Black Hat Asia 2015: Target: MalwareBlack Hat Asia 2015: Target: Malware
Hostile software is ever evolving, and Black Hat-associated research is one of the key loci of information on monitoring, defending against, and nullifying it. With that in mind, today we'll preview a quartet of interesting malware-related Briefings from Black Hat Asia 2015.
February 25, 2015
Malware commonly turns to API-wrapping techniques to obfuscate API calls, which makes it difficult to reverse-engineer the code. The old way of dealing with this, binary pattern matching, is easily defeated by simply changing the obfuscation pattern. What's needed is a more robust deobfuscation scheme ... how about one based on memory access analysis? API Deobfuscator: Identifying Runtime-Obfuscated API Calls via Memory Access Analysis will detail just such a scheme, which can generate maps between obfuscated API calls and their true invocations. And so the arms race continues.
Continuing on this sneaky malware kick, some of the more advanced malware, such as Citadel and Zeus/GameOver, can detect when they're being run in security researchers' sandboxes and halt all execution--stifling attempts to study them. As always, two can play that game. SLIME: Automated Anti-Sandboxing Disarmament System will show you how to defeat these countermeasures, automatically disarming them so analysis can proceed. Be sure to stick around for data on this technique's effectiveness on real-world, large-scale malware samples.
The Security Content Automation Protocol (SCAP) comprises a number of open standards meant to enumerate system vulnerabilities and malware characteristics via components like Common Vulnerabilities and Exposures (CVE), Common Configuration Enumeration (CCE), and Malware Attribute Enumeration and Characterization (MAEC), which all capture high-fidelity data in XML. Unfortunately, their XML schemes lack mutual compatibility, making deeper cross-analysis difficult. Security Content Metadata Model with an Efficient Search Methodology for Real Time Monitoring and Threat Intelligence proposes a low-impact way to modify these schema which will result in more powerful analyses that can resolve vulnerabilities before they're exploited.
Lastly, Android's become another hot frontier in the fight against malware, and static and dynamic analysis tools such as IDA, Smali, and mobile sandboxes have been created in response to Android malware's increasingly complex defensive measures. But even these can be worked around. DABiD: The Powerful Interactive Android Debugger for Android Malware Analysis will introduce DABiD (Dynamic Android Binary Debugger), an interactive Android debugger. DABiD can catch malwares' dynamic code modifications, monitor dynamically loaded classes, control execution flow, or disable certain instructions, making it easier to analyze and squash. All that, and it doesn't even need root.
Black Hat Asia 2015 takes place March 24 to 27 at the Marina Bay Sands in Singapore. Register today!
About the Author(s)
You May Also Like
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Deploy Zero Trust for Remote Workforce Security
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Everything You Need to Know About DNS Attacks
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
2022 Insurance Industry Cyber Threat Landscape Report
Protecting Critical Infrastructure: The 2021 Energy, Utilities, and Industrials Cyber Threat Landscape Report
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report