Malware analysis, threat intelligence and reverse engineering

In this presentation, I introduce the concepts of malware analysis, threat intelligence and reverse engineering. Experience or knowledge is not required.

Feel free to send me feedback via Twitter (@bartblaze) or email.

Blog post: https://bartblaze.blogspot.com/2018/02/malware-analysis-threat-intelligence.html

Labs: https://github.com/bartblaze/MaTiRe

Mind the disclaimer.

License: CC Attribution-NonCommercial-NoDerivs License

Transcript

1. Malware Analysis Threat Intelligence Reverse Engineering Bart Parys
2. Introduction • Career of +8 years in information security • Last 4 years even more involved in malware research & analysis • Maintain a personal blog (https://bartblaze.blogspot.com) • Twitter: @bartblaze • Email: bartblaze@gmail.com • Please do reach out! 2
3. What we will see today • Short introductions for each section malware analysis, threat intelligence, reverse engineering • Combining all three together while taking a deep(er) dive • Hands-on exercises of course! And also… • Feel free to interrupt me at any point during the course • Contact me online or offline at any given point 3
4. Preparation: for this course Verify that… • You have already downloaded the Virtual Machine provided • You have not installed VirtualBox guest additions • The VM is in a clean state - it cannot be already infected with malware • Take a snapshot of the clean state No VM available? Ask if you can partner up. In case of any other issues or questions… Shout :-) 4
5. Preparation: for your own lab at home • Always isolate your virtual environment ◦ Use NAT ◦ Use a VPN on the host, if you allow communication • Snapshot capability ◦ VirtualBox (Free) ◦ VMWare Workstation (Not free) • Never install VirtualBox guest additions or VMware tools ◦ Why? Scrutinizes your VM - easier to identify by malware • If possible, have a non-Windows machine as host • Keep your host machine, antivirus and virtualization software updated! 5
6. Malware Analysis 6
7. Malware Analysis: The basics... Malware is any form of malicious software. (Plural: malware) Which types of malware do you know? Can you give me an example? • Virus: needs user interaction & infects other applications; for example a file infector • Worm: self-replicates; for example to shares or removable media • Trojan or trojan horse: disguised as an innocuous application • Backdoor: allows for persistent access; for example RATs • Rootkit: any application that allows for privileged and persistent access • Spyware: any application that spies on the user; for example a keylogger • Ransomware: holds the user hostage in return for a price (either files, browser or the whole machine) • PUP/PUA/Adware: modifies browser settings and/or installs unwanted applications 7
8. A word on ransomware Source: https://blogs.technet.microsoft.com/mmpc/2017/09/06/ransomware-1h-2017-review-global-outbreaks-reinforce-the-value-of-security-hygiene/ (2017, Microsoft) 8
9. How did it start? 1989: AIDS trojan, first case of ransomware 2005: GPcode (PGPCoder) 2009/2010: WinLock 2012: ACCDFISA, Urausy, Reveton 2013: CryptoLocker 2014: CTB-Locker (Critroni), TorrentLocker, CryptoWall 2015: Mobile ransomware (on Android), such as Fusob 2016: Locky, ‘Open-source’ ransomware such as; Eda2, Hidden Tear 2017: WannaCry (May), NotPetya (June), BadRabbit (October) 9
10. CryptoLocker • Introduced the end of rogueware (fake antivirus) • Innovative … • Inspirational … • … And very annoying :-) Many assumed that any form of cryptographic ransomware (“cryptoware”) is Cryptolocker, however this was one ransomware variant. It has been dead since 2014. 10
11. How does one get malware? The bad way 11 • Phishing or spear-phishing • Exploit kits • Drive-by download • USB drive or other removable media • Network (shares, SMB) • Manual installation (RDP, VNC, TeamViewer, …) • Watering hole (Strategic Web Compromise) • Other malware that downloads and/or installs ‘companions’
12. How does one get malware? For analysis purposes • Malware Sample Sources for Researchers https://zeltser.com/malware-sample-sources/ • List of Malware Sources http://www.kernelmode.info/forum/viewtopic.php?f=16&t=308 • Get a job in this field that applies most to you. Keywords for jobs: Malware analyst/researcher, threat intelligence (analyst), reverser/reverse engineer - and any of these but add ‘cyber’ in front - yes really • Ask other researchers :-) 12
13. Analysing malware: static vs dynamic 13 • Static: do not run the malware, look at static properties ◦ Can you think of tools, or what could be considered static properties? • Dynamic: run the malware, and examine onwards ◦ Can you think of tools, or what could only be discovered by running the malware? Why not both?
