Hardware-Assisted Malware Analysis
0 likes54 views
The document presents a proposal for hardware-assisted malware analysis, highlighting the challenges malware poses in evading analysis and the benefits of hardware-assisted solutions for improving transparency and effectiveness in detection. It outlines developments in the proposed framework, discusses future work, and emphasizes the importance of addressing security, performance, and development trade-offs. Additionally, it lists relevant publications and concludes with contact information for further inquiries.
Hardware-Assisted Malware Analysis
- 1. Introduction Hardware-Assisted Solutions My Proposal Conclusions Hardware-Assisted Malware Analysis Marcus Botacin1, Andr´e Gr´egio3, Paulo L´ıcio de Geus2 1Msc. Computer Science Institute of Computing - UNICAMP marcus@lasca.ic.unicamp.br 2Advisor Institute of Computing - UNICAMP paulo@lasca.ic.unicamp.br 3Co-Advisor Federal University of Paran´a (UFPR) gregio@inf.ufpr.br CTD - SBSEG Hardware-Assisted Malware Analysis IC-UNICAMP
- 2. Introduction Hardware-Assisted Solutions My Proposal Conclusions Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 3. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Problem Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 4. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Problem Malware Threats. Figure: Washington Post: https://tinyurl.com/ljo7ekm Figure: BBC: https://tinyurl.com/mfogjhe Hardware-Assisted Malware Analysis IC-UNICAMP
- 5. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Solution Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 6. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Solution Malware Analysis. Figure: Imperva: https://tinyurl.com/zkbsnl2 Figure: Enigma: https://tinyurl.com/kydgwve Hardware-Assisted Malware Analysis IC-UNICAMP
- 7. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Challenges Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 8. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Challenges The Challenges. Figure: Themerkle: https://tinyurl.com/kasuxcr Figure: Forbes: https://tinyurl.com/l7ecrex Hardware-Assisted Malware Analysis IC-UNICAMP
- 9. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Challenges How to stop analysis? Table: Anti-Analysis: Tricks summary. Malware samples may employ multiple techniques to evade distinct analysis procedures. Technique Description Reason Implementation Anti Check if running Blocks reverse Fingerprinting Debug inside a debugger engineering attempts Anti Check if running Analysts use VMs Execution VM inside a VM for scalability Side-effect Anti Fool disassemblers AV signatures may Undecidable Disassembly to generate wrong opcodes be based on opcodes Constructions Hardware-Assisted Malware Analysis IC-UNICAMP
- 10. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Challenges And then... Figure: Commercial solution armored with anti-debug technique. Hardware-Assisted Malware Analysis IC-UNICAMP
- 11. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Challenges And then... Figure: Real malware impersonating a secure solution which cannot run under an hypervisor. Hardware-Assisted Malware Analysis IC-UNICAMP
- 12. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Benefits Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 13. Introduction Hardware-Assisted Solutions My Proposal Conclusions The Benefits Transparency 1 Higher privileged. 2 No non-privileged side-effects. 3 Identical Basic Instruction Semantics. 4 Transparent Exception Handling. 5 Identical Measurement of Time. Hardware-Assisted Malware Analysis IC-UNICAMP
- 14. Introduction Hardware-Assisted Solutions My Proposal Conclusions A Summary Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 15. Introduction Hardware-Assisted Solutions My Proposal Conclusions A Summary A Survey Table: Hardware features. Technique PROS CONS Gaps HVM Ring -1 Hypervisor High development overhead SMM Ring -2 BIOS High development implementation cost AMT Ring -3 Chipset No malware code change analysis solution HPCs Lightweight Context-limited No malware information analysis solution GPU Easy to program No register No introspection data procedures TSX Commit-based Store only Overcome the few KB KB barrier SGX Isolates goodware Also isolates No enclave malware inspection SOCs Tamper-proof Passive Raise alarms components Hardware-Assisted Malware Analysis IC-UNICAMP
- 16. Introduction Hardware-Assisted Solutions My Proposal Conclusions Background Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 17. Introduction Hardware-Assisted Solutions My Proposal Conclusions Background Branch Monitors Figure: Branch Stack. Hardware-Assisted Malware Analysis IC-UNICAMP
- 18. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 19. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Proposed Framework Figure: Proposed framework architecture. Hardware-Assisted Malware Analysis IC-UNICAMP
- 20. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I develop a performance-counter-based malware analyzer? Could I isolate processes’ actions? Figure: Data Storage (DS) AREA. Hardware-Assisted Malware Analysis IC-UNICAMP
- 21. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I develop a performance-counter-based malware analyzer? Is CG reconstruction possible? Table: ASLR - Library placement after two consecutive reboots. Library NTDLL KERNEL32 KERNELBASE Address 1 0xBAF80000 0xB9610000 0xB8190000 Address 2 0x987B0000 0x98670000 0x958C0000 Hardware-Assisted Malware Analysis IC-UNICAMP
