Beyond Vulnerabilities: Analyzing Behaviors to Spot Malware in Your Release

The talk starts from a shift in thinking: the SolarWinds, Equifax and 3CX incidents show that a release can cause harm without containing any vulnerability. Vulnerability scanners look for flaws in code and do not assess what a program is meant to do, so they miss malicious additions. Build pipelines are also hard to lock down because they span many tools, runners and dependency sources.

The proposed approach is to analyze behaviors instead of only bugs. Static binary analysis unpacks a package layer by layer, down to compiled code, and maps that code to system effects such as starting processes, opening network sockets or changing security services. Dynamic sandboxing is slower and can be evaded by malware that stays dormant. The key idea is differential analysis: set a known-good release as a baseline and review the behaviors that are new in each later version. Examples from SolarWinds and 3CX showed new low-level calls and a partially validated digital signature in changed DLLs, and a backdoor injected at build time in a Black Hat demonstration added new network behaviors.

The talk closed with a Jenkins demo in which a static scan stage ran after each build. A modified sample web app that read a password file and sent it out produced eleven new behaviors in the diff. The takeaways are to automate the diff in CI/CD, define which behaviors each release should have, and fail builds on unexpected changes. Behavior comparison also helps check reproducible builds, where file hashes differ for harmless reasons.