Man in the Malware: Intercepting Adversarial Communications
Demonstrates methodologies for intercepting and decrypting command-and-control traffic between active malware implants and adversary servers.
Summary
The Challenge of Command-and-Control Visibility
Advanced malware families protect their command-and-control (C2) channels using custom symmetric encryption, dynamic domain generation algorithms (DGAs), and layered TLS tunnels.
Reverse Engineering Malware Cryptographic Protocols
Ben Folland walks through the technical process of extracting hardcoded cryptographic keys, decrypting config blocks, and reconstructing proprietary C2 communication protocols.
Man-in-the-Middle Interception and Emulation
By creating protocol-accurate server emulators and intercepting active C2 sessions, researchers can monitor adversary commands, track infected victim populations, and harvest operational threat intelligence.
Operationalizing Adversary Telemetry
Leveraging intercepted adversary communications enables defenders to generate proactive detection rules, alert compromised victims, and assist law enforcement in disrupting cybercrime syndicates.
Related talks
Main Stage·39 min
Joe Stewart
Joe Stewart details joe Stewart: OllyBone: Semi-Automatic Unpacking on IA-32 Abstract: The amount of new malware being developed has increased at a staggering rate over the last couple of years.
Main Stage·44 min
Valsmith · Quist
Valsmith and Quist explores hacking malware: offense is the new defense at DEF CON 14, examining malware-analysis and practical defenses.
Main Stage·34 min
Michael Torres · Zane Hoffman
Provides an inside look at a massive operational relay network (ORB) of compromised IoT devices and routers used by Chinese APT actors to obfuscate cyber attacks.