usually this is done. It's
produced in like a in a sandbox.
Typically, there's two ways that some people do it. Some people
do it on just like a actual spare device that.
You know, they don't really care about or they do it in a in a
virtual machine.
And you know, let's say let's say you wanna test something
out, you have. Let's say you run, you spin up a VM using. You
can use VM Ware. You can use VirtualBox. You can spin up any
type of VM. It could be a windows VM or Mac VM or Linux
VM. Any type of environment. And then from there you can run the
code and you can see the behavior and see what happens.
You know you wanna look for things like the CPU spiking is
the what is the disk usage like is the.
What's is my computer moving a little bit slower, just
observing the behavior from that point.
So.
And the dynamic analysis tools, we can use things like
Wireshark. You can use task manager. Actually you could use
a one, one that I really like Carla any dot run. And then
there's one that I kind of took interest in called Gidra.
So in the screenshot that you're looking at, this is from
Wireshark and you can see here the packet list pane.
And then what's happening here is wire shark is capturing all
the traffic on the given network.
And then if if you click you know you can click on the given
packet and expand it and then view and you can review like the
metadata of what's going on. So as long as you running.
If you see the little shark Finn right here.
You hit that and that'll kind of.
No, sorry. There's actually like a green start button. It's not
this shark thing. It's like a green start button. It'll start.
It'll start capturing all the traffic going in network. And
until you hit stop, it's just gonna keep capturing traffic.
Anything that's coming in and out of your network. And
Wireshark is picturing is is is picking it up. So there's FYI
beware logging on the public Wi-Fi like Starbucks.
You'd be surprised.
Then, alright, so we have hybrid analysis so.
In this instance you use hybrid analysis. OK, so let's say so.
So static malware analysis can't detect sophisticated malicious
codes and dynamic malware analysis might not succeed in
detecting sophisticated malware as they hide in the presence of
a sandbox environment, right?
This approach is technically the best approach overall. However,
from a business perspective, the cost and the accuracy kind of
forces organizations to choose a method of analysis carefully.
So.
How about analysis?
If it's just a combination of both static and dynamic, but
depending on your budget.
You have to kind of pick one or use more or less of one or the
other depending on what the issue is.
That's just kind of like a quick overview of having analysis and
how it's used and when it's used.
Alright.
So before I play this.
I'm just gonna give you a quick.
Quick overview of what's gonna happen, so I'm just gonna
demonstrate.
Actually recorded this video right here, but I'm this is just
gonna be a demonstration of both static analysis and dynamic
analysis. So I'm doing the hybrid analysis here in this
video and I'm gonna use some of the tools that we discussed
earlier. So I'm gonna go ahead and play it. Let me know if you
can hear the the sound.
Are you guys here?
No, I don't hear any sound.
Now.
No.
Ohk ohk. OK Ohhh alright and next and next case one second.
No, sorry.
You can stop sharing the presentation and then reshare.
With sound.
OK.
But let me do that.
One second.
Alright, so now.
Ohh I'd I. There you go. Yeah, close that down.
There we go.
And then there's that toggle include computer sound.
Yep, I see it. Here we go.
So go back to our slide here.
Alright. Hello Master class money you guys here.
Yep.
Alright, perfect.
Him. Scott. Today we're gonna be doing a demonstration of malware
analysis. Now, this is gonna be a very basic demonstration due
to time constraints and brain cell constraints, we don't wanna
go too deep into this because this isn't exactly easy, but the
basic version of gets you the gist of what is happening.
Whenever someone's doing a malware analysis. Alright, well,
let's go.
First thing we're gonna do, we're gonna download a
suspicious file. How do we know this a suspicious? Well, I've
been testing it, and let's just say we'll find out.
Alright.
Download Ms toolkit.
Alright, let it download it. So it downloads folder.
OK.
Ohh man, what do we see here? Failed virus detected.
When you see something like this, that tells me that my
antivirus more than likely is the one that blocked it from
downloading.
Let's check and see why.
So in my case I use a Windows security. Sometimes on this
Windows Defender.
Alright, So what we're gonna do is we're gonna come here to
protection history. Boom.
Alright. As you can see I've done a number of takes.
6 to take Jake, how many times have I said that in a recording?
Alright, so we're going to try to.
Expand this here and see what is going on and see if we can get
some information from our.
Antivirus, so obviously we can see here the threats been
blocked.
It's been detected as a Trojan.
Alright.
And where the file was gonna be downloaded to was my downloads
folder. As you can see it was gonna be downloading from a web
file from here and if we do a quick static analysis here,
which is what we're doing, we're doing a static analysis.
Alright, we see that there's URL. Interesting. Now do we
wanna copy this URL and paste it and one of our web browsers on
our local device and I don't think so. That's probably not a
good idea. But what we can do is we can plug it in.
