Ce diaporama a bien été signalé.
Nous utilisons votre profil LinkedIn et vos données d’activité pour vous proposer des publicités personnalisées et pertinentes. Vous pouvez changer vos préférences de publicités à tout moment.
FuzzingMalwareforFun&Profit. ApplyingCoverage-Guided
FuzzingtoFindBugsinModernMalware
MaksimShudrak
DEF CON 26
About Me
BIO
2018 – present: Senior Offensive Security Researcher
2016: Defended PhD (Vulns Hunting) in Tomsk, Russia
2015...
Introduction & Motivation
Why coverage-guided fuzzing ?
Fuzzer overview & architecture
Fuzzer usage & demo
Case Studies. Mirai + vulnerability demo
Case Studies. TinyNuke, KINS, Dexter
Discussion, Future Work & Conclusion
Motivation . Complex Parsers
- ☺
Motivation . Complex Parsers
I am so #@$%^* tired of writing this algorithm.
Motivation . Complex Parsers
Motivation. Low Code Quality
Motivation. It is Fun!
Related Works
● DEF CON 25 Offensive Malware Analysis: Dissecting OSX/FruitFly
via a Custom C&C Server by Patrick Wardle
●...
Legal Issues
● Hacking-back is mostly illegal
○ Attack attribution is very hard and might lead to wrong conclusions
○ Hard...
Possible Benefits. Local Deny of Service (agent)
Possible Benefits. Remote Deny of Service (agent)
Benign service
Botnet
DDoS-attack
Possible Benefits. Remote Deny of Service (agent)
Benign service
Botnet
Possible Benefits. Remote Deny of Service (agent)
Benign service
Botnet
Possible Benefits. Remote Code Execution (agent)
1. Take control over botnet or shutdown botnet
2. Track down botnet owner...
Possible Benefits. Remote Code Execution in C&C
Fuzzing
● Nowadays, fuzzing is a state-of-the-art approach to find bugs
in modern applications
● Fuzzing is a part of SDLC...
Fuzzing
What is Coverage-Guided Fuzzing ?
What is Coverage-Guided Fuzzing ?
What is Coverage-Guided Fuzzing ?
What is Coverage-Guided Fuzzing ?
Why Coverage-Guided Fuzzing ?
~minutes for AFL and thousand years for dump fuzzer
State-of-the-art Coverage-Guided Fuzzers
● AFL
○ http://lcamtuf.coredump.cx/afl/
● Libfuzzer
○ https://llvm.org/docs/LibFu...
AFL Source Code Instrumentation Approach
● Custom gcc (afl-gcc) compiler is used to inject
instrumentation routines for ea...
Challenge I. Source Code
No Source Code
Challenge II. Obfuscation
Challenge III. Encryption
● Most C&C channels are encrypted
● We need to encrypt our test case the same way as malware to ...
WinAFL
● WinAFL is a port of AFL for Windows. Rely on DynamoRIO dynamic
binary instrumentation framework.
○ No need for so...
Dynamic Binary Instrumentation (DBI) is a
technique of analyzing the behavior of a binary
application at runtime through t...
How Does DynamoRIO Work ? (10000 foot view)
Target applicationLauncher
DynamoRIO Application in memory
Kernel
shared syste...
How Does DynamoRIO Work ? (10000 foot view)
Target applicationLauncher
DynamoRIO
Launch (suspended)
(1)
Application in mem...
How Does DynamoRIO Work ? (10000 foot view)
Launcher
DynamoRIO
Launch (suspended)
(1)
Application in memory
Kernel
(2)
Inj...
Target application
shared system libs
How Does DynamoRIO Work ? (10000 foot view)
Launcher
DynamoRIO
Launch (suspended)
(1...
Target application
shared system libs
How Does DynamoRIO Work ? (10000 foot view)
Launcher
DynamoRIO
Launch (suspended)
(1...
Target application
shared system libs
How Does DynamoRIO Work ? (10000 foot view)
Launcher
DynamoRIO
Launch (suspended)
(1...
Target application
shared system libs
How Does DynamoRIO Work ? (10000 foot view)
Launcher
DynamoRIO
Launch (suspended)
(1...
