One FlAw over the Cuckoos Nest on , Ricardo J. Rodr guez I naki - - PowerPoint PPT Presentation

▶
one flaw over the cuckoo s nest
SMART_READER_LITE
LIVE PREVIEW

One FlAw over the Cuckoos Nest on , Ricardo J. Rodr guez I naki - - PowerPoint PPT Presentation

May 30, 2023 108 likes •831 views

One FlAw over the Cuckoos Nest on , Ricardo J. Rodr guez I naki Rodr guez-Gast All wrongs reversed inaki@sensepost.com, rjrodriguez@fi.upm.es @virtualminds es @RicardoJRdez SensePost Universidad Polit

slide-1
SLIDE 1

One FlAw over the Cuckoo’s Nest

I˜ naki Rodr´ ıguez-Gast´

  • n†, Ricardo J. Rodr´

ıguez‡

All wrongs reversed

inaki@sensepost.com, rjrodriguez@fi.upm.es

@virtualminds es ※ @RicardoJRdez

†SensePost ‡Universidad Polit´

ecnica de Madrid London, UK Madrid, Spain

1 de Noviembre, 2013 No cON Name 2013 Barcelona (Espa˜ na)

slide-2
SLIDE 2

$whoarewe

$whoarewe: command not found

CLS member (2001) Ph.D. by UZ (2013) Working for UPM Trainee @ NcN, RootedCON, HIP Speaker @ NcN, HackLU, RootedCON, STIC CCN, HIP CISSP, CEH, GWAPT Security analyst @ SensePost Malware lover mlw.re staff Trainee @ 44CON . . .

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 2 / 39

slide-3
SLIDE 3

Agenda

Outline

1

Motivation

2

Previous Concepts Cuckoo Sandbox Dynamic Binary Instrumentation: The Pin Framework

3

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection Sandboxing detection

4

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs Introducing PinVMShield

5

Case Study: the pafish tool

6

Related Work

7

Conclusions and Future Work

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 3 / 39

slide-4
SLIDE 4

Motivation

Outline

1

Motivation

2

Previous Concepts Cuckoo Sandbox Dynamic Binary Instrumentation: The Pin Framework

3

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection Sandboxing detection

4

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs Introducing PinVMShield

5

Case Study: the pafish tool

6

Related Work

7

Conclusions and Future Work

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 4 / 39

slide-5
SLIDE 5

Motivation

Motivation (I)

Malware are increasing in number and complexity Targeted attacks also grown (specially industry and government espionage)

How do we currently fight against malware?

Firstly, to understand how a sample works (what is it doing?) Then, to figure out how it can be removed Lastly, to avoid future infections (can we detect it again?)

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 5 / 39

slide-6
SLIDE 6

Motivation

Motivation (II)

Figuring out what it is doing. . .

Manual analysis

Intensive Time-consuming

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 6 / 39

slide-7
SLIDE 7

Motivation

Motivation (II)

Figuring out what it is doing. . .

Manual analysis

Intensive Time-consuming Good if you are paid per working hour ¨ ⌣

Automatic analysis

Just take a seat, and relax. . . Real problem here: automation of malware analysis tasks

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 6 / 39

slide-8
SLIDE 8

Motivation

Motivation (II)

Figuring out what it is doing. . .

Manual analysis

Intensive Time-consuming Good if you are paid per working hour ¨ ⌣

Automatic analysis

Just take a seat, and relax. . . Real problem here: automation of malware analysis tasks Only manual analysis for weird (or interesting) samples

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 6 / 39

slide-9
SLIDE 9

Motivation

Motivation (III)

Sandbox Environments

Computer resources are tightly controlled and monitored Current trending of malware analysis Commercial and free-license solutions

Sandboxie JoeBox CWSandbox Cuckoo Sandbox PyBox

Virtual Machine and Sandbox: a good combination

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 7 / 39

slide-10
SLIDE 10

Motivation

Motivation (III)

Sandbox Environments

Computer resources are tightly controlled and monitored Current trending of malware analysis Commercial and free-license solutions

Sandboxie JoeBox CWSandbox Cuckoo Sandbox PyBox

Virtual Machine and Sandbox: a good combination

Do malware samples detect VMs/sandbox environments?

