![\"find-blog-header\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2013\/04\/find-blog-header.jpg\")
<\/p>\n<\/p>\n
As you might imagine, researching malware might give you a unique perspective on computers. One of the things we do in the course of malware analysis is to set up sacrificial \u201cgoat\u201d systems that we can let get all crudded up in a safe and secure way. (Well, safe and secure for anything outside that goat machine, anyway.) We create different \u201cimages,\u201d which will vary here and there (e.g., one image for macro viruses, another for different types of infection vectors, different operating systems, etc).<\/p>\n
To ensure the best possibility of the malware working, you want it to look and act reasonably like a real person\u2019s machine, so you populate it with fake information that a malware creator might want to grab, like email addresses and passwords. For safety\u2019s sake, you want to make sure any information on the system is just what you have put there \u2013 no email addresses or account information from Readme files or software documentation in browser history or any temporary files.<\/p>\n
Once we got everything set up on a new goat machine, the last step before saving a snapshot was to go through and purge wayward non-test contact information from that system. It beggars belief the places where this information resides, even on a clean install (an almost-untouched system). On a system that has been used for a while to create and swap files, to send and receive emails, and to make online purchases, there is a whole lot more interesting information to be found.<\/p>\n
Attackers, being in it to make a buck, know this too. That was why we had to be so thorough in cleaning our goat systems before we could use them for analysis. Malware authors would find info in the darndest places, not stopping at just looking through documents or emails, or what was actively being typed. So it\u2019s useful to be aware of what information is on your system so you can lock it up if need be.<\/p>\n
Doing this manually is kind of a royal pain, which is why it\u2019s cool that there are now products (like Identity Scrubber<\/a>) that do the heavy lifting for you. It can sift through your machine for whatever information you want to be aware of, and then you can choose to scrub that data away or lock it in the vault so it\u2019s not lying around in the open. You can repeat the process periodically to keep things tidy.<\/p>\n This technology on its own won\u2019t protect you from bad guys skulking around the Internet, but it can go a long way to making your machine a less tempting target. Especially if you pair it with regular security software like anti-virus<\/a> and a firewall<\/a>, it can make your data that much harder to get than the next guy\u2019s.<\/p>\n","protected":false},"excerpt":{"rendered":" As you might imagine, researching malware might give you a unique perspective on computers. One of the things we do in the course of malware analysis is to set up sacrificial \u201cgoat\u201d systems that we can let get all crudded up in a safe and secure way. (Well, safe and secure for anything outside that […]<\/p>\n","protected":false},"author":6,"featured_media":13923,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[11],"tags":[231],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n