14. Static malware analysis: primer First of, consider the type of a file. Is it a(n)… • Executable? EXE, COM, SCR, PIF, DLL ◦ Strings, compile time, imports, sections, … • Image? PNG, BMP, JPG, GIF ◦ Steganography, hidden content, creator/creation date, ... • Office file? DOC/DOCX, XLS/XLSX, RTF ◦ Creator/creation date, embedded content, filename, … • Adobe file? PDF, EPS, SWF/FWS ◦ Creator/creation date, embedded content, filename, … • Archive? ZIP, RAR, 7z, ISO ◦ Creation date, contents, … 14
15. Static malware analysis: tools It is important to have a proper toolbox, or toolset • Executable? ◦ ExeinfoPE, Detect it Easy (DIE), PEViewer (RogueKillerPE) • Office document? ◦ Oletools, oledump, OfficeMalScanner, QuickSand • Adobe document? ◦ Pdfid, pdf-parser, PDF Stream Dumper Additionally: strings2, FLOSS, and… calculate the hash! (MD5, SHA1, SHA256) 15
16. Lab 1: static analysis • On the desktop, you can find a folder named ‘Labs’ • Examine the files inside the LAB1 folder Instructions • Use HxD, ExeinfoPE and PEViewer to look at the files • Go over at least these tabs in PEViewer: ◦ Dashboard, Indicators, Hex/Strings, PE Sections/Overlay, PE Imports/Exports/TLS, PE Debug, PE Resources, Version Info/Digital Signature • Run FLOSS and/or strings2 over the files, and identify any strings of interest 16
17. Lab 1: addendum PE - what’s in a file? • Short for PECOFF - Portable Executable and Common Object File Format Specification • Windows only! x86 and x64 • Executables, object code, DLLs • For extensive reading: “PE Format” https://msdn.microsoft.com/en-us/l ibrary/windows/desktop/ms68054 7%28v=vs.85%29.aspx (Microsoft) 17 DOS header - MZ - 0x4D5A PE header - PE 0x5045 Sections - code, data, imports & original entrypoint (OEP) Resources - icons Overlay - appended data
18. Dynamic malware analysis: primer You have two different ways of doing dynamic analysis: • Do it yourself: run the malware in a VM ◦ Manual dynamic analysis • Use a sandbox: let a sandbox take care of the malware ◦ Automatic dynamic analysis What are some of the pros and cons of, on one hand, running the malware yourself, and on the other hand, let a machine take care of it? 18
19. VirusTotal 19 https://www.virustotal.com • Scans with over 60 engines (antivirus/machine learning) • Supports, in theory, all file types • Extensive file details • Limited VT sandbox, Tencent’s sandbox • Useful for a second opinion • All uploads are public
20. Online sandboxes - part I 20 • https://www.reverse.it/ / https://www.hybrid-analysis.com/ • https://malwr.com/ • https://any.run/ • https://cape.contextis.com (can automatically extract malware configs)
21. Online sandboxes - part II 21 • https://malware.sekoia.fr/new (documents only, no executables) • https://iris-h.malwageddon.com/ (documents only, no executables) • https://manalyzer.org/ (executables only)
22. Quick concept - packed malware • Traditionally used for… ◦ shrinking the file, in size • Now used for ‘obfuscating’ the file, and its strings, imports, … 22 DOS header - MZ - 0x4D5A PE header - PE 0x5045 Unpacker code & entrypoint (stub) Packed sections
23. Lab 2: dynamic analysis • On the desktop, you can find a folder named ‘Labs’ • Examine the files inside the LAB2 folder Instructions • Execute the file. Check out some of the buttons. What functionality does this file have, at least? • Open Process Hacker and examine the strings of the process. Click the process Properties > Memory tab > Strings button • Can you find any peculiar string(s), that static analysis or strings does not reveal? 23
24. Additional tools Fakenet • Create a “fake network” • Tricks the malware into thinking there’s connection • Serves back files correspondingly CaptureBAT • x86 only (32-bit Windows) • Create a log file to analyse registry, file changes and more • Creates a copy of deleted files 24
25. Lab 3: static + dynamic analysis • On the desktop, you can find a folder named ‘Labs’ • Examine the files inside the LAB3 folder Instructions • Statically analyse the file. What can you discover already? • Start Fakenet by double-clicking the icon, and CaptureBAT by opening command prompt, navigate to the directory, and start it with the following command: ◦ CaptureBAT.exe -c -l lab3.log (-c will capture events, -l will write to a log file) • Open Process Hacker, and execute the file. Let it run for a minute, and check process memory strings. What can you discover with CaptureBAT and Fakenet? 25
26. Recap: malware analysis 26 • Malware can assume many forms • It does not discriminate, as you have malware for most modern operating systems • Some malware can exist cross-platform (think of a malicious macro in Word, for example) • Static vs dynamic analysis, and combined • Know which tools are at your disposal, but also… • Know how to perform analysis manually!
