the development of a contained and user emulated malware
play

The development of a contained and user emulated malware assessment - PowerPoint PPT Presentation

Sep 16, 2022 •289 likes •530 views

The development of a contained and user emulated malware assessment platform Siebe Hodzelmans & Frank Potter (TechCrunch, 2012) 2/23 Incident Response and Malware Analysis (Debrie, Lone-Sang, and Quint, 2014) 3/23 (ArsTechnica, 2017)

  1. The development of a contained and user emulated malware assessment platform Siebe Hodzelmans & Frank Potter

  2. (TechCrunch, 2012) 2/23

  3. Incident Response and Malware Analysis (Debrie, Lone-Sang, and Quint, 2014) 3/23

  4. (ArsTechnica, 2017) 4/23

  5. (Times Square Chronicles, 2019) 5/23

  6. Research ques+on ‘How can malware be tested for detection of antivirus software by emulating user actions, without the AV vendor learning about the malware?’ 6/23

  7. Sub questions ● What traffic is generated by AV software? ● How to prevent AV software from notifying and submitting the red team’s malware to the AV vendor? ● Are there any differences between direct scanning and user emulated detection rates? 7/23

  8. Methodology - Traffic analysis ● McAfee, Symantec and Trend Micro ● Malware samples 8/23

  9. 9/23

  10. Methodology - Preventing submission 10/23

  11. 11/23

  12. Methodology - User emulation ● Compare manual with emulated behavior of malware ● Web browsing user emulation with pywinauto and pyautogui ● Malware infection Tree (Kamali, 2016) 12/23

  13. Results - Traffic analysis ● Traffic capture: ○ McAfee, Symantec and Trend Micro ○ Later Kaspersky ● In general: ○ Installation, registration, updating ○ Analytical data ○ Lots of hashes and encoded data ○ Only HTTP(S) 13/23

  14. Results - Traffic analysis ● Noteworthy: ○ Trend Micro: missing SNI, long plain HTTP GET ○ McAfee: every file gets hashed, google analytics ○ Symantec: ping submission with data buffer ○ Kaspersky: lot of HTTP(S) 400 and 502 errors, certificate pinning ● No sample submission 14/23

  15. Results - Traffic analysis Das Malwerk Deloitte obfuscated Deloitte direct exports 1e84- 1f7b- 230a- 266a- 2578- obf. obf. dll obf. dll beacon beacon msf ff45 55c7 6f87 11f5 6c51 exe 1 2 exe dll vnm ✔ ✔ ✔ ✔ ✔ McAfee ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ Symantec ✖ ✔ ✔ ✔ ✔ ✔ Trend Micro ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ Kaspersky 15/23

  16. Results - Sample submission preven3on ● Offline: undesirable ○ Difference Trend Micro ○ Warning Symantec ● Blacklisting ○ Unsure what to block ○ Updates can change endpoints ● Whitelisting ○ Robust ○ Parameters: ■ hostnames ■ traffic size and direction ■ content 16/23

  17. Results - User emulation ● Two ways: ○ pywinauto, accessibility API ○ pyautogui, mouse and keyboard, screenshots ● Compared manual to emulation ○ Malware infection Tree ○ File handles, process tree structure 17/23

  18. Results - User emulation 18/23

  19. Results - User emula-on 19/23

  20. Discussion ● Contamination of packet captures ● mitmproxy ○ Insecure connections ○ Kaspersky errors ● Results of sample submission prevention ○ Unable to trigger sample submission ○ Flaw in research design ○ Based on what we did observe ● McAfee low detection rate 20/23

  21. Conclusion How can malware be ● Variety of traffic tested for detection ○ But no sample submission of antivirus software ● Whitelisting the best approach by emulating user actions, without the ● Dynamic analysis is of added value AV vendor learning ○ User emulation matches manual about the malware? ○ Multiple approaches to emulation 21/23

  22. Future work ● Exploratory investigation in traffic generated by AV software ○ Another approach: reverse engineering ● Combine whitelisting with IRMA ● Monitoring AV detection of malware 22/23