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 7 / 39

slide-11
SLIDE 11

Motivation

Motivation (III)

Sandbox Environments

Computer resources are tightly controlled and monitored Current trending of malware analysis Commercial and free-license solutions

Sandboxie JoeBox CWSandbox Cuckoo Sandbox PyBox

Virtual Machine and Sandbox: a good combination

Do malware samples detect VMs/sandbox environments?

Yes, they do.

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 7 / 39

slide-12
SLIDE 12

Motivation

Motivation (IV)

Can we avoid the detection of a VMs/sandbox environment?

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 8 / 39

slide-13
SLIDE 13

Motivation

Motivation (IV)

Can we avoid the detection of a VMs/sandbox environment?

Yes, we can! (at least, we should try. . . )

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 8 / 39

slide-14
SLIDE 14

Motivation

Motivation (IV)

Can we avoid the detection of a VMs/sandbox environment?

Yes, we can! (at least, we should try. . . )

We’re gonna do it in a fancy way. . .

using Dynamic Binary Instrumentation ¨

⌣

Dynamic Binary Instrumentation (DBI)

Analyse the runtime behaviour of a binary Executes arbitrary code during normal execution of a binary

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 8 / 39

slide-15
SLIDE 15

Motivation

Motivation (V)

Why DBI? Its advantages

Binary instrumentation: advantages

Programming language (totally) independent Machine-mode vision We can instrument proprietary software

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 9 / 39

slide-16
SLIDE 16

Motivation

Motivation (V)

Why DBI? Its advantages

Binary instrumentation: advantages

Programming language (totally) independent Machine-mode vision We can instrument proprietary software

Dynamic Instrumentation: advantages

No need to recompile/relink each time Allow to find on-the-fly code Dynamically generated code Allow to instrument a process in execution already (attach)

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 9 / 39

slide-17
SLIDE 17

Motivation

Motivation (VI)

Why DBI? Its disadvantages

Main disadvantages

Overhead (by the instrumentation during execution) ⇓ performance (analyst hopelessness!) Single execution path analysed

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 10 / 39

slide-18
SLIDE 18

Motivation

Motivation (VII)

Summary of contributions

Our goal in this work

Develop a Dynamic Binary Analysis (DBA) tool

Integrated with Cuckoo Sandbox

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 11 / 39

slide-19
SLIDE 19

Motivation

Motivation (VII)

Summary of contributions

Our goal in this work

Develop a Dynamic Binary Analysis (DBA) tool

Integrated with Cuckoo Sandbox Protects Cuckoo for being detected. . .

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 11 / 39

slide-20
SLIDE 20

Motivation

Motivation (VII)

Summary of contributions

Our goal in this work

Develop a Dynamic Binary Analysis (DBA) tool

Integrated with Cuckoo Sandbox Protects Cuckoo for being detected. . . . . . and also for (some) VMs detection

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 11 / 39

slide-21
SLIDE 21

Previous Concepts

Outline

1

Motivation

2

Previous Concepts Cuckoo Sandbox Dynamic Binary Instrumentation: The Pin Framework

3

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection Sandboxing detection

4

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs Introducing PinVMShield

5

Case Study: the pafish tool

6

Related Work

7

Conclusions and Future Work

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 12 / 39

slide-22
SLIDE 22

Previous Concepts Cuckoo Sandbox

Cuckoo Sandbox (I)

What is Cuckoo Sandbox?

Automated malware analysis tool Written in Python Reporting system (API calls, registry access, network activity) Extensible OpenSource

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 13 / 39

slide-23
SLIDE 23

Previous Concepts Cuckoo Sandbox

Cuckoo Sandbox (II)

Sample.exe (Suspended) cuckoo.py agent.py analyzer.py TCP socket (8000) Drop file submit.py web.py api.py packages (exe.py) Executes procces and injects cuckoomon.dll Sample.exe Cuckoomon.dll (Random name) \\.\PIPE\random string API call resultserver Results from the analysis

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 14 / 39

slide-24
SLIDE 24

Previous Concepts Dynamic Binary Instrumentation: The Pin Framework

Dynamic Binary Instrumentation: The Pin Framework (I)

http://www.pintools.org

What is Pin?