Challenges
● Lack of source code
● Obfuscation
● Encryption
Challenges
● Lack of source code – WinAFL + DynamoRIO
● WinAFL supports only file-based fuzzing
● Obfuscation
● Encryption
WinAFL patch (netAFL)
Malware (main module)
Malware in memory
DynamoRIO shared lib
winafl shared lib
AFL fuzzer
Fuzzer in ...
WinAFL patch (netAFL)
Malware (main module)
Malware in memory
DynamoRIO shared lib
winafl shared lib
AFL fuzzer
Fuzzer in ...
WinAFL patch (netAFL)
Malware (main module)
Malware in memory
DynamoRIO shared lib
winafl shared lib
AFL fuzzer
Fuzzer in ...
WinAFL patch (netAFL)
Malware (main module)
Malware in memory
DynamoRIO shared lib
winafl shared lib
AFL fuzzer
Fuzzer in ...
WinAFL patch (netAFL)
Malware (main module)
Malware in memory
DynamoRIO shared lib
winafl shared lib
AFL fuzzer
Fuzzer in ...
WinAFL patch (netAFL)
Malware (main module)
Malware in memory
DynamoRIO shared lib
winafl shared lib
AFL fuzzer
Fuzzer in ...
WinAFL patch (netAFL)
Malware (main module)
Malware in memory
DynamoRIO shared lib
winafl shared lib
AFL fuzzer
Fuzzer in ...
WinAFL patch (netAFL). Usage
> afl-fuzz.exe –usage
Fake server settings:
-s - Server port to listen for incoming connectio...
WinAFL patch (netAFL). User-defined Encryption & CnC
● Custom encryption function prototypes:
○ char* APIENTRY encrypt_buf...
TOOL DEMO
4 hours after
Case Study I. Mirai
未来
Mirai. Overview
Mirai. Overview
● IoT-based botnet DDoS
● Most disruptive DDoS cyber-attack in history
○ 2016 Dyn DDoS (1.2Tb/s).
○ Krebs ...
Mirai. HTTP-response parser
Mirai. Seed File
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like
Gecko) Ch...
Mirai. Fuzzing Statistics
Mirai. Vulnerability
Mirai. Crash Case
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Wndows NT 10.0; WOW64) AppleWeQKit/537.36 (KHTML,
like Geckt) Ch...
Mirai. Exploitation Demo
Case Study II. Dexter v2
Dexter. Overview
● Point-of-sales (PoS) malware which is targeted Microsoft
Windows terminals
● Steals credit/debit card d...
Dexter. Target
Dexter. Vulnerability
Case Study III. TinyNuke
TinyNuke. Overview
● Man-in-the-browser Trojan equipped with common features:
WebInjects, SOCKS, Proxy, JSON parsers and e...
TinyNuke. Target
TinyNuke. Seed File{
"expand" : "attributes",
"link" : {
"rel" : "self",
"href" : "http://localhost:8095/crowd/rest/userma...
TinyNuke. Statistics
TinyNuke. Vulnerability
TinyNuke. Crash Case
,[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[...
Case Study IV. KINS
KINS. Overview
● Banking trojan implemented on top of Zeus source code
● Used to attack major financial institution in Ger...
KINS. Seed File
HTTP/1.1 200 OK
Date: Sun, 18 Oct 2009 08:56:53 GMT
Server: Apache/2.2.14 (Win32)
Transfer-Encoding: chunk...
KINS. Target
KINS. Statistics
KINS. Vulnerability
KINS. Vulnerability
KINS. Crash Case
HTTP/1.1 200 OK
Date: Sun, 18 Oct 2009 08:56:53 GMT
Server: Ap32)
Transfer-Encoding: chunked
Lasdified: S...
Challenges and Issues
● Preliminary reverse engineering required
● Need to find/trigger target function
● Bugs in DynamoRI...
Drltrace
● Drltrace is an open-source API calls tracer for Windows (similar to
ltrace for Linux).
drltrace.exe –logdir . –...
Future Work
● Automatically find target function
● Increase stability
● Code-coverage visualization
Conclusion
● Bugs in malware exist and can be used to defend against them
● Coverage-guided fuzzing was able to find bugs ...