To a.
Dynamic analysis tool. That's right.
As we can see, this is the URL right here. Ends in dot zip.
So when the copy this.
Alright.
Now let's open up our dynamic analysis tool.
Any dot run. It's really cool tool where you can.
Open for you can upload files and you can put in your URL's.
Normally we would upload the file but we we're not gonna do
that in this case because my antifire is blocked it, which is
awesome. Did its job. So alternative this enter the URL.
So.
What any .1 is gonna do is it's going to spin up a Windows 7 VM.
And.
Once we put this URL in here.
You'll see it spin up.
We're gonna try to play with the file, run with the file, see
what happens. See its behavior.
See what happens on the network. We're gonna see. We'll see a lot
of things you can see here.
Wanna timer?
So what we can do is we can add some time because we don't know
how long we're going to take, right?
OK, it looks like it won't let you go past five minutes, which
is cool.
You'll see some processes pop up over here on the right, and
you'll see some more information popping down here on the left,
but we'll get to that here in a moment. So why is this a dynamic
analysis? Because now we are. We are in motion. We're gonna try
to run the file, we're seeing what's happening live and.
Since we've already done our dynamic analysis, we've already
gathered information. Now we're going to test and see what
happens.
So let's go ahead and try to open it.
Right.
So you can see here.
This is a zip file.
So let's see.
If it'll let us extract it.
We're gonna extract to the desktop, since that's the
easiest place to extract things too.
Alright.
Minimize this. Let's look on our desktop for this file.
Alright, we see it here. Still looks like it's in a.
Zip. So I'm gonna try it again.
Extract here.
Alright. Ohh until password, why is it asking that well?
Let's look here.
In the original ZIP file.
We saw password for.
It should say password for archive. Yep. Well, open us up.
Alright. We don't see anything in here.
So.
Let's assume that there is no password to follow or to enter.
Alright.
So we're just gonna come and press enter.
This was the specified password is incorrect. Alright, no big
deal, right?
I still go back to the zip folder and see what we can see.
What else we can come up with.
Let's see what we see inside of. Alright, I'll see if it open it
that way.
Alright, see executables in here.
See read me that THT's in here.
Alright, we're not gonna quite open those yet. Let's see.
As far as open up a task manager.
And let's look at performance. See if anything goes haywire
when we try to run the EXE. Let's see what happens. You know
it's still in the zip file. Let's still see what happens.
Alright, still being asked to put put in a password you don't
see anywhere for for a password.
And that's OK. Ah.
Let's see what we have over here on the right.
I see.
Some more whatnots popping up here.
The more processes by the way, as you can see right here
processes just click on them and see what happens, alright.
No verdict.
Look down here says no verdict.
Alright, username admin, this is who was trying to open it. More
info.
Click on that.
They modifies the phishing filter for Internet Explorer.
That doesn't sound too good.
OK, that didn't more time, so we gotta hurry up. So what happens
when you're on the free version?
Alright, so again you can continue to click on these and
look at the information presented down here.
You know, see a warning application launched itself.
Alright, that means that more than likely there was something
trying to run in the background for trying to launch itself.
Alright, these two say no suspicious events.
Alright, manual execution by user. OK, that's good. That's
us.
Alright, so if you look here, these are just the HTTP request.
Uh, you don't see any any red. Red is bad, green is good.
Alright, connections. Ohh we already see some red.
This is reputation, reputation, reputation for this is
malicious. OK reputation for this whitelisted. So it means
we're good to go here.
Alright, let's look at the DNS request. As our time runs down
alright, so malicious reputation for this domain. But also we
look here and we see.
No threats, but just because we don't see any threats, that
doesn't mean there's anything you know, that doesn't mean it's
good to go. That just means there was no reported threats or
no threats found.
Alright and our timer is up.
So on the next slide, we can kind of discuss this a little
more.
All right.
Ohm.
So.
Before.
I'll get into kind of the goals upon graduation that anybody
have any questions about what we just watched.
I'll I'll ask. I have some notes jotted down, so I'll I'll ask
OK.
after Blake's presentation when it's the Q&A. But yeah, good
OK.
OK, awesome.
job. Interesting.
Awesome, awesome, awesome. Alright, alright.
So I have a quick question that those are anyone?
Yeah, yeah.
And that's basically for for. If you just wanna check if the
malicious the the URL is malicious are not correct.
It can be a URL, it can be for a file, either one.
OK, alright. So anyone. Thank you.
Yep.
Yep, no problem, no problem any dot run.
OK. And you got one I got you. Thank you.
Yes, Sir. Umm alright so.
That was my malware analysis presentation, but I also wanted
to.
Kind of touch on my goals upon graduation as I am going to be
done here in a few weeks.
But it's crazy it's been.
I started last August.
And.
I didn't know what to expect really.