Framework designed by Intel Allows to build easy-to-use, portable, transparent and efficient instrumentation tools (DBA, or Pintools) Recall: instrumentation enables the execution of arbitrary code during run-time of a binary Extensive API for doing whatever you can imagine Used for things like:

Instruction profiling Performance evaluation Bug detection And malware analysis (here we are ¨ ⌣)

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 15 / 39

slide-25
SLIDE 25

Previous Concepts Dynamic Binary Instrumentation: The Pin Framework

Dynamic Binary Instrumentation: The Pin Framework (II)

How does Pin work?

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 16 / 39

slide-26
SLIDE 26

On the Anti-VMs & Anti-Sandboxing Techniques

Outline

1

Motivation

2

Previous Concepts Cuckoo Sandbox Dynamic Binary Instrumentation: The Pin Framework

3

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection Sandboxing detection

4

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs Introducing PinVMShield

5

Case Study: the pafish tool

6

Related Work

7

Conclusions and Future Work

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 17 / 39

slide-27
SLIDE 27

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (I)

How can an execution inside a VM be detected?

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 18 / 39

slide-28
SLIDE 28

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (I)

How can an execution inside a VM be detected?

Detection ways

Seek VME artifacts in processes, system files and/or registry

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 18 / 39

slide-29
SLIDE 29

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (I)

How can an execution inside a VM be detected?

Detection ways

Seek VME artifacts in processes, system files and/or registry Seek VME artifacts in memory

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 18 / 39

slide-30
SLIDE 30

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (I)

How can an execution inside a VM be detected?

Detection ways

Seek VME artifacts in processes, system files and/or registry Seek VME artifacts in memory Seek specific features of virtualised hardware

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 18 / 39

slide-31
SLIDE 31

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (I)

How can an execution inside a VM be detected?

Detection ways

Seek VME artifacts in processes, system files and/or registry Seek VME artifacts in memory Seek specific features of virtualised hardware Seek CPU instructions specific to VME

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 18 / 39

slide-32
SLIDE 32

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (II)

Artifacts in processes, system files and/or registry

Some examples

VMWare

“VMTools” service References in system files to “VMWare” and vmx References in the registry to “VMWare”

VirtualBox

VBoxService.exe process (“VirtualBoxGuestAdditions”) References in the registry to “VBox”

MS Virtual PC

vmsrvc.exe, vpcmap.exe, vmusrvc.exe processes References in the registry to “Virtual”

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 19 / 39

slide-33
SLIDE 33

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (III)

Artifacts in memory

The Red Pill

Software developed by Joanna Rutkwoska, 2004 Uses the SIDT instruction (Store Interrupt Descriptor Table)

VMWare: IDT in 0xFFxxxxxx VirtualPC: IDT in 0xE8xxxxxx In real machines: Windows (0x80FFFFFF), Linux (0xC0FFFFFF)

Other options: GDT, LDT

GDT, LDT also displaced in virtual environments Scoopy tool (http://www.trapkit.de)

(IDT == 0xC0) || IDT == 0x80 GDT == 0xC0 LDT == 0x00

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 20 / 39

slide-34
SLIDE 34

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (V)

Specific features of virtualised hardware

Specific virtualised hardware

Network controller USBs controller Host controller . . .

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 21 / 39

slide-35
SLIDE 35

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (V)

Specific features of virtualised hardware

Specific virtualised hardware

Network controller USBs controller Host controller . . .

Seek specific “fingerprints”

SCSI device type Network controller MAC Host controller type . . .

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 21 / 39

slide-36
SLIDE 36

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (V)

Specific features of virtualised hardware

Specific virtualised hardware

Network controller USBs controller Host controller . . .

Seek specific “fingerprints”

SCSI device type Network controller MAC Host controller type . . .

