|COOKIES: By using this website you agree that we can place Google Analytics Cookies on your device for performance monitoring.|
Reverse Engineering Malware
If you have a question about this talk, please contact Wei Ming Khoo.
Program analysis is a challenging task when source code is available. It is even more challenging when neither the source code nor debug information is present. The analysis task is rendered even more challenging when the code has been obfuscated to prevent the analysis from being carried out. Malware authors often employ a myriad of these evasion techniques to impede automated reverse engineering and static analysis efforts of their binaries. The most popular technologies include “code obfuscators” that serve to rewrite the original binary code to an equivalent form that provides identical functionality while defeating signature-based detection systems. These systems significantly complicate static analysis, making it challenging to uncover the malware intent and the full spectrum of embedded capabilities. While code obfuscation techniques are commonly integrated into contemporary commodity packers, from the perspective of a reverse engineer, deobfuscation is often a necessary step that must be conducted independently after unpacking the malware binary. In this presentation, we review the main challenges when analyzing binary programs and explore techniques for recovery of information that allows program understanding and reverse-engineering. In particular, we describe a set of techniques for automatically unrolling the impact of code obfuscators with the objective of completely recovering the original malware logic. We have implemented a set of generic debofuscation rules as a plug-in for the popular IDA Pro disassembler. We use sophisticated obfuscation strategies employed by two infamous malware instances from 2009, Conficker C and Hydraq (the binary associated with the Aurora attack) as case studies. In both instances our deobfuscator enabled a complete decompilation of the underlying code logic. This work was instrumental in the comprehensive reverse engineering of the heavily obfuscated P2P protocol embedded in the Conficker worm.
This talk is part of the Computer Laboratory Security Seminar series.
This talk is included in these lists:
Note that ex-directory lists are not shown.
Other listsClare Hall Colloquium Why Deep Neural Networks Are Promising for Speech Recognition Thin Film Magnetic Talks
Other talksStructural and functional insights into RNA polymerases from –ve sense RNA viruses Neuroimmune interactions in early development and the biological embedding of health disparities Human-Data Interaction - Big Data/Digital Humanities Seminar Harnessing the Power of Non-Covalent Interactions for Organocatalysis A correspondence between SPTs and CFTs: wavefunctions, hidden order, and flux attachment NMDA receptors: diversity, molecular mechanisms and synaptic regulation.