Downloaded 10 times
More Related Content
Similar to How to convince a malware to avoid us
How to convince a malware to avoid us
- 1. How to convincea malware to avoid us? Csaba Fitzl
- 2. whoami blue teamer security researcher,blogger certification monkey husband, father hiker
- 3. What is thistalk about?
- 5. Agenda part #1 -What malware authors afraid of and how they detect it? part #2 - Real world examples part #3 - My POC tools for vaccination
- 6. What malware authorsare afraid of?
- 7. security researchers sandboxes virtual machines hardenedmachines => malware hates being analyzed also tries to avoid certain targets
- 8.
- 9.
- 10. Virtual machines look forartifacts in: registry file system processes MAC address… VMware I/O ports red pill
- 11. Sandboxes screen resolution (low) installedsoftware (limited) number of cores memory desktop etc… ref: Zoltán Balázs – Sandbox detection for the masses: leak, abuse, test
- 12.
- 13.
- 15. 048fc07fb94a74990d2d2b8e92c099f3f986 af185c32d74c857b07f7fcce7f8e Word dropper sandbox detection PublicSub IuIxpP() If DKTxHE Then Error 101 If qrNjY Then Error 102 (…) Public Function DKTxHE() As Boolean DKTxHE = RecentFiles.Count < 3 End Function
- 16.
- 17. c279165952de10a5f715df706da26b2d5a57cc 50e49dcab74fc91dba2ce1408b generic trojan checks forplenty of analysis SW checks for anti malware
- 18.
- 19.
- 20.
- 21.
- 22. What is inthe focus? mainly about hiding analysis tools e.g.: zer0fox ease researcher’s job verify environment - pafish
- 23. How about vaccination? let’stry to emulate ‘unhealthy’ environment less researched malware might avoid us
- 24. Previous research White Paper Towardsan Understanding of Anti-virtualization and Anti-debugging Behavior in Modern Malware, 2008 Rapid7 Vaccinating systems against VM-aware malware, 2013 Gal Bitensky Demo Vaccination The Anti-Honeypot Approach, 2016 various tools against specific malware
- 25.
- 27. tool #1: fakevm kerneldriver w/ SSDT hooking up to Win7 x86 can emulate VBOX / VMWARE files & registry keys easy to extend w/ other keys, files
- 28.
- 29. tool #2: FakeDebuggerWindows simple Windowsapp creates a window, and doesn’t show it no conflict with other windows
- 30.
- 31. tool #3: mutex-grabber monitor malwr.comfor mutexes dynamically add them to the system allows whitelisting saving / loading files
- 32.
- 33. Challenges software compatibility does normalsw care about VM / debuggers? system resources low level vaccination? needs to be done in clever way (e.g.: machine can’t be VBOX and VMware at the same time)
- 34.
- 35. HitMan Pro Alert usesvaccination other interesting protections as well tested w/ Pafish
- 36.
- 37. Minerva Labs sw dedicatedfor vaccination claims to stop many malware these days
- 38.
- 39. interesting area it iseffective against malware should be more commonly researched could have two long term effects malware stop caring about VM, etc.. -> this method won’t be effective, but analysis might be easier everything stays -> we can protect against malware
- 40.