Doo tool (also seeks Class IDs in the registry)

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 21 / 39

slide-37
SLIDE 37

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (VI)

CPU instructions specific to VME

Some VMs add/use own instructions to communicate host/guest

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 22 / 39

slide-38
SLIDE 38

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (VI)

CPU instructions specific to VME

Some VMs add/use own instructions to communicate host/guest Seek host/guest communication channel

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 22 / 39

slide-39
SLIDE 39

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (VI)

CPU instructions specific to VME

Some VMs add/use own instructions to communicate host/guest Seek host/guest communication channel Jerry tool VMDetect tool

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 22 / 39

slide-40
SLIDE 40

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection

On the Anti-VMs & Anti-Sandboxing Techniques (VI)

CPU instructions specific to VME

Some VMs add/use own instructions to communicate host/guest Seek host/guest communication channel Jerry tool VMDetect tool Magic number. . . CONSTANT (WTF!) mov eax, 564D5868h ; “VMXh” mov ebx, 0 mov ecx, 0Ah mov edx, 5658 ; “VX” in eax, dx cmp ebx, 564D5868h

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 22 / 39

slide-41
SLIDE 41

On the Anti-VMs & Anti-Sandboxing Techniques Sandboxing detection

On the Anti-VMs & Anti-Sandboxing Techniques (VIII)

Sandbox

Binary execution in controlled environment Examples: Sandboxie, Norman Sandbox Analyser, Anubis, Cuckoo,

  • WinJail. . .

They have some common and recognisable issues:

DLLs loaded Read of ProductID key Windows username (API GetUserName) Window handle (API FindWindow)

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 23 / 39

slide-42
SLIDE 42

Mixing Cuckoo Sandbox and Pin DBI

Outline

1

Motivation

2

Previous Concepts Cuckoo Sandbox Dynamic Binary Instrumentation: The Pin Framework

3

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection Sandboxing detection

4

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs Introducing PinVMShield

5

Case Study: the pafish tool

6

Related Work

7

Conclusions and Future Work

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 24 / 39

slide-43
SLIDE 43

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs

Mixing Cuckoo Sandbox and Pin DBI (I)

Every file has a package Best place for the integration:

Attaching Pin to the suspended process Directly executing the sample with Pin

Pin and cuckoomon together

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 25 / 39

slide-44
SLIDE 44

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs

Mixing Cuckoo Sandbox and Pin DBI (II)

Attach to suspended process

agent.py analyzer.py Drop file packages (exe.py) Executes procces and injects cuckoomon.dll \\.\PIPE\random string API call PIN (Attach) Sample.exe PIN Cuckoomon.dll (Random name) Sample.exe (Suspended) Attach PIN to the sample

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 26 / 39

slide-45
SLIDE 45

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs

Mixing Cuckoo Sandbox and Pin DBI (III)

Pin integrated into a package

agent.py analyzer.py Drop file packages (exe.py) Executes procces and injects cuckoomon.dll \\.\PIPE\random string API call PIN (Suspended) Sample.exe Sample.exe PIN Cuckoomon.dll (Random name)

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 27 / 39

slide-46
SLIDE 46

Mixing Cuckoo Sandbox and Pin DBI Introducing PinVMShield

Mixing Cuckoo Sandbox and Pin DBI (IV)

Introducing PinVMShield (1)

main(argc : int, argv[] : char*) : int Fini(code : INT32, *v : void) : void <<Interface>> Pin Image(img : IMG, *v : void) PinVMShield #funcName[MAX_LENGTH_FUNCNAME] : char #isTryingT

  • DetectVMs(*s : char) : bool

#FindRTNByNameA(img : IMG) : RTN #FindRTNByNameW(img : IMG) : RTN #GetPrototypeFunctionA() : PROTO #GetPrototypeFunctionW() : PROTO #GetPrototypeFunction(*funcName : char) : PROTO #ReplaceFunctionSignature(rtn: RTN, proto: PROTO) : void PinWrapperWinAPI logFilename : char* = "file.out" logFile : FILE* stristr(*s1 : char, *s2 : char) : *char printMessage(*msg : char) : void common 0..* vWinAPIs

  • myGetModuleHandle(orig: AFUNPTR, lpModuleName: LPCTSTR, *ctx: CONTEXT): HMODULE

WrapperGetModuleHandle

  • myProcess32FirstAndNext(orig: AFUNPTR, hSnapshot: HANDLE, *ctx: CONTEXT, lppe: LPPROCESSENTRY32) : bool

WrapperProcess32FirstAndNext

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 28 / 39

slide-47
SLIDE 47

Mixing Cuckoo Sandbox and Pin DBI Introducing PinVMShield

Mixing Cuckoo Sandbox and Pin DBI (...): our Tool

Introducing PinVMShield (2)

