Antivirus Evasion Techniques and Countermeasures

23,765 views
24,117 views

Published on

This presentation throws light on innovative techniques for bypassing antivirus detection. This will be useful for researchers and pen testers to develop successful post exploitation techniques.

Published in: Technology
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
23,765
On SlideShare
0
From Embeds
0
Number of Embeds
21,926
Actions
Shares
0
Downloads
8
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide
  • Reference: Three ways to inject code into a remote process - http://www.codeproject.com/KB/threads/winspy.aspx
  • Antivirus Evasion Techniques and Countermeasures

    1. 1. Amit Malik (DouBle_Zer0)<br />SecurityXploded and Garage4hackers Bangalore Chapter Lead<br />E-Mail: m.amit30@gmail.com<br />Anti-Virus Evasion techniques and Countermeasures<br />
    2. 2. Why<br />How<br />Countermeasure<br />Legal Statement <br />Agenda<br />
    3. 3. I am a Penetration Tester.<br />I want to use public codes* without fear.<br />I want to know the system internals.<br />I want to impress my girl friend ^_^.<br />I want to test effectiveness of security technologies.<br />WHY<br />
    4. 4. Warning: Everything that I will discuss here is not applicable to .exe files.<br />Logic – divide exe in two parts – means don’t make exe.<br />Code<br />Interface<br />Code – it is our normal code with some additional powers – stand alone executable code.<br />Interface - interface will execute the code <br />In simple words we need a shellcode type code and a interface to execute the shellcode.<br />HOW #1<br />
    5. 5. Why we are splitting exe in two parts ?<br />AV detection techniques<br />Signature based<br />Emulation + signature<br />MD5 <br />Heuristic <br />If your binary is packed then AV uses Emulation + signature tech. for detection.<br />By splitting exe in two parts we can bypass AVs.<br />True fact: generating exe is simpler than writing the stand alone executable code that performs the same function. <br />HOW #2<br />
    6. 6. Techniques:<br />Code injection in another process<br />Jump and Execute<br />Loaders<br />HOW #3<br />
    7. 7. Code injection in another process<br />Interface – make a interface that will read the “code” and will inject it into another process.<br />Raw Material:<br />OpenProcess<br />WriteProcessMemory<br />CreateRemoteThread<br />HOW #4 – Technique #1<br />
    8. 8. HOW #4 – Technique #1 - Demo<br />
    9. 9. Jump and Execute<br />Interface – make a interface that will read the file and then jump to that location and execute the code<br />Raw Material:<br />ReadFile<br />JMP<br />HOW #4 – Technique #2<br />
    10. 10. HOW #4 – Technique #2 - Demo<br />
    11. 11. Loaders<br />Interface – make a interface that will read the “code” and creates a trusted process in suspended mode and overwrite the “code” at the entry point of the suspended process and then resume the thread.<br />Raw Material:<br />CreateProcess – suspended<br />WriteProcessMemory<br />ResumeThread<br />HOW #4 – Technique #3<br />
    12. 12. HOW #4 – Technique #3 -Demo<br />
    13. 13. What if AV flag Interface ?<br />Yes, they can but the interface code is using legitimate APIs with very minimal code.<br />Many legitimate programs use similar APIs so fear of false positive.<br />May be they can flag on the basis of MD5 <br />HOW #5<br />
    14. 14. Simply call it shellcode detection<br />The Philosophy<br />Emulate or Execute Everything<br />Exception – move to next byte<br />Abort execution if anytime EIP >= 7xxxxxxx<br />Scan – Detection<br />Countermeasures<br />
    15. 15. Shellcode Detection - Demo<br />
    16. 16. “Shellcode Detection” Technique and source codes are distributed under CC.<br />http://creativecommons.org/licenses/by-nc/3.0/<br />Codes: https://sites.google.com/site/hacking1now/tools<br />Legal Statement<br />

    ×