Thank you!
https://github.com/mxmssh/netafl
https://github.com/mxmssh
https://www.linkedin.com/in/mshudrak
Prochain SlideShare
Chargement dans…5
×

Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bugs in Modern Malware.

My recent presentation from the DEF CON 26 about malware fuzzing.

  • Identifiez-vous pour voir les commentaires

Fuzzing malware for fun & profit. Applying Coverage-Guided Fuzzing to Find Bugs in Modern Malware.

  1. 1. FuzzingMalwareforFun&Profit. ApplyingCoverage-Guided FuzzingtoFindBugsinModernMalware MaksimShudrak DEF CON 26
  2. 2. About Me BIO 2018 – present: Senior Offensive Security Researcher 2016: Defended PhD (Vulns Hunting) in Tomsk, Russia 2015-2017: Researcher, IBM Research, Haifa, Israel 2011-2015: Security Researcher, PhD student Interests Vulnerabilities Hunting Fuzzing Reverse-engineering Malware Analysis Dynamic Binary Instrumentation Projects Drltrace – transparent API-calls tracing for malware analysis https://github.com/mxmssh/drltrace WinHeap Explorer – PoC for heap-based bugs detection in x86 code https://github.com/WinHeapExplorer/WinHeap-Explorer IDAMetrics – IDA plugin for machine code complexity assessment https://github.com/mxmssh/IDAmetrics
  3. 3. Introduction & Motivation
  4. 4. Why coverage-guided fuzzing ?
  5. 5. Fuzzer overview & architecture
  6. 6. Fuzzer usage & demo
  7. 7. Case Studies. Mirai + vulnerability demo
  8. 8. Case Studies. TinyNuke, KINS, Dexter
  9. 9. Discussion, Future Work & Conclusion
  10. 10. Motivation . Complex Parsers - ☺
  11. 11. Motivation . Complex Parsers I am so #@$%^* tired of writing this algorithm.
  12. 12. Motivation . Complex Parsers
  13. 13. Motivation. Low Code Quality
  14. 14. Motivation. It is Fun!
  15. 15. Related Works ● DEF CON 25 Offensive Malware Analysis: Dissecting OSX/FruitFly via a Custom C&C Server by Patrick Wardle ● DEF CON 25 Digital Vengeance: Exploiting the Most Notorious C&C Toolkits by Professor Plum ● Targeted attacks: From being a victim to counter attacking by Andrzej Dereszowski (SIGNAL 11) ● Malware fuzzing: ○ Rasthofer, S., Arzt, S., Triller, S. and Pradel, M., 2017, May. Making malory behave maliciously: Targeted fuzzing of android execution environments. In Software Engineering (ICSE), 2017 IEEE/ACM 39th International Conference on (pp. 300-311). IEEE. ○ F. Peng, Z. Deng, X. Zhang, D. Xu, Z. Lin, and Z. Su. X-force: Force executing binary programs for security applications. In Proceedings of the 2014 USENIX Security Symposium, San Diego, CA (August 2014), 2014
  16. 16. Legal Issues ● Hacking-back is mostly illegal ○ Attack attribution is very hard and might lead to wrong conclusions ○ Hard to identify scopes of attack ○ Check out last year DEF CON Professor Plum’s presentation for more details: ■ https://www.youtube.com/watch?v=fPhkmAdWH-I ● BUT no one can prohibit us to search for bugs in malware
  17. 17. Possible Benefits. Local Deny of Service (agent)
  18. 18. Possible Benefits. Remote Deny of Service (agent) Benign service Botnet DDoS-attack
  19. 19. Possible Benefits. Remote Deny of Service (agent) Benign service Botnet
  20. 20. Possible Benefits. Remote Deny of Service (agent) Benign service Botnet
  21. 21. Possible Benefits. Remote Code Execution (agent) 1. Take control over botnet or shutdown botnet 2. Track down botnet owners 3. ????? 4. PROFIT
  22. 22. Possible Benefits. Remote Code Execution in C&C
  23. 23. Fuzzing ● Nowadays, fuzzing is a state-of-the-art approach to find bugs in modern applications ● Fuzzing is a part of SDLC ● Fuzzing is very important for applications & OS security
  24. 24. Fuzzing
  25. 25. What is Coverage-Guided Fuzzing ?