- 22. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I develop a performance-counter-based malware analyzer? Is CG reconstruction possible? Table: Function Offsets from ntdll.dll library. Function Offset NtCreateProcess 0x3691 NtCreateProcessEx 0x30B0 NtCreateProfile 0x36A1 NtCreateResourceManager 0x36C1 NtCreateSemaphore 0x36D1 NtCreateSymbolicLinkObject 0x36E1 NtCreateThread 0x30C0 NtCreateThreadEx 0x36F1 Hardware-Assisted Malware Analysis IC-UNICAMP
- 23. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I develop a performance-counter-based malware analyzer? Is CG reconstruction possible? Figure: Introspection Mechanism. Hardware-Assisted Malware Analysis IC-UNICAMP
- 24. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I develop a performance-counter-based malware analyzer? Is CG reconstruction possible? _lock_file+0x90printf+0xe3__iob_funcprintf+0xcaprintfNewToy Figure: Step Into. scanf+0x3f NewToy printf Figure: Step Over. Hardware-Assisted Malware Analysis IC-UNICAMP
- 25. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I retrieve all executed functions ? Is CFG reconstruction possible? Figure: Code block identification. Hardware-Assisted Malware Analysis IC-UNICAMP
- 26. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I retrieve all executed functions ? Is CFG reconstruction possible? Figure: it is possible to reconstruct the whole execution flow. Hardware-Assisted Malware Analysis IC-UNICAMP
- 27. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Is the final solution transparent? Deviating Behavior Figure: Deviating behavior identification. Hardware-Assisted Malware Analysis IC-UNICAMP
- 28. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Is the final solution transparent? Deviating Behavior Figure: Divergence: True Positive. Figure: Divergence: False Positive. Hardware-Assisted Malware Analysis IC-UNICAMP
- 29. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I develop a Debugger? Inverted I/O Figure: Debugger’s working mechanism. Hardware-Assisted Malware Analysis IC-UNICAMP
- 30. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Could I develop a Debugger? Integration Figure: GDB integration. Hardware-Assisted Malware Analysis IC-UNICAMP
- 31. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Does the solution handle ROP attacks? ROP Attacks Figure: ROP chain example. Hardware-Assisted Malware Analysis IC-UNICAMP
- 32. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Does the solution handle ROP attacks? CALL-RET Policy Figure: CALL-RET CFI policy. Hardware-Assisted Malware Analysis IC-UNICAMP
- 33. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Does the solution handle ROP attacks? Exploit Analysis Table: Excerpt of the branch window of the ROP payload. FROM TO —- 0x7c346c0a 0x7c346c0b 0x7c37a140 0x7c37a141 —- Hardware-Assisted Malware Analysis IC-UNICAMP
- 34. Introduction Hardware-Assisted Solutions My Proposal Conclusions Developments Does the solution handle ROP attacks? Exploit Analysis Listing 1: Static disassembly of the MSVCR71.dll library. 1 7 c346c08 : f2 0 f 58 c3 addsd %xmm3,%xmm0 2 7 c346c0c : 66 0 f 13 44 24 04 movlpd %xmm0,0 x4(%esp ) Listing 2: Dynamic disassembly of the MSVC71.dll executed code. 1 0x1000 ( s i z e =1) pop rax 2 0x1001 ( s i z e =1) r e t Hardware-Assisted Malware Analysis IC-UNICAMP
- 35. Introduction Hardware-Assisted Solutions My Proposal Conclusions Remarks Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 36. Introduction Hardware-Assisted Solutions My Proposal Conclusions Remarks Lessons learned Transparency is essential. Hardware-assisted approaches may fulfill transparency requirements. There are open problems on hardware monitoring. Security, performance, and development efforts as trade-offs (really?). Performance monitors as lightweight alternatives. Hardware-Assisted Malware Analysis IC-UNICAMP
- 37. Introduction Hardware-Assisted Solutions My Proposal Conclusions Future Work Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 38. Introduction Hardware-Assisted Solutions My Proposal Conclusions Future Work And now? Multi-core monitor. Linux Monitor. Malware clustering. Hardware-Assisted Malware Analysis IC-UNICAMP
- 39. Introduction Hardware-Assisted Solutions My Proposal Conclusions Publications Topics 1 Introduction The Problem The Solution The Challenges 2 Hardware-Assisted Solutions The Benefits A Summary 3 My Proposal Background Developments 4 Conclusions Remarks Future Work Publications Hardware-Assisted Malware Analysis IC-UNICAMP
- 40. Introduction Hardware-Assisted Solutions My Proposal Conclusions Publications Main Papers Who watches the watchmen: A security-focused review on current state-of-the-art techniques, tools and methods for systems and binary analysis on modern platforms—ACM Computing Surveys (A1). Enhancing Branch Monitoring for Security Purposes: From Control Flow Integrity to Malware Analysis and Debugging—ACM Transactions on Privacy and Security (A2). The other guys: automated analysis of marginalized malware—Journal of Computer Virology and Hacking techniques (B1). Hardware-Assisted Malware Analysis IC-UNICAMP
- 41. Introduction Hardware-Assisted Solutions My Proposal Conclusions Publications Solution’s Availability Figure: Solution’s Availability. Solution is public on github. https://github.com/marcusbotacin/BranchMonitoringProject Hardware-Assisted Malware Analysis IC-UNICAMP
- 42. Introduction Hardware-Assisted Solutions My Proposal Conclusions Publications Questions ? Contact marcus@lasca.ic.unicamp.br mfbotacin@inf.ufpr.br Hardware-Assisted Malware Analysis IC-UNICAMP