27. Threat Intelligence 27
28. Threat Intelligence: The basics... 28 • “ [...] the process of understanding the threats to an organization based on available data points.” Threat Intelligence: What It Is, and How to Use It Effectively, SANS 2016 https://www.sans.org/reading-room/whitepapers/analyst/threat-intelligence-is-effectively-37282) • It entails several parts: ◦ Tactical ◦ Strategic ◦ Operational • Be able to see the bigger picture!
29. But first… how did we get here? • Mandiant’s APT1 report, released in February 2013 https://www.fireeye.com/content/dam/fireeye-www/services/p dfs/mandiant-apt1-report.pdf (PDF) • Directly implicated a PLA unit • Significant impact on both attackers and defenders Cyber-espionage is very real and can occur at any point, anytime and anywhere. 29
30. Cyber Kill Chain vs Diamond Model Cyber Kill Chain: • Published in 2009 by Lockheed Martin • Based on a series of events, from an attacker’s perspective, but defender-centric • Disrupt or deny a chain and you may gain the upper hand - resulting in minimal financial losses or compromise 30 Diamond Model: • Published in 2013 by Active Response • More attacker-centric • Tactics, techniques and procedures, also known as TTPs • As a defender, it may enable a better overall response to a threat - resulting in minimal financial losses or compromise
31. Cyber Kill Chain 31 Source: https://www.loc kheedmartin.co m/content/dam/ lockheed/data/c orporate/docum ents/LM-White- Paper-Intel-Driv en-Defense.pdf (Lockheed Martin)
32. Diamond Model 32 Source: http://www.activerespo nse.org/wp-content/upl oads/2013/07/diamond. pdf (Active Response)
33. What else is there? 33 Apply or map Mitre’s ATT&CK matrix to an attacker: Source: https://attack.mitre.org/wiki/ATT%26CK_Matrix
34. Pyramid of pain in Threat Intelligence (TI) 34 Source: http://detect-respond.blogspot.co.uk/2013/03/the-pyramid-of-pain.html (2013, David Bianco)
35. Exercise: investigate a real case 35 CrunchyRoll hack delivers malware: https://bartblaze.blogspot.com/2017/11/crunchyroll-hack-delivers- malware.html Together, we will go through the stages of this attack, and apply or map this to (part of) the diamond model, and/or the (cyber) kill chain.
36. Threat Intelligence: tactical 36 What does an organisation need to defend itself? • Applied to real-time events • More temporal. Why? ◦ Threat actors can ‘burn’ TTPs ◦ They can re-tool • Think of the pyramid of pain!
37. Threat Intelligence: strategic 37 How does an organisation defend itself? • Be able to respond correctly in case of an incident • What is needed to protect the organisation • Forms more of an overall picture, more so for management ◦ But again: pyramid of pain • Often analyses long-term trends
38. Threat Intelligence: operational 38 Operational and technical are usually glued together • Handles on details of an attack or intrusion • Provides guidance and technically-focused intelligence • Often, indicators are also provided ◦ What’s that pyramid again?
