Few words are as aptly descriptive as "malware"; cue overused "what it says on the tin" remark. Of course, hostile software is ever evolving, and Black Hat-associated research is one of the key loci of information on monitoring, defending against, and nullifying it. With that in mind, today we'll preview a quartet of interesting malware-related Briefings from Black Hat USA 2014.
In the security world it's a given that nationstates often get the funnest (and scariest) toys. One case in point is Snake (also known as Turla and Uroboros) a highly sophisticated malware that maintains persistent access using covert communications, some of which are very difficult to detect. Sergei Shevchenko's Dissecting Snake - A Federal Espionage Toolkit will demonstrate key aspects of Snake's functionality, including usermode-centric and kernel-centric architectures, rootkit capabilities, encrypted virtual volumes, and C&C traffic authorization.
Modern, 64-bit versions of Windows raise the bar for kernel-mode rootkits, with features like Driver Signature Enforcement and PatchGuard more capably protecting the keys to the kingdom. Plan B? Subvert the system before the OS takes control. Legacy BIOS systems lack the newer Secure Boot protections, as the Master Boot Record, Volume Boot Record, and bootstrap code all reside in unsigned sectors of disk. Come to Exposing Bootkits with BIOS Emulation to see how a combo of low-level anti-rootkit techniques, emulation, and heuristic detection logic can sniff out bootkits on these legacy systems.
Anti-virus solutions make grand claims about their effectiveness against unknown malwares, but how can a user know which is most capable? One thing they could do is attend One Packer to Rule Them All: Empirical Identification, Comparison, and Circumvention of Current Antivirus Detection Techniques in which Alaeddine Mesbahi and Arne Swinnen will run through their empirical findings, which include that A/Vs are much more effective detecting x86 than x64 malware. To keep things light, they also developed new packing techniques that render malwares completely undetectable to current products.
In 2011 Rodrigo Branco, Gabriel Negreira Barbosa et al presented a wide range of anti-reverse engineering techniques found in malware, along with detection algorithms and statistics on prevalence. Unfortunately, the industry didn't take this info and run with it, so they're trying again with Prevalent Characteristics in Modern Malware. Armed with data from 12+ million samples, they'll demonstrate the prevalence of over 50 additional non-defensive characteristics found in modern malware, as well as how the malware responds to analysis. This time, their extensive malware database will hopefully get the notice it deserves.
Regular registration ends on July 26. Please visit Black Hat USA 2014's registration page to get started.