So this this whole course, this whole program kind of got me
moving in a direction that I wanted to go, so I've forgotten
exactly out of it what I was looking for. Now I know I wanna
get my security plus certification after graduation.
Obviously I couldn't do it during because that was a.
That's a lot.
I'm currently working in the field.
As a endpoint security engineer, but after graduation, obviously
I'm gonna have a lot of extra time, so I want to see if it's
possible to get a second gig and see how see how that goes.
That I'm kinda in learning phase right now. I just like learning
a lot and you know you you really learn a lot on the job.
So I wanna see what else is out there and see if I can do a
double dip.
One thing I'm really big on is mentorship.
Already kind of trying to groom my nieces and nephews to get
enough cybersecurity, but I also.
I'm probably gonna, you know, just start reaching out to other
classmates or even undergrads that are still.
You know, it may have some questions that may that may want
to, you know, find a direction to where they wanna go and what
they wanna do after they graduate.
Because not everybody, not everybody, has an idea. Even
still after graduation. So now if anybody wants to talk about
that, I'm open. And then also want to pursue.
And the CSA plus certification, I do wanna be a Social Security
analyst as well. There's a lot of things in Social Security
that I wanna do, but I actually love analyzing. It's.
Very fun, like I can really sit there and do it for hours and
not get bored. So those are my goals upon graduation.
Ohh.
Thanks. Thanks everybody. I've really enjoyed this internship.
Yeah, I don't regret it at all. It was between this and the
capstone it internship. I would encourage any and everybody to.
To to do this, if you know anybody who's up next for a
capstone or or to do a internship.
I encourage them to do the internship. It's really good
environment, especially if you apply yourself.
And then you know, it's a good environment to kind of network
with classmates too. We never know who you can, who you can
help out. You never know who can help you out down the road.
Alright, I guess we're gonna do a Q&A after the next
presentation and not this one.
Correct. Yep.
Correct. Yeah.
OK, OK alrighty.
Thanks everyone.
Great job, Scott. That was awesome.
Thank you. Thank you.
All right, Blake, Are you ready?
Yep, I'm ready.
OK.
Get this set up.
Alright, so I did mine on object oriented programming.
The agenda for my presentation will be as follows. I have a I
have a brief introduction. We will look at some of the
languages that utilize object oriented programming, then look
at a few alternatives to object oriented programming.
I'll do better to find what object oriented programming is
and show some examples of how classes play a part in object
oriented programming.
I'll discuss the four main pillars of object oriented
programming, which are inheritance, abstraction,
encapsulation and polymorphism, and then with a brief summary.
So for about a year now, I've been working with Java and by no
means and expert, but I like to think I have the basics
mastered. Part of the basics of Java is object oriented
programming or OP. Understanding the four pillars of object
oriented programming will improve your ability to work
with Java and other languages that use object oriented
programming.
So the languages.
These are some of the popular object oriented programming
languages. Pure languages such as Ruby consider everything
objects other languages such as Java are designed primarily for
object oriented programming, but still use some procedural
processes. Languages such as JavaScript support object
oriented mechanisms.
Alternatives.
These are some of the alternative programming
paradigms I've found to object oriented programming. I'm not
gonna go into a great deal about each of them, but it will touch
on procedural oriented. As I mentioned before, some languages
such as Java primarily use object oriented programming, but
use some procedural processes. Procedural programming divides
the program into smaller parts called functions.
It makes the code less reusable as it does not offer inheritance
and we'll get to more on that later.
Uh, so define object oriented programming.
This is one of the clear definitions of object oriented
programming that I found just from educative IO, and they say
that object oriented programming relies on the concept of classes
and objects. Classes and objects are the two keywords I wanna
focus on here.
Ohh, as it says, classes are code blueprints used to create
an individual instance of an object. So I want it to look at
a real world example to kind of help better visualize it.
Looking at the side slide, we see the classes are blueprints
for objects and objects are instance of a class. So think of
a blueprint for a house. It has all the information needed. How
big it's gonna be, how many rooms it will have and so on.
Looking at the picture below, each house is an instance of
that blueprint or a single occurrence.
And for me in my head, this is how I I defined or how I see
object oriented programming.
Objects are blue, are instances of a class, and classes are
blueprints for objects and it just goes around in a circle.
So I wanna discuss uh classes next.
So earlier I said that blueprints are classes contain
all the information about the house object. So let's create
our own class to use for the example. For the presentation,
let's call it a cat class. I have two cats, Kiki and mittens.
The mom is Kiki and the daughter is mittens. But then being
mother daughter won't be important to the topic.
So here we can see our cat class and the cat class contains
variables and methods or things that knows and things that can
do so the name, age, weight and color. All described the cat
object and play, eat and drink all describe what the cat object
can do.