39. Finding intelligence • Use threat intelligence feeds ◦ For example: AlienVault OTX ◦ And act on them • Enable automated alerts ◦ For example: Google Alerts • Twitter - a rich data source, sometimes • Security blogs ◦ Vendors or individuals • Resource: “Awesome Threat Intelligence” ◦ https://github.com/hslatman/awesome-threat-intelligence 39
40. What’s in our toolbox? External intelligence 40 • https://developers.facebook.com/products/threat-exchange • http://www.misp-project.org/ • https://otx.alienvault.com/dashboard/ • https://exchange.xforce.ibmcloud.com/
41. What’s in our toolbox? Internal intelligence 41 • Logs from your software and hardware ◦ Antivirus, firewall, anti spam, event logs, … ◦ SIEM: Security Information & Management System ▪ Includes log management, compliance, analysis, specific correlation and aggregation of data, … In a dashboard • Previous attacks, successful or not ◦ Attacker methodology (think of the matrices!) • People: experience, insight - create, structure & maintain a team
42. How to leverage Indicators of Compromise • As seen before, indicators come in many different forms ◦ Can you name some? • STIX, TAXII, CyBox: helpful for standardising data, and transforming it into intelligence ◦ Read: How STIX, TAXII and CybOX Can Help With Standardizing Threat Information https://securityintelligence.com/how-stix-taxii-and-cybox-can-help-with-standardizing-threat-information / SecurityIntelligence, 2015 • Leverage rules or rulesets, most commonly: ◦ OpenIOC ◦ Yara 42
43. OpenIOC • Created by Mandiant • We will, however, not leverage OpenIOC in this course • Mostly used is its IOC Editor • To learn more OpenIOC Series: Investigating with Indicators of Compromise (IOCs) https://www.fireeye.com/blog/threat-research/ 2013/12/openioc-series-investigating-indicator s-compromise-iocs.html Mandiant, 2013 43 https://www.fireeye.com/services/freeware.html
44. Yara - part I • Yet Another Recursive Acronym • “The pattern matching Swiss knife” • Can identify and classify files, not only malware • Repository on Github https://github.com/VirusTotal/yara • Public list of Yara rules https://github.com/InQuest/awesome-yara 44
45. Yara - part II 45
46. Yara - part III 46 • You can scan a file, folder or process with Yara • The commandline is as follows: ◦ For a file: yara32.exe rules_file file ◦ For a folder, recursively: yara32.exe rules_file folder -r Exercise: Let’s write some Yara rules together!
47. Threat Intelligence: pitfalls Threat Intelligence is not… • A silver bullet! It often takes more than just Indicators of Compromise (IOCs) • Easy. You need to cover all angles, vectors, possibilities, … • Difficult. Sometimes, it’s easier… TTPs & sharing come a long way What about attribution? 47
48. Roll the attribution dice 48 It’s North-Korea… Theoretically: any country with capability
49. Attribution: scenario 49 Imagine a scenario, where a threat actor or cyber criminal attacks an individual, an organisation, or even a country. • What do we establish first? What is or isn’t actionable? • What are some of the possible issues? • What are some identifiables? (Think TTP!) • What’s next?
50. Lab 4: Yara Write efficient Yara rules for the file and its droppers, if any, in Lab 4. These can be either or both for the file on disk, or in memory. Instructions • Run FLOSS or Strings2 on the file. See if you can find something specific, interesting and/or suspicious. Write a Yara rule, and test! • Run the file, and observe the behaviour. Fakenet, CaptureBAT & Process Hacker are your friends! 50
51. Addendum: time Time is a very important aspect in threat intelligence • Five minutes can make a lot of difference ◦ To the attacker: execute the operation ◦ To the defender: identify an operation (intrusion) • Time is in everything: do you have a plan ready, that can kick out an attacker as fast as possible? • What about attackers that stay on the network? • What about attackers that perform rapid lateral movement? 51
52. Recap: threat intelligence • Ideally, you leverage the full threat intelligence cycle • Know what you don’t know • Trust, but validate/verify • There are no silver bullets • Attribution: use, but don’t over-use • Always maintain a healthy sense of paranoia • Be aware, and wary, of time 52 Strategic Tactical Operational
53. Reverse Engineering 53
54. Reverse Engineering: The basics... • “Reverse engineering is the process of analyzing a subject system to create representations of the system at a higher level of abstraction.” Reverse engineering and design recovery: A taxonomy http://win.ua.ac.be/~lore/Research/Chikofsky1990-Taxonomy.pdf (1999, Chikofsky & Cross) • You can compare it with a bicycle… It is assembled at the factory, but, for whatever reason, you may wish to disassemble it • Basically, you attempt to understand the soft -or hardware • Re-assembling, re-engineering parts may be prohibited. Read the license agreement (EULA) 54
55. Different layers 55 • Each of these layers has multiple languages • Can you think of any examples for each? • The operating system can only understand machine language • We will be focusing on assembly, however. More specifically: x86
56. Registers 56 General EAX EBX ECX EDX Segment CS DS ES/FS/GS SS Pointer ESP EBP EDI ESI What else is there? • EIP: instruction pointer - points to the next instruction • EFLAGS: flags - these hold the state of the CPU, where each bit is a … flag: 0 or 1 Examples are: CF, SF, ZF, PF, TF (and many more… ) 32- bit registers!