  26. 26. What is Coverage-Guided Fuzzing ?
  27. 27. What is Coverage-Guided Fuzzing ?
  28. 28. What is Coverage-Guided Fuzzing ?
  29. 29. Why Coverage-Guided Fuzzing ? ~minutes for AFL and thousand years for dump fuzzer
  30. 30. State-of-the-art Coverage-Guided Fuzzers ● AFL ○ http://lcamtuf.coredump.cx/afl/ ● Libfuzzer ○ https://llvm.org/docs/LibFuzzer.html ● AFL’s forks ○ kAFL – AFL for kernel-level fuzzing ○ WinAFL – AFL fork for Windows binaries fuzzing ○ and many others: https://github.com/mirrorer/afl/blob/master/docs/sister_projects.txt
  31. 31. AFL Source Code Instrumentation Approach ● Custom gcc (afl-gcc) compiler is used to inject instrumentation routines for each basic block ● Main routine after instrumentation looks like this:
  32. 32. Challenge I. Source Code No Source Code
  33. 33. Challenge II. Obfuscation
  34. 34. Challenge III. Encryption ● Most C&C channels are encrypted ● We need to encrypt our test case the same way as malware to be able to find bugs ● By default, AFL doesn’t support encryption, checksums and crypto signatures generation ○ There is a post processor library to deal with that
  35. 35. WinAFL ● WinAFL is a port of AFL for Windows. Rely on DynamoRIO dynamic binary instrumentation framework. ○ No need for source code access ○ Open-source ○ Fast-enough to use for coverage-guided fuzzing https://github.com/ivanfratric/winafl https://github.com/DynamoRIO/dynamorio
  36. 36. Dynamic Binary Instrumentation (DBI) is a technique of analyzing the behavior of a binary application at runtime through the injection of instrumentation code.
  37. 37. How Does DynamoRIO Work ? (10000 foot view) Target applicationLauncher DynamoRIO Application in memory Kernel shared system libs
  38. 38. How Does DynamoRIO Work ? (10000 foot view) Target applicationLauncher DynamoRIO Launch (suspended) (1) Application in memory Kernel shared system libs . .
  39. 39. How Does DynamoRIO Work ? (10000 foot view) Launcher DynamoRIO Launch (suspended) (1) Application in memory Kernel (2) Inject instrumentation library Target application shared system libs
  40. 40. Target application shared system libs How Does DynamoRIO Work ? (10000 foot view) Launcher DynamoRIO Launch (suspended) (1) Application in memory Kernel (3) Hook entry point DynamoRIO lib + user-defined libs
  41. 41. Target application shared system libs How Does DynamoRIO Work ? (10000 foot view) Launcher DynamoRIO Launch (suspended) (1) Application in memory Kernel (3) Hook entry point DynamoRIO lib + user-defined libs ins2 basic block ins3 ins1 Takefirstbasicblock (4)
  42. 42. Target application shared system libs How Does DynamoRIO Work ? (10000 foot view) Launcher DynamoRIO Launch (suspended) (1) Application in memory Kernel (3) Hook entry point DynamoRIO lib + user-defined libs ins2 basic block transformation (5) ins1 ins2 DR’s ins6 ins3 ins1 Code cache DR’s ins1 DR’s ins2 DR’s ins3 DR’s ins4 DR’s ins5 ins3 (4) Takefirstbasicblock
  43. 43. Target application shared system libs How Does DynamoRIO Work ? (10000 foot view) Launcher DynamoRIO Launch (suspended) (1) Application in memory Kernel (3) Hook entry point DynamoRIO lib + user-defined libs Takefirstbasicblock (4) ins2 basic block transformation (5) ins1 ins2 DR’s ins6 ins3 ins1 Code cache DR’s ins1 DR’s ins2 DR’s ins3 DR’s ins4 DR’s ins5 ins3 Takenextbasicblock (6)
  44. 44. Challenges ● Lack of source code ● Obfuscation ● Encryption
  45. 45. Challenges ● Lack of source code – WinAFL + DynamoRIO ● WinAFL supports only file-based fuzzing ● Obfuscation ● Encryption
