The Remote Metamorphic Engine Detecting, Evading, Attacking the AI - PowerPoint PPT Presentation

The Remote Metamorphic Engine Detecting, Evading, Attacking the AI and Reverse Engineering Amro Abdelgawad / REcon 2016

line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx mov byte [ecx], dl The Remote Metamorphic Engine xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf call line95_1 db 7 db 3 dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 ‣ Security as undefined expression db 3 dd 946381070 db 2 dd 3318121790 db 2 dd 1375432265 db 1 dd -1 ‣ Flux binary mutation mov ebx, 92 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 ‣ Resisting Reverse Engineering xor dword [eax], 0xb1c21343 add eax, 4 sub dword [eax], 0x111111ee add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 jmp ebx ‣ Evading AI machine learning line95_2: popf popad nop jmp long line96 line95_1: mov eax, [esp] ‣ Artificial Immunity nop nop xor eax, eax xor ecx, ecx xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret

line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx mov byte [ecx], dl xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf call line95_1 db 7 db 3 dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 db 3 dd 946381070 db 2 dd 3318121790 db 2 dd 1375432265 { } db 1 dd -1 Security Patterns mov ebx, 92 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 add eax, 4 Division by Zero | Division by Infinity sub dword [eax], 0x111111ee add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 jmp ebx Isolation Randomization line95_2: popf popad nop jmp long line96 line95_1: mov eax, [esp] nop nop xor eax, eax xor ecx, ecx xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret

line46_1: mov ecx, [esp] nop nop The Undefined Expression mov dl, 0xe9 test edx, edx mov byte [ecx], dl xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad Security as Undefined & indeterminate expression pushf call line95_1 db 7 db 3 dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 db 3 dd 946381070 db 2 1 dd 3318121790 db 2 - ∞ ∞ dd 1375432265 = = db 1 dd -1 mov ebx, 92 0 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 add eax, 4 Undefined sub dword [eax], 0x111111ee add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 jmp ebx line95_2: popf ∞ 0 popad RE Time nop jmp long line96 line95_1: mov eax, [esp] nop nop xor eax, eax xor ecx, ecx xor edx, edx The Remote mov cl, 0xe9 mov byte [eax], cl Metamorphic xor edx, 0 mov ecx, 0x00000057 Engine mov dword [eax+1], ecx ret

line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx The Unbreakable Code mov byte [ecx], dl xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf call line95_1 db 7 db 3 dd 838225172 db 2 dd 4211932376 Unpredictable db 4 dd 2520091426 db 3 dd 946381070 db 2 dd 3318121790 un · pre · dict · a · ble db 2 dd 1375432265 db 1 dd -1 mov ebx, 92 adjective:/ ˌə npr əˈ dikt ə b( ə )l/ add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 add eax, 4 sub dword [eax], 0x111111ee add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 Likely to change suddenly and without reason jmp ebx line95_2: popf popad nop jmp long line96 and therefore not able to be predicted line95_1: mov eax, [esp] nop nop xor eax, eax (= expected before it happens) xor ecx, ecx xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret

line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx mov byte [ecx], dl xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret The Breakable Code line95: pushad pushf call line95_1 db 7 db 3 dd 838225172 db 2 dd 4211932376 The Fixed Static Code Problem db 4 dd 2520091426 db 3 dd 946381070 db 2 dd 3318121790 db 2 Static Code Dynamic Data dd 1375432265 db 1 dd -1 mov ebx, 92 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 add eax, 4 sub dword [eax], 0x111111ee add eax, 4 Core security weakness in all today’s software add dword [eax], 0xaaccee22 add eax, 4 jmp ebx line95_2: popf popad nop jmp long line96 Enables all sorts of replicable software line95_1: mov eax, [esp] nop nop security exploits xor eax, eax xor ecx, ecx xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret

line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx mov byte [ecx], dl xor eax, 0 Unpredictable Code Evolution mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf call line95_1 db 7 db 3 Dynamic Code Dynamic Data dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 db 3 dd 946381070 db 2 dd 3318121790 db 2 Code evolution across time dd 1375432265 db 1 dd -1 mov ebx, 92 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d Functionality evolution across location add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 add eax, 4 sub dword [eax], 0x111111ee Self contained autonomous code add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 jmp ebx line95_2: popf popad Unpredictable nop jmp long line96 line95_1: mov eax, [esp] nop nop Self aware xor eax, eax xor ecx, ecx xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret

line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx mov byte [ecx], dl Code Evolution xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf call line95_1 Resisting Reverse Engineering db 7 db 3 dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 db 3 dd 946381070 db 2 dd 3318121790 Locate the Code db 2 dd 1375432265 db 1 dd -1 not locatable mov ebx, 92 add eax, ebx mov ebx, eax Remote Execution sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 add eax, 4 Analyze the Code sub dword [eax], 0x111111ee add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 Sho ru Lifetime jmp ebx line95_2: popf Flux Mutation popad nop jmp long line96 line95_1: mov eax, [esp] Break the Code nop nop Unbreakable xor eax, eax xor ecx, ecx Self aware xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret

line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx mov byte [ecx], dl The Remote Metamorphic Engine xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf call line95_1 Remote Flux Mutation db 7 db 3 dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 db 3 dd 946381070 db 2 dd 3318121790 db 2 Tru su ed Zone Untru su ed Zone dd 1375432265 db 1 dd -1 mov ebx, 92 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 Remote Mutation Thread/Process add eax, 4 sub dword [eax], 0x111111ee add eax, 4 add dword [eax], 0xaaccee22 add eax, 4 jmp ebx Mutation Engine Morphed Code Execution line95_2: popf popad nop jmp long line96 line95_1: mov eax, [esp] nop nop xor eax, eax Challenge xor ecx, ecx Response xor edx, edx mov cl, 0xe9 mov byte [eax], cl xor edx, 0 mov ecx, 0x00000057 mov dword [eax+1], ecx ret

line46_1: mov ecx, [esp] nop nop mov dl, 0xe9 test edx, edx The Remote Metamorphic Engine mov byte [ecx], dl xor eax, 0 mov edx, 0x00000067 mov dword [ecx+1], edx ret line95: pushad pushf Challenge Response Metamorphic Protocol call line95_1 db 7 db 3 dd 838225172 db 2 dd 4211932376 db 4 dd 2520091426 db 3 dd 946381070 db 2 Tru su ed Zone Untru su ed Zone dd 3318121790 db 2 dd 1375432265 Challenge db 1 dd -1 mov ebx, 92 add eax, ebx mov ebx, eax sub dword [eax], 0xe82c334d 4 bytes size Code add eax, 4 add dword [eax], 0xa1723594 add eax, 4 xor dword [eax], 0xb1c21343 Remote Mutation Thread/Process add eax, 4 sub dword [eax], 0x111111ee add eax, 4 Clock Synced add dword [eax], 0xaaccee22 add eax, 4 Mutation Engine jmp ebx Morphed Code Execution line95_2: popf Response popad nop jmp long line96 line95_1: mov eax, [esp] nop nop xor eax, eax xor ecx, ecx xor edx, edx Communication protocol made of morphed clock mov cl, 0xe9 mov byte [eax], cl xor edx, 0 synchronized machine code rather than data mov ecx, 0x00000057 mov dword [eax+1], ecx ret