So now we have two instances of the cat object, one for mittens
and one for Kiki. This leads us to one of the first one of the
four main pillars of object oriented programming
inheritance. I'm gonna keep with the animal theme and add two
more classes.
So inheritance.
Inheritance is when a child class inherits data from a
parent class.
Or the parent class extends variables and methods to a child
class. Child classes can have a can have their own additional
variables and methods as well.
So now looking at this, we have an animal and a dog class. The
animal class contains all the variables and methods and the
cat class and the dog class just extends the animal class.
So meaning when we create a new cat object, we have access to
all the very all these variables and methods without having any
code in the cat class other than putting extends at the end of
class. Same for the dog class.
Inheritance in basic terms, is where one class acquires the
variables and methods from another class.
So now abstraction.
Abstraction can be applied to both classes and methods.
Abstract classes cannot be instantiated, but they can have
subclasses. Abstract methods are declared without implementation,
so let's start with abstract classes.
Looking at the example from inheritance, technically I can
create an animal object that would have the same attributes
as both the cat and the dog class. For example, the animal
object being an animal object is a little vague.
Umm, we don't know what kind of animal it's supposed to be.
However, we do know the variables and methods for it,
but that's it.
Ohh, what if we don't want to allow the instantiation of the
animal object?
Will it simply add the keyword abstract to the animal class?
Adding this add some security and won't allow anyone to be
able to create an instance of the animal class.
Now I abstract methods.
As we said earlier, abstract methods are declared without
implementation. The abstract keyword is added to the method,
but the method is built without any code in the method body.
Instead, when you use the method in a subclass, you must
implement the method there. The best way I could demonstrate
this was to use a code snippet. Here. You can see in the animal
class there is.
3 abstract methods for play, eat and drink.
There is no code entered for these methods, but in the cat
class we have the same methods but with code in the method
body, so that's where it's.
It's built in the.
The cat class.
Encapsulation.
Encapsulation is the hiding of attributes of a class. These
attributes can be accessed only through methods.
Uh.
Geeks for geeks, a website that's.
That I got a really ton of good information. They say it the
best that encapsulation is protective shield that prevents
data from being accessed by code outside of the shield.
Uh, this adds a layer of security to the to the program.
Encapsulation is done by declaring private variables and
creating a public getter and setter methods. Think of a pill
in this example, all the contents within the pill are
protected by the capsule around it. Encapsulation provides more
benefits than just security. It also makes the code more
reusable and easier to maintain.
So here's a code snippet of encapsulation at work we have
private first name and last name variables and these are accessed
through getter and setter methods. Below these methods are
just what they sound like. They do. The setter method sets the
name and they get our method gets the name for times sake.
I'm not gonna go into great detail about the code, this is
just what it looks like.
Polymorphism.
Polymorphism is a combination of two Greek words, Polly, which
means numerous, and Morpheus, which means forms. So
polymorphism means numerous forms or many forms.
Polymorphism can occur in two different ways. Method
overloading or method overriding.
Method overloading is when multiple methods within the same
class have the same name but function differently.
This is also known as compile time polymorphism.
Method overriding is a method in the child class behaving
differently than the parent class, or it overrides the
parent class. This is known as runtime polymorphism.
Method overloading is kind of straightforward, I said. It's
multiple methods within the same class that have the same name
but function differently.
This is also known as compile time polymorphism, so I've added
an add class with two methods.
Both have the same both names Sum 1 takes in two arguments and
the other takes in three arguments.
They can have the same name only if the arguments are different.
And then method overriding is when the child class behaves
differently than the parent class.
We can have a speak method in the animal class that just says
hi and create new classes that extend the animal class which
allow each new animal to call the speak method. But each
animal speaks differently and doesn't really say hi if you
call it the dog method of speak it would say wolf. The cow would
be moved out, would be hooked and the cat would be meow.
Ohh the methods and the child class behave differently than
the parents than the parent class because they have been
overridden.
So with a solid foundation of object oriented programming,
you'll be able to write clean, organized code that is highly
reusable. It also makes programs easier to understand and more
efficient.
Now I want it to do kind of a live demo.
OK. So can you all see the eclipse?
Yeah. OK.
All right, so.
Here I have a cat class, so that's the same thing as was
before.
It has variables and methods, things that knows and things
that can do.
So I'm going to create a cat object.
That is a cat object. So now we can.
Name the name. The object. We can Add all the variables and
have it run the methods as well, so.
I'm not going to do all of them, but so it can run all of these
variables.
Methods.
Here.
So there we go and that is.
Just the program, the cat object as it is right there so.
Now what I wanna do is we're gonna delete this.
And then.
We're gonna do the inheritance part of it.
So what I'm going to do is delete everything from the cat.
Class here and then I'm gonna go to the animal.
At this copied and pasted. So now this is the animal class and
everything is in the animal class.
