A Thorny Piece of Malware and Me
Marion Marschalek explores a thorny piece of malware and me at DEF CON 21, examining malware-analysis and practical defenses.
Summary
Architecture and Background
A Thorny Piece Of Malware (And Me): The Nastiness of SEH, VFTables & Multi-Threading MARION MARSCHALEK ANALYST, IKARUS SECURITY SOFTWARE GMBH Reverse Engineering is the supreme discipline in analyzing malware, how else would you find out all capabilities of a malicious sample? But this task gets trickier nearly every day, as malware authors apply new techniques to evade analysis. Even worse, documentation of said techniques is barely existent, which makes our job even harder.
Vulnerability Analysis
This talk will focus on the challenges of a specifically thorny piece of malware, detected as Backdoor.Win32.Banito. It will discuss the palette of anti-analysis measures found and show a path through a multi-threaded file-infecting spy bot. The talk will try to shed some light on the merely shallow documentation of the binary layout of Windows Structured Exception Handling (SEH), point out complications in analyzing object oriented C++ binaries and give an insight on how to tackle multi-threaded executables.
Exploitation and Demonstrations
Marion Marschalek (@pinkflawd) is currently employed at IKARUS Security Software GmbH based in Vienna, Austria. She is working as Malware Analyst and in Incident Response for two years now. Besides that Marion teaches basics of malware analysis at University of Applied Sciences St.
Remediation and Defensive Strategies
Pölten. She has a technical degree, achieved through three different universities on three different continents. In March this year Marion won the Female Reverse Engineering Challenge 2013, organized by RE professional Halvar Flake. Materials:
Related talks
Main Stage·39 min
Deral Heiland
Deral Heiland details deral Heiland, The Insecure Workstation II "Bob Reloaded" The insecure workstation II "Bob Reloaded".
Main Stage·46 min
Levinson · Borges
Levinson and Borges presents ill see your missile and raise you a mirv: Typically, the activities of a malware attack occur on an execution timeline that generally consists of 3 segments—the vector, the stage, and t...
Main Stage·21 min
Sheng Hao Ma
Sheng Hao Ma presents playing malware injection with exploit thoughts: In the past, when hackers did malicious program code injection, they used to adopt RunPE, AtomBombing, cross-process creation threads, and other...