Adding Malware Scanning to your SDLC with YARA

In the rapidly evolving field of software development, maintaining robust security measures is crucial. One essential aspect of security is ensuring that software is free from malware. This tutorial will guide you through setting up a lab to test Docker images for malware using YARA, an open-source tool for identifying and classifying malware based on pattern matching.

What is YARA?

YARA is a tool designed to help in identifying and classifying malware samples. By creating specific rules, YARA can scan files or applications to detect the presence of known malware or suspicious patterns, making it an invaluable tool for security analysts and incident response teams.

Setting Up the Lab

Our lab involves using the EICAR test file, a safe file developed by the European Institute for Computer Antivirus Research (EICAR) to simulate malware. This file is recognized by antivirus programs as a virus but is non-destructive. This makes it perfect for training and testing malware detection tools without the risk of using real malware.

Step 1: Download the EICAR Test File: The EICAR test file can be obtained with a simple curl command

curl https://secure.eicar.org/eicar.com.txt -O

Step 2: Create a Dockerfile: Using the Dockerfile format, we place the EICAR test file into an Alpine Linux container. This sets up the environment for our test

FROM alpine:3.10
WORKDIR /app
COPY ./eicar.com.txt /app

Step 3: Build and Tag the Docker Image: Build the Docker image with the EICAR file embedded

docker build . -t kurtisvelarde.com:5000/eicar-test:0.1

Step 4: Run the YARA Scanner: We use a Docker container equipped with YARA to scan the directory where our Docker registry stores images

docker run --rm -v $PWD/rules:/rules:ro \
                  -v /opt/docker-registry/data/docker/registry/v2/:/malware:ro \
                  blacktop/yara -r /rules/eicar.yara /malware/repositories/eicar-test/

Step 5: Use Deepfence Yarahunter for Advanced Scanning: For a more comprehensive scan, we deploy Deepfence Yarahunter, a tool designed to perform deep malware scans on Docker images

docker run -i --rm --name=deepfence-yarahunter \
           -v /var/run/docker.sock:/var/run/docker.sock \
           -v /tmp:/home/deepfence/output \
           deepfenceio/deepfence_malware_scanner_ce:2.0.0 \
           --image-name kurtisvelarde.com:5000/eicar-test:0.1 --output=json > myeicar.json

Conclusion

By integrating YARA into your development pipeline, you can detect and mitigate threats early in the software lifecycle. Using Docker adds a layer of flexibility and efficiency, allowing for scalable and manageable security practices. This lab setup is just the beginning. As you become more familiar with YARA and Docker’s capabilities, you can expand this foundation to include more complex scanning scenarios and broader malware detection strategies.

This tutorial provides a basic framework for setting up a malware detection lab using Docker and YARA, crucial for anyone involved in software development and security.