And now we are going to.
Extend.
So now we are extending the animal class. There's nothing in
the cat class.
And.
Extends.
The animal class, so that's for both the cat and the dog class.
So now whenever we go back here, we can create.
That object again.
We can create a dog object.
But we can still access these variables.
That's just fine.
And this is all the variables that we have access to and these
are the methods drink eat.
And play.
Uh, so we can set all of these.
As well.
Of but I can still, I can still make an animal object.
And we don't really want that to happen.
It could.
Yeah.
OK. So yeah.
So we don't really want that to happen.
So let's make the animal class.
Ohh already had it as abstract, that's why it was showing that
error error.
So now if we go back.
It created it no problem.
And if I go back and add abstract to it.
It cannot instantiate type animal, so now we can't create
an object of animal.
So that is the abstraction part of it.
Yeah.
So let's make.
Drink.
Method.
So it's telling us that we can't have anything in the method
body, so we'll delete that.
And then we will add it to.
The cat class.
And then we got added to the dog class as well.
No longer on that, we will get the catastral drinking and then
the other one would be dog. So that was abstraction and
inheritance.
So in capsulation.
We can do set this to private.
And then would you do with this, there's a shortcut.
Do source generate getters and setters?
And we're just gonna do it for a name.
And now we have a problem of trying to set the name for.
Uh, the cat object and the dog object.
So now we have to just do this.
Use the method of set name.
Be able to set the name and then to be able to retrieve the name.
All the cat object again.
Get name.
Then we print that out.
Would be.
Right there.
Uh, so that is quickly capsulation and then?
Polymorphism.
Uh for the method overloading 1.
That would be having.
A method with.
The same name more than once. So we'll do.
Play.
And then it'll take in a.
Argument I could spell.
That one. So we have the same method, play and play. One takes
in an argument and the other one does it.
So I'm gonna add one thing to the cat class will be a string
toy equals.
Yeah, nip toy.
And then I'm gonna go back to.
Main method.
We're going to call cat the cat object 2 play.
And there's two. So we're gonna pick the one that takes in the
argument of toy.
And then we got to do cat reference or cat object and then
reference the toy.
Call that.
And this plays with Toy, so that was method overloading and then
method overriding.
Uh.
That is going to be where we just add.
Instead of in the animal class we have eat and it just says the
animal eats, we can go to our dog class and add.
At 8:00, it and.
Whenever we call our dog object again.
That shouldn't be capitalized, but that's OK.
Call it, it should say the dog eats instead of the animal eats.
So it's a lot of stuff, but.
That's all I have.
Right. Awesome job.
Well done, I enjoyed it.
Thank you.
Alright. Does anybody have questions for either Scott or
Blake?
I got a question for Blake actually.
OK, what you got?
OK.
How did you get interested in it?
In what part?
Man, I I I couldn't describe it if I wanted to, man.
It's a lie. I didn't realize that it was gonna be so much. I
picked a broad topic.
In hopes to like just be able to fill the 15 minutes. But after I
was like halfway through I said ohh my gosh it's gonna be way
too much. This is gonna be a lot of information.
No, that was that was good.
But it's.
That's understanding that is like the main concepts of the
object oriented programming.
Yeah, it reminds me a lot of databases. I don't know how many
And the problem.
of you have taken database classes, but.
Yeah, with with the relationship relational databases.
That classes and methods.
Well, and I'm definitely not a programmer. This is Tina,
everybody. Hi.
But what I one thing about programming versus cybersecurity
or something else? Is it kind of stays the same because I don't
wanna tell you how many years ago Blake that I learned what
you just talked about. I I mean, I shouldn't say I learned it. I
heard it in class.
A really long time ago and refused to learn programming.
I've never been into that, but it's kind of stable as far as I
mean. I'm sure it's changed a lot over the years, but it just
like what you described is is how it's been for a long, long
time. It's my point.
Right. The concepts stay the same.
And so at least.
Yeah.
Right, right.
I mean, at least that's the the the upside, I guess, of being on
the programming side is things don't change like every day like
a new malware or a new virus or whatever. It's like every other
day. You know, there's something new at that. You have to learn
in cybersecurity. But at least once you learn the programming
concepts, which they're very hard to learn. But if you could
master that, they kind of stay the same. So.
To some extent.
Just just a new syntax every now and then with a different
language.
Yeah, yeah, exactly. And even my programming people tell me
because, you know, like I said, it's not my area of strength
that if you kind of look nerve one language and you're good at
it, then the other ones come really easily after that.
Which I don't know if that's true or not. You know, I I like
it it to languages just because I can learn Spanish doesn't mean
I could learn German, right?
Good point.
But.
Well, I I know both so.
Ohh wow.
I don't know. I'm just saying I don't think they're quite cool,
but.
