Skip to content
CYBER TALKS

Playing Malware Injection with Exploit Thoughts

Sheng Hao Ma

MalwareMain Stage21 minOpen on YouTube ↗

Sheng Hao Ma presents playing malware injection with exploit thoughts: In the past, when hackers did malicious program code injection, they used to adopt RunPE, AtomBombing, cross-process creation threads, and other...

Summary

Architecture and Background

In the past, when hackers did malicious program code injection, they used to adopt RunPE, AtomBombing, cross-process creation threads, and other approaches. They could forge their own execution program as any critical system service.

Vulnerability Analysis

However with increasing process of anti-virus techniques, these sensitive approaches have been gradually proactively killed. Therefore, hackers began to aim at another place, namely memory-level weakness, due to the breakages of critical system service itself.

Exploitation and Demonstrations

This agenda will simply introduce a new memory injection technique that emerged after 2013, PowerLoadEx. Based on this concept, three new injection methods will be disclosed as well.

Remediation and Defensive Strategies

These makes good use of the memory vulnerability in Windows to inject malicious behavior into system critical services. The content will cover Windows reverse analysis, memory weakness analysis, how to use and utilize, and so on. The relevant PoC will be released at the end of the agenda.

Related talks

Main Stage·46 min

  • DEF CON
  • Malware
  • Date: Aug 2018
  • Location: Las Vegas

Ill See Your Missile and Raise You A MIRV

Levinson · Borges

Levinson and Borges presents ill see your missile and raise you a mirv: Typically, the activities of a malware attack occur on an execution timeline that generally consists of 3 segments—the vector, the stage, and t...

malware-analysisreverse-engineeringdetection-evasion+1

Main Stage·20 min

  • DEF CON
  • Malware
  • Date: Aug 2013
  • Location: Las Vegas

A Thorny Piece of Malware and Me

Marion Marschalek

Marion Marschalek explores a thorny piece of malware and me at DEF CON 21, examining malware-analysis and practical defenses.

malware-analysisreverse-engineeringthreat-detection+1

Main Stage·39 min

  • DEF CON
  • Malware
  • Date: Aug 2006
  • Location: Las Vegas

OllyBone: Semi-Automatic Unpacking on IA-32

Joe Stewart

Joe Stewart details joe Stewart: OllyBone: Semi-Automatic Unpacking on IA-32 Abstract: The amount of new malware being developed has increased at a staggering rate over the last couple of years.

malware-analysisbotnetreverse-engineering+1