How to convince a malware to avoid us
- 1. How to convince a malware to avoid us? Csaba Fitzl
- 2. whoami blue teamer security researcher, blogger certification monkey husband, father hiker
- 3. What is this talk about?
- 5. Agenda part #1 - What malware authors afraid of and how they detect it? part #2 - Real world examples part #3 - My POC tools for vaccination
- 6. What malware authors are afraid of?
- 7. security researchers sandboxes virtual machines hardened machines => malware hates being analyzed also tries to avoid certain targets
- 8. How they detect it?
- 9. Debuggers IsDebuggerPresent PEB!IsDebugged PEB!NtGlobalFlags OutputDebugString timing (RDTSC) self debug INT3 actual windows names etc…
- 10. Virtual machines look for artifacts in: registry file system processes MAC address… VMware I/O ports red pill
- 11. Sandboxes screen resolution (low) installed software (limited) number of cores memory desktop etc… ref: Zoltán Balázs – Sandbox detection for the masses: leak, abuse, test
- 12. Antivirus registry file system antivirus product registered
- 15. 048fc07fb94a74990d2d2b8e92c099f3f986 af185c32d74c857b07f7fcce7f8e Word dropper sandbox detection Public Sub IuIxpP() If DKTxHE Then Error 101 If qrNjY Then Error 102 (…) Public Function DKTxHE() As Boolean DKTxHE = RecentFiles.Count < 3 End Function
- 16. demo time
- 17. c279165952de10a5f715df706da26b2d5a57cc 50e49dcab74fc91dba2ce1408b generic trojan checks for plenty of analysis SW checks for anti malware
- 18. demo time
- 19. ca7cb56b9a254748e983929953df32f219905f 96486d91390e8d5d641dc9916d Teslacrypt antivirus detection
- 20. demo time
- 21. Today’s research
- 22. What is in the focus? mainly about hiding analysis tools e.g.: zer0fox ease researcher’s job verify environment - pafish
- 23. How about vaccination? let’s try to emulate ‘unhealthy’ environment less researched malware might avoid us
- 24. Previous research White Paper Towards an Understanding of Anti-virtualization and Anti-debugging Behavior in Modern Malware, 2008 Rapid7 Vaccinating systems against VM-aware malware, 2013 Gal Bitensky Demo Vaccination The Anti-Honeypot Approach, 2016 various tools against specific malware
- 25. My PoC tools
- 27. tool #1: fakevm kernel driver w/ SSDT hooking up to Win7 x86 can emulate VBOX / VMWARE files & registry keys easy to extend w/ other keys, files
- 28. demo time
- 29. tool #2: FakeDebuggerWindows simple Windows app creates a window, and doesn’t show it no conflict with other windows
- 30. demo time
- 31. tool #3: mutex-grabber monitor malwr.com for mutexes dynamically add them to the system allows whitelisting saving / loading files
- 32. demo time
- 33. Challenges software compatibility does normal sw care about VM / debuggers? system resources low level vaccination? needs to be done in clever way (e.g.: machine can’t be VBOX and VMware at the same time)
- 35. HitMan Pro Alert uses vaccination other interesting protections as well tested w/ Pafish
- 36. demo time
- 37. Minerva Labs sw dedicated for vaccination claims to stop many malware these days
- 38. Conclusion
- 39. interesting area it is effective against malware should be more commonly researched could have two long term effects malware stop caring about VM, etc.. -> this method won’t be effective, but analysis might be easier everything stays -> we can protect against malware