Black Hat Asia
March 28-31, 2017
Singapore
Black Hat USA
July 22-27, 2017
Las Vegas, NV, USA
Black Hat Europe
December 4-7, 2017
London UK
7/16/2014
07:00 PM
Black Hat Staff
Black Hat Staff
Event Updates
50%
50%

Black Hat USA 2014: Something Strange in the Neighborverse

Few words are as aptly descriptive as "malware"; cue the overused "what it says on the tin" remark. Of course, hostile software is ever evolving, and Black Hat-associated research is one of the key loci of information on monitoring, defending against, and nullifying it. With that in mind, today we'll preview a quartet of interesting malware-related Briefings from Black Hat USA 2014.

In the security world, it's a given that nation states often get the funnest (and scariest) toys. One case in point is Snake (also known as Turla and Uroboros), a highly sophisticated malware that maintains persistent access using covert communications, some of which are very difficult to detect. Sergei Shevchenko's Dissecting Snake -- A Federal Espionage Toolkit will demonstrate key aspects of Snake's functionality, including usermode-centric and kernel-centric architectures, rootkit capabilities, encrypted virtual volumes, and C&C traffic authorization.

Modern, 64-bit versions of Windows raise the bar for kernel-mode rootkits, with features like Driver Signature Enforcement and PatchGuard more capably protecting the keys to the kingdom. Plan B? Subvert the system before the OS takes control. Legacy BIOS systems lack the newer Secure Boot protections, as the Master Boot Record, Volume Boot Record, and bootstrap code all reside in unsigned sectors of disk. Come to Exposing Bootkits With BIOS Emulation to see how a combo of low-level anti-rootkit techniques, emulation, and heuristic detection logic can sniff out bootkits on these legacy systems.

Anti-virus solutions make grand claims about their effectiveness against unknown malware, but how can a user know which is most capable? One thing they could do is attend One Packer to Rule Them All: Empirical Identification, Comparison, and Circumvention of Current Antivirus Detection Techniques, in which Alaeddine Mesbahi and Arne Swinnen will run through their empirical findings, which include that A/Vs are much more effective detecting x86 than x64 malware. To keep things light, they also developed new packing techniques that render malware completely undetectable to current products.

In 2011, Rodrigo Branco, Gabriel Negreira Barbosa, et al. presented a wide range of anti-reverse engineering techniques found in malware, along with detection algorithms and statistics on prevalence. Unfortunately, the industry didn't take this information and run with it, so they're trying again with Prevalent Characteristics in Modern Malware. Armed with data from more than 12 million samples, they'll demonstrate the prevalence of more than 50 additional nondefensive characteristics found in modern malware, as well as how the malware responds to analysis. This time, their extensive malware database will hopefully get the notice it deserves.

Regular registration ends on July 26. Please visit Black Hat USA 2014's registration page to get started.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This is a secure windows pc.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.