But it was very good. Both of you did an awesome job, Scott as
well. I mean very interesting stuff. So thank you.
Thanks.
Yeah.
While we have Blake here, can you tell us what the best times
to use? You know, in capsulation versus method overloading versus
method overwriting etcetera.
Is it just?
Programmer preference or?
And no, it's a lot to do with uh security and readability and
reusability. So you can.
Use the.
Use the code more efficiently. It's easier for other
programmers programmers to understand it.
Ohm.
Then it just it won't.
It won't allow somebody to accidentally create something
that they shouldn't create.
Whenever they're doing, whenever they're programming.
Gotcha.
And does anybody else have any questions?
Because I have some for Scott.
Get ready, Scott.
I'm I'm I was born ready.
When you were talking about the static and dynamic analysis.
Yes.
It reminded me a lot of sast and DAST.
Is, is are the tools that you use for the static and dynamic
analysis the same for like?
Umm Static app security testing and dynamic app security
testing.
To be honest with you, I'm not sure, but there's a possibility.
I mean it. It's it's about the principle though, right? If the
Yeah.
principle is to just.
Test out.
What something does, then? Technically, yeah. Or if you
just depends on what the goal is, cause malware analysis is
just one.
One thing that you can use those tools for.
Where are you?
Thank you.
So I think it just depends on what you're what, what's your
goal is the immediate goal is.
Because.
Since I think 2019, we we've worked on this thing called the
Loyalty app. It's been a Purdue project and we have it mostly
Umm.
OK.
done.
But now Nate and I think it was Sean, maybe Daniel and I were
talking about bringing it to you security people to Sast and DAST
test. But I know it's it would be performing the static and
dynamic tests on the code.
And we have to figure out how to load it all up to AWS to host it
so that we have a URL for you guys to test for the dynamic
but.
Yeah, it just reminded me of that when you, when you were
talking about that.
OK, I think I see what you wanna do. I think it sounds like you
just wanna well.
Test the code.
Yeah. So.
The two OK. So for example, let's say.
Let's say let's, let's use the any .1 that we used in the in my
in the demonstration.
All that would do.
If let's say you upload, well, if you have it as a file format.
Yeah, yeah, you can upload it into any that run and then you
can.
They kind of go from there and see how it reacts on the on a
whatever operating system that.
That you want to host it on or that you wanted to run on unless
you wanted to run in the cloud, like if you wanted to run in the
cloud, that's different.
Yeah, it would be cloud.
If this cloud based. Yeah. So that's a little bit different.
That's a bit different. I am not that learned on how that will
work quite yet cause.
Most of them were analysis.
Is it's just gonna be a file that you're looking at. Let's
see what's on it and what it does.
As far as something running in a cloud environment.
That's interesting. I didn't really. I don't know. I don't
know why, but I didn't think about it like.
Which makes sense though because.
Yeah.
I think I think, though, that what you were talking about with
the analysis and what we were talking about doing with the
code.
Testing the assassin DAST, I think those two are very
similar. I I was just worn, wondering if the tools because
I'm I'm not that familiar with it. I know the basics, the
Umm.
concepts but.
OK, I got you.
Yeah. So I wasn't sure if the the tools would be the same.
No, I think you might be looking for more like a.
Uh vulnerability management or vulnerability testing or
something like that? Like he I think you want what you wanna do
Umm OK.
is you wanna see where the holes are.
Umm yeah.
Yeah. OK. So that would be that would be more like a risk
assessment actually.
OK.
All right. I see a couple of other people have their hands
Yeah, I watched.
up, so.
Ohh do I call on them?
If you want.
Ohh I don't know who had the. Ohh, let me look at the. OK,
Lucian.
And I say that right.
Hi, yes, hi Scott. I do have a question. Did you try the cause?
Ohh awesome. Awesome.
I saw the website that you used the run.
Did I did I travel?
They have the free version and they also you have to pay.
Yes, yes, yes.
They have a membership. Did you try to use the cuckoo? They have
the they have a online too. Like, I mean, you can download
install which is very cumbersome.
Uh sandbox to install.
Yes, yes, I didn't, only because.
I can pretty much do the same thing with. I can easily just go
spin up a VM on my machine right now.
I use VMware. I can and pretty much do the same sort of thing,
so I didn't really bother doing that.
But I wanted to use any dot run because that's an easy sum.
That's an easy website that anybody can kind of go to and
play with if they like.
Yeah.
OK, I I I didn't know what would. What would be the
advantages of using that over cuckoo? Because they also have
Umm.
like a free.
Website where you can upload or you submit to your aisle or
Umm.
hash. So I don't know what's the difference. Do they have more
Yep.
signature based?
Or do they have a better?
Umm, I don't know way of presenting you statistics maybe,
but I don't know. Thank you though.