APIs fooled

GetUserNameA/W GetUserNameExA/W RegQueryValueA/W RegQueryValueExA/W RegOpenKeyA/W RegOpenKeyExA/W GetModuleHandleA/W GetModuleHandleExA/W GetFileAttributesA/W Process32First / Process32Next FindWindowA/W FindWindowExA/W CreateFileA/W CreateNamedPipeA/W GetCursorPos

Alpha version available for download: (soon) https://bitbucket.org/rjrodriguez/pinvmshield/

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 29 / 39

slide-48
SLIDE 48

Case Study: the pafish tool

Outline

1

Motivation

2

Previous Concepts Cuckoo Sandbox Dynamic Binary Instrumentation: The Pin Framework

3

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection Sandboxing detection

4

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs Introducing PinVMShield

5

Case Study: the pafish tool

6

Related Work

7

Conclusions and Future Work

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 30 / 39

slide-49
SLIDE 49

Case Study: the pafish tool

Case Study: the pafish tool (I)

Tool that incorporates several detections for vms and sandboxing Developed by Alberto Ortega In v.0.2.5.1 (the one of case study):

Generic Sandbox Sandboxie QEMU Wine VirtualBox VMWare

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 31 / 39

slide-50
SLIDE 50

Case Study: the pafish tool

Case Study: the pafish tool (I)

Tool that incorporates several detections for vms and sandboxing Developed by Alberto Ortega In v.0.2.5.1 (the one of case study):

Generic Sandbox Sandboxie QEMU Wine VirtualBox VMWare

Do you wanna know more about the blue fish?

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 31 / 39

slide-51
SLIDE 51

Case Study: the pafish tool

Case Study: the pafish tool (I)

Tool that incorporates several detections for vms and sandboxing Developed by Alberto Ortega In v.0.2.5.1 (the one of case study):

Generic Sandbox Sandboxie QEMU Wine VirtualBox VMWare

Do you wanna know more about the blue fish? → attend Alberto’s session! (tomorrow afternoon)

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 31 / 39

slide-52
SLIDE 52

Case Study: the pafish tool

Case Study: the pafish tool (II)

It’s demo time!

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 32 / 39

slide-53
SLIDE 53

Related Work

Outline

1

Motivation

2

Previous Concepts Cuckoo Sandbox Dynamic Binary Instrumentation: The Pin Framework

3

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection Sandboxing detection

4

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs Introducing PinVMShield

5

Case Study: the pafish tool

6

Related Work

7

Conclusions and Future Work

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 33 / 39

slide-54
SLIDE 54

Related Work

Related Work (I)

CWSandox

Sandbox environment Three design criteria: automation, effectiveness and correctness Performs a dynamic analysis API hooking

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 34 / 39

slide-55
SLIDE 55

Related Work

Related Work (I)

CWSandox

Sandbox environment Three design criteria: automation, effectiveness and correctness Performs a dynamic analysis API hooking It is detected by sandbox detection techniques

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 34 / 39

slide-56
SLIDE 56

Related Work

Related Work (II)

Sandbox + DBI

Pin as DBI framework Own-created sandbox environment Two execution environments:

Testing: binary execution is traced. Traces are checked against some security policies Real: binary execution is monitored avoiding harmful behaviours

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 35 / 39

slide-57
SLIDE 57

Related Work

Related Work (II)

Sandbox + DBI

Pin as DBI framework Own-created sandbox environment Two execution environments:

Testing: binary execution is traced. Traces are checked against some security policies Real: binary execution is monitored avoiding harmful behaviours

Our solution also monitors the execution but. . .

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 35 / 39

slide-58
SLIDE 58

Related Work

Related Work (II)

Sandbox + DBI

Pin as DBI framework Own-created sandbox environment Two execution environments:

Testing: binary execution is traced. Traces are checked against some security policies Real: binary execution is monitored avoiding harmful behaviours

Our solution also monitors the execution but. . .

besides avoids sandbox detection!