57. Instructions Moving data MOV MOVZX MOVSZ LEA Arithmetic (math) ADD SUB INC DEC Logic OR/AND/XOR SHR/SHL SAL/SAR ROR/ROL Control Flow JMP CMP/TEST CALL/RET JZ/JNZ/JB/JG (...some more) What else is there? • Manipulating the “stack”: PUSH, POP (pushad, popad) • NOP: No OPeration - represented with 0x90, and does nothing 57
58. Examples 58 mov eax, ebx Move the value of ebx in eax inc eax Increment the value of eax with 1 xor eax, eax Clear the eax register instruction destination, source
59. Stack, heap and memory: visualised 59 ~error catching Stack Heap Program image (base image of binary) DLLs TEB PEB ~shared user page Kernel land (no user access) 0x00000000 Grows UP Grows DOWN 0x0040000 Loaded libraries/images Thread Environment Block Process Environment Block 0x7fffffff 0xffffffff
60. Stack 60 • Stores functions/function parameters, local variables, and for program control flow. A stack usually has a limited and fixed location in memory, where it begins • Last In First Out or LIFO ◦ The order in which elements come off a stack • Push and Pop ◦ PUSH: Adds an element to the stack ◦ POP: Removes the most recently added element (sometimes referred to as pull) • The stack grows upwards to lower addresses • Used for short-term storage only • Stack overflow: if the stack is full; and does not contain enough space to accept the next element - the call stack pointer exceeds thus its boundary
61. Heap • Used for dynamic memory during program execution • The heap grows downwards to higher addresses • Has typically more memory available to it than the stack • The heap requires pointers to access it • Programmer has to define or explicitly allocate and deallocate (free) the memory ◦ If this is not done properly, you may experience a memory leak • Allocated memory is referred to as malloc 61
62. Exercises • Name a typical return instruction • Do we know of any 8-bit, 16-bit, 32-bit or 64-bit registers for general purposes? Name two (2) in total • Name a typical return register • Which register/s is/are typically used for loops? 62
63. Debuggers, disassemblers and decompilers • Debuggers: debug a binary, this means running the sample! ◦ Examples: OllyDBG, Immunity, x64dbg • Disassemblers: disassemble or tear apart a binary. Static! ◦ IDA Pro Free, Radare ◦ Some disassemblers can also be used as a debugger • Decompilers: decompile a binary, this means reverting back to its source code (more or less) ◦ ILSpy, dnSpy ◦ Some decompilers can also be used as a debugger 63
64. Compression and obfuscation • Compression is, as mentioned, for reducing the file size, but also for ‘obfuscating’ data. Examples include but are not limited to: ◦ UPX, Themida, ASPack, MPRESS, VMProtect, … ◦ But also: Winzip, Winrar, 7z, … • Obfuscation is actually masquerading sections of code (and text). There is a plethora of methods, including, but not limited to: ◦ Fake C2 servers planted as strings ◦ Base64 (remember?), XOR, RC4, AES, … ◦ Garbage instructions or junk code ◦ But also: obfuscators! For example, for .NET: SmartAssembly, Confuser, ... 64
65. Lab 5: IDA, x64dbg and dnSpy We will examine the files in LAB5 together. Instructions • Open LAB5-1 in IDA, visit the strings tab, and find the ‘Hello World’ string, and its accompanying code block. What does it do? • Open LAB5-2 in x64dbg (x32dbg), and step through. The file is packed with UPX, and we will need to unpack it manually! • Open LAB5-3 in dnSpy, and go through the code, and figure out what it is doing from only reading the code. 65
66. Lab 5 addendum: UPX • In LAB5, one of the files we investigated, turned out to be packed with (default) UPX • We can also leverage the same packer, UPX, to unpack the file • Try it yourself! UPX is located in the Tools folder > upx394w ◦ upx -d file -o unpacked_file 66
67. XOR encryption • A form of encryption (sometimes referred to as encoding) • Exclusive OR • Will return true only if one of the operators is true 67 Operator Operator Result 0 0 False (0) 0 1 True (1) 1 0 True (1) 1 1 False (0)