OK, that would have been a really good thing to test out. I
could have been like a side by side from compared, you know
what I'm gonna do that on my spare time and just play with
it.
OK. Thank you. That was my question.
Yeah, I'm. I'm a weirdo. I'm a weirdo like that. I like. I like
playing with stuff and testing stuff out, and that's why I like
network analysis. I'm just a weird guy.
Thank you. Good luck.
You're welcome. Thanks.
We're all weird in our little way in the tech field, I think
because, you know, like Blake, he loves the back end code. I
love the front end code and.
You get excited about malware.
As I can.
Yeah, I I actually have a little bit of a story on how why I'm
even why, how I even got there, but I'll save that for after
James was question.
Actually my questions more or my comments more towards Angela.
Angela, what you're talking about with Sast and DAST is a
code security review done by the nonprogram. Well, a programmer
who is not involved in the actual coding of the application
as well as a security review dynamically done at runtime.
Effectively a vulnerability test I believe.
Umm.
My recall of.
The articles I had to read on it for class. So yeah, there's
going to be some overlap.
Between what Scott was showing us and those processes.
But there's going to be a whole lot more to it, cause it'll be
up like the static.
Review is done line by line by an actual programmer who
understands the code but didn't write it. Looking for the
logical errors.
Or ways that they can be exploited.
Yep.
I forgot about that class. What class was that again, James?
OK.
Because I think I remember that class. I just so many classes. I
can't remember my mom.
Yeah, I don't remember exactly which class it was in, but I
think it actually came up in multiple classes through the IT
programming.
OK Ohf IT programming cause OK alright cool.
Yeah, I've been. I'm in the I getting the IT degree, which
just a concentration in cyber. So I didn't didn't classes
Ah.
outside of cyber as well.
Yeah, they thanks for that information. It's written in PHP
and the only one who knows it who's still here is Ryan, and
he's pretty busy. So I'll see if he can do a sast analysis. He
was he was starting to do it.
And he wasn't sure what tool to use.
So because we we've never done it here before.
But we do want to.
I believe Daniel.
Daniel's gonna help us with the tools. We yeah.
Yeah, Daniel's gonna help us. But if if a sass.
We're gonna pick a few open to open source tools that we're
gonna use.
OK.
So you can can use a sast for a tool for the SAS.
Yes.
OK.
Alright.
Yep.
So real quick as when it kind of share a quick nerdy story. I
don't know if anybody can relate to this. So how I even got to.
Even be interested in now we're analysis is because so as you
know, when you're a broke college student, you try to find
free stuff. What comes with free stuff. Something wrong? Most of
the time. So I used to call myself the BitTorrent king
because all I had was my laptop. But I could download any
software I needed or whatever, whatever I need it off the
Internet to help me get through school.
And sometimes I get.
Compromised.
So.
What happens when you give compromise? Well, whatever's not
Reboot.
working right. That's the first step. Really. So you go in, you
go to Google, and you just literally type out exactly what
the problem is. And you kind of deduce it down from there and
try to figure out how to deal with whatever you got going on.
So I that's when I started to.
Kind of get a good interest in.
And just testing stuff, not necessarily malware analysis per
se, but.
This testing things out if you're getting out of something
is good or not, so that's why those tools are kind of valuable
is because.
I would be able to.
Upload one of those documents to, let's say, virus total, and
let's see if it comes back as as if it's been reported as
malicious in multiple places. I can see now if it has or not,
and also keep in mind if anybody wants to play around with
anything like virus total or any of those static analysis tools
just cause it doesn't say that it's malicious. That doesn't
mean it's not malicious. That's just been what's reported cause
you might have been the first person.
To deal with whatever you're dealing with and turns out it is
malicious.
So just an FYI.
Right, like with your dynamic test, there were problems, but
it didn't say that it was malicious.
Right, it can be.
Even though there were warnings.
Right, right, right, it's one but.
Also.
Something can be reported as malicious.
And it would be nothing wrong actually.
Is this reported as malicious? It could be a case where.
Maybe it might be a, it might be a rookie.
With a with a machine that has like.
Two gigs of RAM.
And you trying to run under. If anybody knows that this thing
is, it's a video game engine called Mugen. It's like a big
file.
So if you wanna run something like that.
On a 2 gig RAM device.
And yeah, you're machine starts running slow. That person might
feel like, man, this thing is slowing my machine down. I'm
gonna report it as malware.
Ohh I'd malware. You just ain't got no ram.
Yeah, yeah, I remember. I I've done that for decades. Google.
Ah.
Why is my computer running like this?
Yeah. Hey, but that's how you learn sometimes cause you don't
have information readily available and a lot of times you
don't. You don't know what you're looking at yet, where a
lot of most people are in the learning phase. So I mean Google
is your best friend.
Yep, Yep. And in programming too.
There's nothing wrong.