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 35 / 39

slide-59
SLIDE 59

Conclusions and Future Work

Outline

1

Motivation

2

Previous Concepts Cuckoo Sandbox Dynamic Binary Instrumentation: The Pin Framework

3

On the Anti-VMs & Anti-Sandboxing Techniques VM Detection Sandboxing detection

4

Mixing Cuckoo Sandbox and Pin DBI Sticking both Programs Introducing PinVMShield

5

Case Study: the pafish tool

6

Related Work

7

Conclusions and Future Work

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 36 / 39

slide-60
SLIDE 60

Conclusions and Future Work

Conclusions and Future Work (I)

PinVMShield

Integrated with Cuckoo Sandbox

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 37 / 39

slide-61
SLIDE 61

Conclusions and Future Work

Conclusions and Future Work (I)

PinVMShield

Integrated with Cuckoo Sandbox Avoids Cuckoo (and other) detections commonly realised by malware

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 37 / 39

slide-62
SLIDE 62

Conclusions and Future Work

Conclusions and Future Work (I)

PinVMShield

Integrated with Cuckoo Sandbox Avoids Cuckoo (and other) detections commonly realised by malware Not currently detected! ¨ ⌣

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 37 / 39

slide-63
SLIDE 63

Conclusions and Future Work

Conclusions and Future Work (I)

PinVMShield

Integrated with Cuckoo Sandbox Avoids Cuckoo (and other) detections commonly realised by malware Not currently detected! ¨ ⌣ X Main drawback: runtime

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 37 / 39

slide-64
SLIDE 64

Conclusions and Future Work

Conclusions and Future Work (I)

PinVMShield

Integrated with Cuckoo Sandbox Avoids Cuckoo (and other) detections commonly realised by malware Not currently detected! ¨ ⌣ X Main drawback: runtime X Coding C++ is like a pain in the ass

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 37 / 39

slide-65
SLIDE 65

Conclusions and Future Work

Conclusions and Future Work (I)

PinVMShield

Integrated with Cuckoo Sandbox Avoids Cuckoo (and other) detections commonly realised by malware Not currently detected! ¨ ⌣ X Main drawback: runtime X Coding C++ is like a pain in the ass

We do have more control on malware (binary) execution

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 37 / 39

slide-66
SLIDE 66

Conclusions and Future Work

Conclusions and Future Work (II)

Future Work

Find a logo Stand-alone app Improve anti-detection techniques (not only hooking. . . )

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 38 / 39

slide-67
SLIDE 67

Conclusions and Future Work

Conclusions and Future Work (II)

Future Work

Find a logo Stand-alone app Improve anti-detection techniques (not only hooking. . . ) Replace (totally) cuckoomon.dll

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 38 / 39

slide-68
SLIDE 68

Conclusions and Future Work

Conclusions and Future Work (II)

Future Work

Find a logo Stand-alone app Improve anti-detection techniques (not only hooking. . . ) Replace (totally) cuckoomon.dll Add anti-DBI techniques

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 38 / 39

slide-69
SLIDE 69

Conclusions and Future Work

Conclusions and Future Work (II)

Future Work

Find a logo Stand-alone app Improve anti-detection techniques (not only hooking. . . ) Replace (totally) cuckoomon.dll Add anti-DBI techniques Test in real malware samples

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 38 / 39

slide-70
SLIDE 70

Conclusions and Future Work

Conclusions and Future Work (II)

Future Work

Find a logo Stand-alone app Improve anti-detection techniques (not only hooking. . . ) Replace (totally) cuckoomon.dll Add anti-DBI techniques Test in real malware samples

Acknowledgments

Alberto Ortega (pafish) NcN staff

  • I. Rodr´

ıguez-Gast´

  • n, R.J. Rodr´

ıguez One FlAw over the Cuckoo’s Nest 1 Nov’13 38 / 39

slide-71
SLIDE 71

One FlAw over the Cuckoo’s Nest

I˜ naki Rodr´ ıguez-Gast´

  • n†, Ricardo J. Rodr´

ıguez‡

All wrongs reversed

inaki@sensepost.com, rjrodriguez@fi.upm.es

@virtualminds es ※ @RicardoJRdez

†SensePost ‡Universidad Polit´

ecnica de Madrid London, UK Madrid, Spain

1 de Noviembre, 2013 No cON Name 2013 Barcelona (Espa˜ na)