  46. 46. WinAFL patch (netAFL) Malware (main module) Malware in memory DynamoRIO shared lib winafl shared lib AFL fuzzer Fuzzer in memory User-defined encryption Client/server module
  47. 47. WinAFL patch (netAFL) Malware (main module) Malware in memory DynamoRIO shared lib winafl shared lib AFL fuzzer Fuzzer in memory User-defined encryption Client/server module
  48. 48. WinAFL patch (netAFL) Malware (main module) Malware in memory DynamoRIO shared lib winafl shared lib AFL fuzzer Fuzzer in memory User-defined encryption (2) Encrypt Client/server module
  49. 49. WinAFL patch (netAFL) Malware (main module) Malware in memory DynamoRIO shared lib winafl shared lib AFL fuzzer Fuzzer in memory User-defined encryption (2) Encrypt Client/server module
  50. 50. WinAFL patch (netAFL) Malware (main module) Malware in memory DynamoRIO shared lib winafl shared lib AFL fuzzer Fuzzer in memory User-defined encryption Coverage bitmap Shared memory (2) Encrypt (4) Update bitmap Client/server module
  51. 51. WinAFL patch (netAFL) Malware (main module) Malware in memory DynamoRIO shared lib winafl shared lib AFL fuzzer Fuzzer in memory User-defined encryption Coverage bitmap Shared memory (2) Encrypt (4) Update bitmap (5) Estimate coverage, generate new test case Client/server module
  52. 52. WinAFL patch (netAFL) Malware (main module) Malware in memory DynamoRIO shared lib winafl shared lib AFL fuzzer Fuzzer in memory User-defined encryption Coverage bitmap Shared memory (2) Encrypt (4) Update bitmap (5) Estimate coverage, generate new test case (6) Restart target routine Client/server module
  53. 53. WinAFL patch (netAFL). Usage > afl-fuzz.exe –usage Fake server settings: -s - Server port to listen for incoming connections Network fuzzing settings: -a - IP address to send data in -U - Use UDP (default TCP) -p - Port to send data in -w - Delay in milliseconds before sending data User-defined cryptographic library settings: -L - Path to library with user-defined crypto User-defined CnC server settings: -l - Path to library with user-defined CnC server
  54. 54. WinAFL patch (netAFL). User-defined Encryption & CnC ● Custom encryption function prototypes: ○ char* APIENTRY encrypt_buffer(char *buf, int buf_size) – to encrypt ○ void APIENTRY free_buffer(char *buf) – to free memory used for encrypted data ● Custom CnC function prototypes: ○ int APIENTRY cnc_init(char *port) - to init CnC ○ int APIENTRY cnc_run(char *data) - to send AFL’s test case ● There is an example distributed with winAFL patch (netAFL)
  55. 55. TOOL DEMO
  56. 56. 4 hours after
  57. 57. Case Study I. Mirai 未来
  58. 58. Mirai. Overview
  59. 59. Mirai. Overview ● IoT-based botnet DDoS ● Most disruptive DDoS cyber-attack in history ○ 2016 Dyn DDoS (1.2Tb/s). ○ Krebs on Security (620 Gb/s) ○ OVH DDoS (1TB/s) ● Hundreds of thousands devices across 164 countries ● Some elements of SDLC:
  60. 60. Mirai. HTTP-response parser
  61. 61. Mirai. Seed File GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 Host: localhost Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.8 Content-Type: application/x-www-form-urlencoded content-length: 3
  62. 62. Mirai. Fuzzing Statistics
  63. 63. Mirai. Vulnerability
  64. 64. Mirai. Crash Case GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Wndows NT 10.0; WOW64) AppleWeQKit/537.36 (KHTML, like Geckt) Chrome/51.0.2704.103 Safari/537.36 Host: location:/keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,imagv/ ,*/*;q=0.8 Accept-Language: =0.8 Content-Type: applicat n/x-www-form-urlencoded content-length: 3 LOL
  65. 65. Mirai. Exploitation Demo
  66. 66. Case Study II. Dexter v2