Alright, cause chances are somebody else. You have. My
brother says that my brother's sort of kind of in the to it,
but yeah, I a lot of times whatever you Google and you're
not the first person to deal with it.
I feel sorry for the person who first posted the question and
you realize it was five years ago. That's the person I feel
Oh yeah.
bad for, yeah.
Yeah. Crickets.
Yeah, I've. I've seen that at.
I wonder how they got that resolved.
Exactly. Yeah, I I've seen that a ton even throughout when I'm
doing some of these labs, like those immersive labs, not
goodness, the malware analysis labs and the immersive labs are
crazy. I've had to Google so much of that.
It'll take me like forever, cause I'm sitting there like,
man, I don't understand what the answer they're looking for. You
think it's one thing? But no, they want you to dive a little
bit deeper. So you you'll type in like you could type in the
Yeah.
actual question that they're asking. You're not gonna find
that answer anywhere. What you can find is.
Once you get a grasp of how Mac malware analysis works, you know
how to search. You know what phrases to use to search.
Exactly. Yeah. Yeah. I tell the soft dev interns that Googling
Yeah.
is a skill.
It is. It really is it search, search engine optimization,
It is.
Yeah.
that's an actual thing.
Yep.
As the young.
Yeah, those people that get paid big tons of money who just know
how just who, just know SEO.
Yep.
Yeah, it goes both ways.
Are you still interested in learning JavaScript?
Me.
I thought it was you that was wanting to learn JavaScript.
I'm I am petrified of programming. I know I need to
learn. I know I need to learn something though probably it'll
probably be part then no.
OK, I wasn't sure I thought it was you, but it might have been
Java though.
somebody else. Well, it probably was somebody else.
No.
No, I'm. I'm interested in knowing how to read it, though I
need to learn better how to read it that way.
You know, make me better at a male as at malware analysis.
Yeah, just get the code and concepts like Blake had down and
That.
you can read any of the see languages.
Ooh man.
C++ is another one that I I don't know.
Devil's language.
Yeah.
See, that's what I took in college. I took C and then C++.
And then they came out with C#.
Yeah, I didn't learn either one, by the way.
Please.
Ohh, you just took you just took it.
I took them. I had a good team.
Teamwork is all good when you don't know stuff.
Wink, wink. I get it.
Yeah, you guys would wish for teams, you know, because we
don't have a lot of teams here.
My program we had a team all the time, so.
The good thing?
Yeah, with the.
But no, it's Scott. You're gonna say it's gonna stay and do his
security plus, right. If if we help you with security plus you
can stay and help the team.
Here, Scott.
And I don't. I don't mind, man. I I just like learning, so I'm
not learning, I'm not living.
Well, you don't have to stop just because you're graduate.
Exactly.
You can stay.
Yeah, I do. Yeah. That is my next. That's my next step cause
There is gita.
I've gone through all of this master's degree and all this and
I really have my security plus.
Yeah. No, you you definitely need to clean up on all five
I am.
with that.
Yeah.
I know it, I know it.
It's a couple 100 bucks. You can do it.
I know it.
But there's so many there's there's a lot of students
studying for that, and there's a lot of study groups. There's
actually a class running in BD track starting in November. It's
288. I know it's undergrad. You can't take a class. But the
point being is there's a class that we created. So anybody that
took 286, which is security, plus gets to take 288, which is
like 10 more weeks of the same thing. So you can study for it.
Umm.
So there's there's the group of students in there you could go
over there and work with them and mentor them.
Their undergrads.
Cool.
Just saying.
Cool, cool. I I hope we do add that to the internship program
Would you?
and I wouldn't mind coming back to help out with something like
that.
Yeah, no. And and we do a lot of cert prep. I mean, there's a lot
of cert prep going on with through our clubs and stuff. So
if you're not already in slack and discord, you can definitely
stay connected there cuz we have groups there all the time doing
OK.
study stuff.
Think I am in the discord now.
Yeah. Yeah, there's there's certain prep groups, and you
could join up.
But feel free to stay and PGIP.
I need a break though.
Ohh yeah, well, we're here. We're not going anywhere.
I need a break.
Yeah. Yeah, it's recommended to take at least two weeks off.
I need them.
Yeah.
Only two.
At least at least minimum.
Man, that's two weeks goes by like 2 days y'all know that.
Yeah, go to Hawaii and come back.
No.
Well, you guys did great. Thank you.
Thanks.
Yeah. Thanks everyone. Anybody has any more questions?
Thank you.
No. Alright. Thanks Scott and Blake. He did wonderful. I
I'll thank you.
Thanks.
learned a lot.
Thanks. Thanks. Thanks.
Thank you.
Yeah, very interesting.
Thank you.
Umm have a good night everyone.
You too.
Have a great night. Bye guys.
Goodnight.
Umm alright bye.