Monirul Sharif 1 , Andrea Lanzi 2 , Jonathon Giffin 1 , Wenke Lee 1 1 Georgia Institute of Technology 2 Universit`a degli Studi di Milano NDSS 2008
Introduction Introduction We need to understand malware… Rootkits Keyloggers Viruses System-wide effects Malware Exploits Bots Worms Spyware Trojans Reverse engineering and Malware Analysis Propagation Control Capabilities Hundreds of new malware samples appear almost everyday… Malware Malware Malware Malware Malware Malware Malware Malware Malware Malware Malware Malware Automated analysis systems have become very important Obfuscations that are easily applicable on existing code can be a threat We present a Simple , Automated and Transparent Obfuscation against state-of-the-art malware analyzers NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 2
Malware Analysis and Obfuscations Malware Analysis and Obfuscations Defense Offense Polymorphism, metamorphism, Static Analysis based approaches packing, opaque predicates, anti-disassembly response Trigger-based behavior Dynamic malware analysis (Logic bombs, time bombs, anti-debugging, anti-emulation, etc.) response Dynamic multipath exploration ? (Moser et al. 2007) Bitscope (Brumley et al. 2007) Conditional Code Obfuscation EXE (Cadar et al. 2006) Forced execution (Wilhelm et al. 2007) NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 3
Rest of the Talk Rest of the Talk o Conditional Code Obfuscation o Principles o Static analysis based automation o Automatic applicability on existing malware without modification o Implications o Implications on Existing Analyzers o Measuring Obfuscation Strength o Prototype Implementation and Evaluation o Evaluation on malware o Weaknesses and Defense o How analysis can be improved to defender NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 4
Principles of Our Attack Principles of Our Attack Malware Binary Inputs Condition Condition Unknown Trigger-based ? behavior Any static and dynamic analysis approach Input Oblivious Analyzer NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 5
Principles of Our Attack Principles of Our Attack Malware Binary cmd = get_command(sock); if (strcmp(cmd, “logkeys”)==0)) { Condition LogKeys() Condition Condition Condition } Unknown Trigger-based Inputs behavior cmd = get_command(sock); if (Hash(cmd)== H)) { LogKeys() } NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 6
Principles of Our Attack Principles of Our Attack Malware Binary cmd = get_command(sock); if (strcmp(cmd, “logkeys”)==0)) { LogKeys() Condition Condition } Unknown Trigger-based Trigger-based Inputs behavior behavior ( K ) cmd = get_command(sock); if (strcmp(cmd, “logkeys”)==0)) { decrypt(encr_LogKeys, K ); encr_LogKeys() } The key is inside the encr_LogKeys(){ program } NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 7
Principles of Our Attack Principles of Our Attack Malware Binary cmd = get_command(sock); if (strcmp(cmd, “logkeys”)==0)) { LogKeys() Condition Condition Condition Condition } Unknown Trigger-based Trigger-based Inputs behavior behavior cmd = get_command(sock); if (Hash(cmd)== H)) { decrypt(encr_LogKeys, cmd); encr_LogKeys() } The key is no longer inside encr_LogKeys(){ the code } NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 8
General Obfuscation Mechanism General Obfuscation Mechanism Original Code Obfuscated Code Hash(c) if ( X == c ) { if ( Hash(X) == H c ) { Decr(B E , X) Encr(B, c) B B E } } o Candidate Conditions - Conditions with equality o Hash function Properties: o The usual ‘==‘ operator o Pre-image resistance – Protects against reversing o String equality checks – strcmp, memcmp, strncmp etc. Hard to find c given H c o Conditions with ‘>’, ‘<‘, ‘!=‘ will not work o Conditional Code o Second pre-image resistance - Program correctness o Any code that executes only when condition is satisfied Hard to find another c’ where Hash(c’) = H c NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 9
Automation Using Static Analysis Automation Using Static Analysis o Identify Candidate Conditions o Identify functions and create CFG for each function o Find blocks containing candidate conditions o Conditional code Identification o Intra-procedural - Basic blocks control dependen t on condition with true outcome o Inter-procedural - Set of all functions only reachable from selected basic blocks o Exclude functions reachable from default path o Conservative conditional code selection for function pointers NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 10