  67. 67. Dexter. Overview ● Point-of-sales (PoS) malware which is targeted Microsoft Windows terminals ● Steals credit/debit card details ● First known botnet that targets POS terminals (mostly in US)
  68. 68. Dexter. Target
  69. 69. Dexter. Vulnerability
  70. 70. Case Study III. TinyNuke
  71. 71. TinyNuke. Overview ● Man-in-the-browser Trojan equipped with common features: WebInjects, SOCKS, Proxy, JSON parsers and etc. ● Distributed over trojanized PDF Reader
  72. 72. TinyNuke. Target
  73. 73. TinyNuke. Seed File{ "expand" : "attributes", "link" : { "rel" : "self", "href" : "http://localhost:8095/crowd/rest/usermanagement/1/user?username=my_username" }, "name" : "my_username", "first-name" : "My", "last-name" : "Username", "display-name" : "My Username", "email" : "user@example.test", "password" : { "link" : { "rel" : "edit", "href" : "http://localhost:8095/crowd/rest/usermanagement/1/user/password?username=my_username" } }, "active" : true, "attributes" : { "link" : { "rel" : "self", "href" : "http://localhost:8095/crowd/rest/usermanagement/1/user/attribute?username=my_username" }, "attributes" : [] } }
  74. 74. TinyNuke. Statistics
  75. 75. TinyNuke. Vulnerability
  76. 76. TinyNuke. Crash Case ,[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[<truncated>[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[] и]]] ,[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[ [{[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[]]]]]] ,[[[[[[[[[[[[[[[[[[[[[[[[[• [[[[[[[[[[[[[[ [[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[]]]]]]]]]]]]]]]]Э
  77. 77. Case Study IV. KINS
  78. 78. KINS. Overview ● Banking trojan implemented on top of Zeus source code ● Used to attack major financial institution in Germany and Netherlands ● Contains rootkit module, HTTP-protocol parser and Web- injection capabilities
  79. 79. KINS. Seed File HTTP/1.1 200 OK Date: Sun, 18 Oct 2009 08:56:53 GMT Server: Apache/2.2.14 (Win32) Transfer-Encoding: chunked Last-Modified: Sat, 20 Nov 2004 07:16:26 GMT ETag: "10000000565a5-2c-3e94b66c2e680" Accept-Ranges: bytes Content-Length:44 Connection: close Content-Type: text/html X-Pad: avoid browser bug AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA <html><body><h1>It works!</h1></body></html>
  80. 80. KINS. Target
  81. 81. KINS. Statistics
  82. 82. KINS. Vulnerability
  83. 83. KINS. Vulnerability
  84. 84. KINS. Crash Case HTTP/1.1 200 OK Date: Sun, 18 Oct 2009 08:56:53 GMT Server: Ap32) Transfer-Encoding: chunked Lasdified: Sat, 20 Nov 2004 07:16:26 GMT ETag: "10000000565a5-2c-3e94b66c2e680" Accept-Ranges: bytes Content-Length: Connection: close Content-Type: text/html X-Pad: avoid browser bug AAAAAAAAy><h1>It works!</h1></body></html>
  85. 85. Challenges and Issues ● Preliminary reverse engineering required ● Need to find/trigger target function ● Bugs in DynamoRIO/WinAFL ● Seed file selection ● Traffic encryption ● Stability
  86. 86. Drltrace ● Drltrace is an open-source API calls tracer for Windows (similar to ltrace for Linux). drltrace.exe –logdir . –print_ret_addr – malware.exe https://github.com/mxmssh/drltrace
  87. 87. Future Work ● Automatically find target function ● Increase stability ● Code-coverage visualization
  88. 88. Conclusion ● Bugs in malware exist and can be used to defend against them ● Coverage-guided fuzzing was able to find bugs in each malware selected for experiment within 24 hours ● Two bugs lead to RCE, one bug can be used to defend against DDoS ● This technique can also be used to find bugs in network-based applications (probably most useful application )
  89. 89. Thank you! https://github.com/mxmssh/netafl https://github.com/mxmssh https://www.linkedin.com/in/mshudrak

×