Upload File

security research and development framework · security research and development framework by amr...

  • Home
  • Documents
  • Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT
43
LOGO Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT

Upload: others

Post on 23-Mar-2020

6 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

LOGO

Security Research and Development

Framework

By Amr Thabet

Malware Researcher

@Q-CERT

Page 2: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

About The Author

Malware Researcher at Q-CERT

Wrote a Stuxnet Malware Analysis Paper

Author of Pokas x86 Emulator

Author of SRDF (what we will talk about)

Page 3: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Introduction

Development Framework (Library)

Contains many security classes/tools

Created For:

Malware Analysis

Packet Analysis

Antivirus and Firewall Tools

Free and Open Source

Page 4: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Why SRDF?

For This Guy !!

Page 5: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Why SRDF?

Implement your Inovative Idea

Don’t re-invent The Wheel

Don’t waste your time

Flexible Design

Production Quality

Community Based Development and Beta-testing

Page 6: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Contents

Design

• User-Mode

• Kernel-Mode

• Features

Major Projects

• Packetyzer

• x86 Emulator

Projects Based on SRDF

• Inspector’s Gadget

• Exploitation Detection System (EDS)

Page 7: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

User-Mode Design

Page 8: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

User-Mode Design

Infrastructure:

The Common Part at any Framework … not related to

security

Targets:

What you will secure or secure from

Libraries:

The Security Tools are here … it’s divided into Malware

and Network

Core:

The interface and the managment

Page 9: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Features

Full OOP

PE, ELF, PDF and Andorid File Parsers

x86 Disassembler, Debugger and Emulator

API Hooking

Packet, Protocol and Network Flow Analysis

Production Quality

FREE and Open Source

Page 10: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Kernel-Mode

Support x32 Bits until now

Little bit old

Should be extended to x64

Under Construction

Page 11: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Kernel- Mode Design

Page 12: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Major Projects

• Packetyzer

• x86 Emulator

Page 13: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Packetyzer

Created By Anwar Mohamed

Packet Analysis Tool

Session Separation

Generating Packets and Send (Winpcap)

Decodes:

ARP,ICMP,TCP,UDP

HTTP, DNS

Parse PCAP Files

Reassemble Packets

Page 14: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Design

Page 15: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Simple Demo – Read Pcap File

Page 16: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Simple Demo – DNS Streams

Page 17: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Simple Demo – HTTP Streams

Page 18: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Simple Demo – HTTP Output

Page 19: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Packetyzer

Reach it at:

https://github.com/AnwarMohamed/Packetyzer

It’s also a Part of SRDF

https://github.com/AnwarMohamed/Packetyzer
Page 20: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Pokas Emulator

For win32 Applications

very powerful debugger

Monitor Memory Writes

Emulate PE Files and Shellcode

Dump The Process

Reconstruct Import Table

SRDF has a Wrapper Class for it

Page 21: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Design

Page 22: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

The Emulator’s Debugger

Take String Condition

Convert it into Native Code

Very Fast

Easy to Customize

Have Predefined Functions

Allow to Add Function

Page 23: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Examples

“__isdirty(eip)“

"__disp() >=0x00401000 &&ecx>10“

"(eax& 0xff)> 5*(edx& 0xff) || __read(0x401000)==0x500“

"__isapiequal('getprocaddress') || __isapiequal('loadlibraryA')“

Page 24: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Demo: Unpack UPX - PEid

Page 25: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Demo: Unpack UPX – ImportTable

Page 26: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Demo: Unpack UPX - Code

Page 27: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Demo: Unpack UPX – Run Code

Page 28: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Demo: Unpack UPX - Unpacked

Page 29: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Demo: Unpack UPX - ImportTable

Page 30: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

x86 Emulator

Reach it at:

https://github.com/AmrThabet/x86Emulator

https://github.com/AmrThabet/x86Emulator
Page 31: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Projects Based on SRDF

• Inspector’s Gadget

• Exploitation Detection System

Page 32: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Inspector’s Gadget

Created by Jonas lykkegaard

ROP gadget indexing and searching tool.

Emulating Gadgets

Scoring and Categorizing

Flexible Search

Page 33: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Design

Page 34: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Features

Categorizing by Behavior

Scoring Gadgets

Allow ret, pop/jmp, iret and ret far

Depends on SQLite

SQL Searching

Predefined SQL Queries

GUI Based

Page 35: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

GUI

Page 36: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT
Page 37: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Exploitation Detection System

Security Mitigation Tool

Detect memory corruption exploits

Based on SRDF

Talked about it in

Reach it at:Defcon 21 archive

Page 38: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Normal API call check

Page 39: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

API call with Ret

Page 40: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Reach Us

SRDF Links:

https://github.com/AmrThabet/winSRDF

FB: http://www.facebook.com/SecDevelop

Twitter: https://twitter.com/winSRDF

Website: http://security-framework.com/

https://github.com/AmrThabet/winSRDF
http://www.facebook.com/SecDevelop
https://twitter.com/winSRDF
http://security-framework.com/
http://security-framework.com/
http://security-framework.com/
Page 41: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Conclusion

Development Framework for security

Contains many tools in Malware and Network

Flexible expandable Design

Kernel-Mode and User-Mode

Free and Open Source

Join Us

Page 42: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

Any Question?