Automation Using Static Analysis Automation Using Static Analysis Handling Common Conditional Code if if P Q P Q K P K Q K P K Q B B P B Q Encr(B, K P ) Encr(B, K Q ) • Two keys are used in two paths. Duplicate code • If one path is not candidate condition, no use in concealing the trigger code NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 11
Automation Using Static Analysis Automation Using Static Analysis Handling Complex Conditions if ( X==a ) { if ( X==a && Y==b ) { if (Y==b ) { Attack() Attack() } } } Logical “and” if ( X==a ) if ( X==a || Y==b ) { Attack() Attack() } } else if (Y==b ) { Attack() } Logical “or” NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 12
Automation Using Static Analysis Automation Using Static Analysis Handling Complex Conditions switch (cmd) { if (cmd==0) attack1(); case 0: attack1(); if (cmd==1) { break; recon(); attack2(); case 1: } recon(); if (cmd==2) case 2: attack2(); attack2(); } Switch Case NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 13
Consequences to Existing Analyzers Consequences to Existing Analyzers • Multi-Path Exploration (Moser et al., Bitscope) o Constraints are built for each path o Hash functions are non-linear, so cannot find solution • Input Discovery (EXE) o Solves constraints to get inputs – symbolic execution o Same problem, cannot find derive input Hash(X)==H C Condition B Trigger-based behavior NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 14
Consequences to Existing Analyzers Consequences to Existing Analyzers • Forced Execution o Without solving constraints, forces execution o Without key, program crashes • Static Analysis o Same as packed code, static analysis on trigger code is not possible Hash(X)==H C Condition B Trigger-based behavior NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 15
Attacks on the Obfuscation Attacks on the Obfuscation o Attacks on Hash(X)=H c o Find possible X for satisfying the above o Input domain o Domain(X) – set of all possible values X may take o With time t for every hash computation, total time = Domain(X) t o For an integer I, Domain(I) = 2 32 o Brute Force attacks o Dictionary Attacks NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 16
Prototype Implementation Prototype Implementation • Overview o Implemented for Linux o Takes malware C source code and outputs obfuscated ELF binaries • Analysis Level – both source code and binary levels required o Source and IR level – type information is essential o Binary level – decrypted code must be executable DynInst LLVM .c .o .o Binary Compiler Analysis/ Framework Instrumentation Malware Final obfuscated ELF Binary Source (c/c++) ELF Binary (x86) Find candidate conditions Encrypt marked (x86) conditional code and keys. Blocks with keys Perform transformation. remove keys Simplified architectural view of the automated obfuscation system NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 17
Analysis and Transformation Phase Analysis and Transformation Phase • Candidate Code Replacement o Enc(X)/Dec(X) Encryption/Decryption – AES with 256 bit keys o Hash function – Hash(X) - SHA-256 o Different hash functions based on data type of X • Decryption Keys and Markers o Key generation – Key(X) = Hash(X|N), N is Nonce NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 18
Encryption Phase Encryption Phase • DynInst based binary transformation tool o Finds Decipher(), and End_marker() and key (K c ) o Encrypts binary code with key o Removes marker and key from code NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 19
Experimental Results Experimental Results • Evaluated by Obfuscating Malware Programs o Selected representative malware source programs for Linux with trigger based behavior • Evaluation Method o Manually identified malicious triggers in malware o Applied obfuscation, counted how many were completely obfuscated by the automated system o Considered three levels of obfuscation strength – Strong – strings Medium – integers Weak – booleans and return codes NDSS 2008 Impeding Malware Analysis Using Conditional Code Obfuscation 20
Impeding Malware Analysis Using Conditional Code Obfuscation 21 Experimental Results Experimental Results NDSS 2008
Recommend
More recommend