68. Lab 6: XOR We will examine the file in LAB6. Instructions • Open the command prompt, and navigate to the Tools folder > XOR • Use either unxor, xorsearch or xorstrings to find the secret message in the file • All tools provide a help file/manual with the “-h” parameter ◦ Example: unxor.py -h 68
69. Addendum: CyberChef • “The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis” • Can perform a ton of operations, such as encoding/decoding, extracting, brute-forcing, … ◦ For example: XOR decoding + bruteforcing! • Utilise online: https://gchq.github.io/CyberChef/ • Send your ideas, collaborate: https://github.com/gchq/CyberChef 69
70. Lab 7: reversing time Investigate, analyse (and write Yara rules for) the files in LAB7. Hints for the first LAB7 file (LAB7-1): • Are you iMPRESSed with my packer? • I smell a RAT… Hints for the second LAB7 file (LAB7-2): • Windows? Never heard of it. • Who will become the next xorrior? • Mirror mirror on the wall, who has the largest botnet of them all? 70
71. Recap: reverse engineering • Reverse engineering, or reversing, takes time to learn - this is perfectly normal • A good method is to write a small piece of software, or file, and consequently analyse it (for example, hello world) • ‘Crackmes’ often provide a great experience • Every engineer, including a reverse engineer, uses Google (or MSDN) from time to time • Familiarise yourself with the language, and languages 71
72. One last lab… 72
73. LAB 8 73 • Lab 8 is for the fearless… So all of you! • It includes a real campaign from an APT actor ◦ What’s an APT again? • Analyse the full chain, this means: ◦ Context ◦ Purpose ◦ Full analysis (pre, during, post) ◦ Write a (short) report on what the malware does
74. LAB 8 - hints • Examine the file in LAB8. What kind of file is this? ◦ It appears to be an email, so rename the file to LAB8.msg • Investigate where it is sent from (or by whom) and where to ◦ Additionally check the date, subject & content of the email • Save the attachment, and unzip it. What kind of file do you get? ◦ It appears to be a Word document! Use static and dynamic analysis to investigate what happens ◦ Don’t forget to get and set your tools ready before starting dynamic analysis! • What files does it drop? Any outgoing connections? Can we write a Yara rule to detect any part(s) of the attack? How is the attack performed? ◦ The attack is mostly done in PowerShell, and appears to use shellcode • Can we make an effort to do attribution at the end? ◦ Qatar has been having political issues, and is in a diplomatic crisis. Possibly, one of its neighbouring countries? 74
75. This slide intentionally left blank. 75
76. Where and how to learn more Books: • Malware Analyst's Cookbook and DVD • Practical Malware Analysis • Practical Reverse Engineering 76 Online: • Reverse Engineering for Beginners https://beginners.re/ • Github: awesome X ◦ https://github.com/rshipp/awesome-mal ware-analysis ◦ https://github.com/fdivrp/awesome-reve rsing ◦ https://github.com/hslatman/awesome-t hreat-intelligence And also: Psychology of Intelligence Analysis (CIA) https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/books -and-monographs/psychology-of-intelligence-analysis/
77. Thank you. Questions? 77 Twitter: @bartblaze Email: bartblaze@gmail.com
78. 78 Disclaimer and license You are free to: Share — copy and redistribute the material in any medium or format The licensor cannot revoke these freedoms as long as you follow the license terms. Under the following terms: Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use. NonCommercial — You may not use the material for commercial purposes. NoDerivatives — If you remix, transform, or build upon the material, you may not distribute the modified material. No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits. The human readable version can be found at: https://creativecommons.org/licenses/by-nc-nd /4.0/ The full license can be found at: https://creativecommons.org/licenses/by-nc-nd /4.0/legalcode All rights reserved © 2018 Bart Parys