Using Microsoft Detours For Deep System Inspection
Examines using Microsoft Detours For Deep System Inspection and evaluates key implications for security practitioners.
Summary
File Operation Vulnerabilities in OT
The speaker opens with SCADA alert managers that write logs using elevated privileges, showing how mispointed config files can corrupt critical binaries and cause endless reboots.
Why Static Analysis Falls Short
Logical file-operation bugs persist across architectures and look benign to automated tools because privileged processes routinely create, move, and delete files.
Microsoft Detours Approach
Dynamic binary instrumentation injects detour functions around syscalls without recompiling targets. Detours is chosen as a lightweight native Windows option versus heavier frameworks like Frida.
Inspection Logic
A DLL hooks high-integrity file operations, filters by integrity level and syscall type, and logs risky create, move, or delete behavior to surface privilege-abuse paths in engineering workstations.
Related talks
S4 Events·27 min
Security researchers examine technical aspects of How Deep Is Your Deep Packet Inspection (DPI).
Black Hat·48 min
Analysts investigate attack surfaces and defenses concerning Securing the System: A Deep Dive into Reversing Android Pre-Installed Apps.
Black Hat·45 min
Presenters detail vulnerability discovery and exploitation in USA 2013 - Evading deep inspection for fun and shell.