  23. Questions? 23/23

Recommend

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User

Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User

Helping Johnny To Analyze Malware : A Usability-Optimized Decompiler and Malware Analysis User Study Khaled Yakdan Sergej Dechand Matthew Smith Elmar Gerhards-Padilla Fraunhofer FKIE University of Bonn University of Bonn University of Bonn

426 views • 19 slides
MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs on a victims system How does it get to run? Attacks a user- or network-facing vulnerable service Backdoor: Added by a malicious

1.02k views • 81 slides
FlowDroid Alex Mariakakis From CSE 501 again Motivation All sorts of mobile malware exist

FlowDroid Alex Mariakakis From CSE 501 again Motivation All sorts of mobile malware exist

FlowDroid Alex Mariakakis From CSE 501 again Motivation All sorts of mobile malware exist Selling user information to advertisement/ marketing companies Stealing user credentials Premium rate calls and SMS SMS spam

843 views • 17 slides
End-user development of End-user development of eTextiles eTextiles tiny.cc/s2o I want to

End-user development of End-user development of eTextiles eTextiles tiny.cc/s2o I want to

Juan Haladjian (TUM) End-user development of End-user development of eTextiles eTextiles tiny.cc/s2o I want to share with you Custodian Jacket Use Case: Accident detection Technicians might have to access the

239 views • 9 slides
Malware Halting Part I: Method Development Kjell Jrgen Hole Simula@UiB Last updated 16.05.17

Malware Halting Part I: Method Development Kjell Jrgen Hole Simula@UiB Last updated 16.05.17

We view malware outbreaks as infectious diseases and use software diversity and computer immunization (or hardening) to prevent the outbreaks from spreading. Malware Halting Part I: Method Development Kjell Jrgen Hole Simula@UiB Last

717 views • 38 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
PD2100A User Guide Overview The Nomad Technologies, Inc. PD2100A is a self contained, mobile, all

PD2100A User Guide Overview The Nomad Technologies, Inc. PD2100A is a self contained, mobile, all

PD2100A User Guide Overview The Nomad Technologies, Inc. PD2100A is a self contained, mobile, all inclusive presentation system allowing the user to present virtually any type of media. These presentation materials can be contained on a notebook

551 views • 10 slides
Testing QEMU emulated devices using qtest Marc Mar Barcel <marc.mari.barcelo@gmail.com>

Testing QEMU emulated devices using qtest Marc Mar Barcel <marc.mari.barcelo@gmail.com>

Testing QEMU emulated devices using qtest Marc Mar Barcel <marc.mari.barcelo@gmail.com> KVM Forum 2014 Marc Mar Testing QEMU emulated devices using qtest 2 Who am I? Computer Science student Worked on QEMU in GSoC project

597 views • 44 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
End User Development: Approaches Towards A End User Development: Approaches Towards A Flexible

End User Development: Approaches Towards A End User Development: Approaches Towards A Flexible

University of Siegen Chair of Information Systems and New Media End User Development: Approaches Towards A End User Development: Approaches Towards A Flexible Software Design Flexible Software Design Michael Spahn, Christian Drner, Volker

733 views • 15 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
INTERACT2015 W04: IFIP WG 13.2 Workshop on User Experience and User-Centered Development

INTERACT2015 W04: IFIP WG 13.2 Workshop on User Experience and User-Centered Development

Integrating Human-Centered and Model-Driven Methods in Agile UI Development INTERACT2015 W04: IFIP WG 13.2 Workshop on User Experience and User-Centered Development Processes Holger Fischer September 14th, 2015 Motivation

625 views • 9 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me

MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me

MazeWalker Enriching static malware analysis and more Yevgeny Kulakov @p_h_0_e_n_i_x About Me Malware RE @ Trusteer, IBM, Seculert binary analysis automation sandbox development Now in vEYE Security on software container

591 views • 48 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides

More recommend