Page 43: Security Research and Development Framework · Security Research and Development Framework By Amr Thabet Malware Researcher @Q-CERT . About The Author Malware Researcher at Q-CERT

LOGO


Embedded devices, an AntiVirus-free safe hideout for Malware KiChan Ahn - Hanyang University, Undergraduate DongJoo Ha - AhnLab Inc., Security Researcher

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

EMC Smarts VoIP Management Suite Certification Framework ... · cert-avaya.conf cert-cisco.conf cert-nortel.conf cert-core.conf cert-microsoft.conf cert-veritas.conf cert-hp.conf

Nicolas Brulez (@nicolasbrulez) Principal Malware Researcher Global Research & Analysis Team

Coordinated Vulnerability Disclosure Part 5 · Coordinated Vulnerability Disclosure . by Dan Klinedinst. And Dan is a . vulnerability researcher at CMU CERT . Coordination Center

Analiza malware Keylogger iSPY - CERT Orange …Analiza Malware Keylogger iSPY Autor Iwo Graj CERT Orange Polska Wirusa można następnie znaleźć w dwóch lokalizacjach systemu operacyjnego

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

관리자를위한악성프로그램(Malware) 분석방법 · 2005-04-04 · KrCERT-TR-2004-002 관리자를위한악성프로그램 분석방법(Malware) [email protected]/(02)405-5091~4

 · cert cert cert cert cert cert cert cert cert cert cert last berge-son ... blasius bode brown brownell carson chilson dunn duvall fallis eiseman felicia heinrich hope juhnke kenny

Malware Trend Report H2 2017 - Nexxy Technologies · The OIC-CERT Malware Trend Report H2-2017 is the 3rd of its kind covering malware trends for the 2nd half of ... multiple ways

Experiences with Building, Deploying and Running a remote- …€¦ · Page 4 Corporate Technology / CT IC CERT Data Sources for Network-based Malware

Visiting the snake nest - RECON.CX · 2019. 3. 5. · Visiting the snake nest Recon Brussels 2018 Jean-Ian Boutin | Senior Malware Researcher Matthieu Faou | Malware Researcher. Jean-Ian

Graph, Entropy and Grid Computing: Automatic Comparison … · Graph, Entropy and Grid Computing: Automatic Comparison of Malware Ismael Briones Aitor Gomez PandaLabs Malware Researcher

Mobile security, forensics & malware analysis with Santoku ... · mobile security & forensics researcher. He has several patents pending and presents on mobile security topics to

MALWARE TREND REPORT - OIC-CERT

The PlugX malware revisited: introducing “Smoaler” · PDF fileThe PlugX malware revisited: introducing “Smoaler” By Gabor Szappanos, Principal Researcher, SophosLabs July 2013

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

Detect Man-in-the-Middle Attacks Certificate Measurements ...Sweesh, AtomPark: spam IopFailZeroAcccessCreate: malware Typically add a root cert to avoid browser warnings. Negligent

Measuring Operational ResilienceMeasuring Operational Resilience Julia Allen CERT Allen is a principal researcher within the CERT Program at the SEI. Allen's areas of interest include

Taller Plataforma Avanzada Malware · Taller Plataforma Avanzada Malware (MISP-MARTA-MARIA) VIII JORNADAS STIC CCN-CERT 2 Innotec System Fernando Muñoz [email protected]

Lecture 6 - tailcall file$whoami Jarosław Jedynak - CERT Polska / p4 ctf - Malware researcher - Dawniej programista - Dekryptory do ransomware, łamanie krypto innych ludzi, testy

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Backoff: New Point of Sale Malware - US-CERT · 2017-09-04 · to deploy the point-of-sale (PoS) malware and subsequently exfiltrate consumer payment data via an encrypted POST request

NET MALWARE THREAT: INTERNALS AND REVERSING … CON 27/DEF CON 27 presentations/DEFCON-27... · ALEXANDRE BORGES – MALWARE AND SECURITY RESEARCHER DEF CON USA 2019 5 9Motivationsto

Andrei Costin and Jonas Zaddach Framework and Case Studies ... · Jonas Zaddach Malware researcher at Talos Working on IoT malware analysis and analysis automation. Agenda Introduction

CERT 2009 Research Report - Carnegie Mellon …...2009 Research Report Abstracts Applying Function Extraction (FX) Techniques to Reverse Engineer Virtual Machines Malware that has

Marta Janus Malware Researcher A tale of encounters with novel evasive malware

The dark side of the ForSSHe - Botconf 2019 · The dark side of the ForSSHe A journey into Linux malware abusing OpenSSH Hugo Porcher, Malware Researcher, ESET Romain Dumont, Malware

Les attaques APT Advanced Persistent Threats - cert-ist.com · forcément “évolués” techniquement (phishing, malware, XSS, etc.). Des outils de génération de composants d’attaques

Malware wellbeing on iOS - dsec.ru · PDF fileMalware wellbeing on iOS devices © 2002—2016, Digital Security #whoami • Information security researcher at Digital Security •

CERT 100 CERT 101 - Plaques and SuchCERT 100 CERT 101 CERT 105 CERT 102 CERT 103 CERT 104. CERT 106 CERT 111 CERT 108 CERT 109 CERT 107 CERT 110. CERT 114 CERT 112 CERT 113 CERT 115

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

PERIODE JULI - SEPTEMBER 2014 - ID-CERT 3 Laporan Kegiatan Pada bab ini kami laporkan hasil kegiatan survey malware ID-CERT sampai bulan September 2014. Kegiatan survey malware telah

Cryptocurrency scams on Android · ESET Research Whitepapers // February 2018 Cryptocurrency scams on Android Lukáš Štefanko // ESET Malware Researcher

Fighting Stealth Malware – Towards Verifiable OSes · Fighting Stealth Malware – Towards Verifiable OSes Joanna Rutkowska Advanced Malware Labs 14th DFN-CERT Security Workshop