Main idea. Demonstrate how malware can increase its robustness against detection by taking advantage of the ubiquitous Graphics Processing Unit (GPU)

Transcription

1 -Assisted Malware Giorgos Vasiliadis Michalis Polychronakis Sotiris Ioannidis ICS-FORTH, Greece Columbia University, USA ICS-FORTH, Greece

2 Main idea Demonstrate how malware can increase its robustness against detection by taking advantage of the ubiquitous Graphics Processing Unit ()

3 Outline Introduction Proof-of-concept implementation Future attacks Conclusions

4 INTRODUCTION

5 Malware evasion Malware continually seek new methods for hiding their malicious activity, Packing Polymorphism as well as, hinder reverse engineering and code analysis Code obfuscation Anti-debugging tricks

6 Countermeasures Signature-based antivirus scanners Disk and memory scanning Static/dynamic code analysis PolyUnpack [15], OmniUnpack[11] System emulation Renovo[9] Unfortunately, malware defense and analysis mechanisms focus on IA-32 code

7 = Graphics Processing Unit Dominant co-processor in home personal computers The heart of graphics cards Traditionally, used for handling 3D graphics rendering Over the years, s have been constantly evolving

8 General-purpose Powerful computation unit General-purpose code execution Specialized APIs exposing several hardware features Fully cooperate with DMA over main memory Portable code No need to install any files No administrator privileges

9 Malware + =? Is it possible for a malware to exploit the rich functionality of modern s? Powered Malware [Reynaud 08]

10 This work Design and implementation of code armoring techniques based on code Self-unpacking Run-time polymorphism

11 SELF-UNPACKING

12 Basic design malware.exe code code code

13 Execution example (1/7) (1)

14 Execution example (2/7)

15 Execution example (3/7)

16 (4) Execution example (4/7) 4. invoke

17 (4) Execution example (5/7) 4. invoke 5. unpack malicious code

18 Execution example (5/7) 4. invoke 5. unpack malicious code

19 Execution example (6/7) (6) 4. invoke 5. unpack malicious code 6. return

20 Execution example (7/7) (7) (6) 4. invoke 5. unpack malicious code 6. return 7. exec malicious code

21 (4) Big Picture (7) (6) 4. invoke 5. unpack malicious code 6. return 7. exec malicious code

22 Self-unpacking: Strengths Exposes minimal x86 code footprint Current analysis and unpacking systems cannot handle code Cannot run on virtual-machines can use extremely complex encryption schemes

23 Self-unpacking: Weaknesses Malware code lies unencrypted in main memory after unpacking Can be detected by dumping the memory Can we do better?

24 RUN-TIME POLYMORPHISM

25 Execution example (1/19) (1)

26 Execution example (2/19)

27 Execution example (3/19)

28 Execution example (4/19) (4) 4. control

29 (5) Execution example (5/19) (4) 4. control 5. invoke

30 (5) Execution example (6/19) 4. control 5. invoke 6. unpack code segment

31 Execution example (6/19) 4. control 5. invoke 6. unpack code segment

32 Execution example (7/19) (7) 4. control 5. invoke 6. unpack code segment 7. return

33 Execution example (8/19) (8) (7) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code

34 (9) Execution example (9/19) (8) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke

35 (9) Execution example (10/19) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code

36 Execution example (10/19) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code

37 Execution example (11/19) (11) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

38 Execution example (12/19) (4) (11) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

39 (5) Execution example (13/19) (4) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

40 (5) Execution example (14/19) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

41 Execution example (14/19) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

42 Execution example (15/19) (7) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

43 Execution example (16/19) (8) (7) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

44 (9) Execution example (17/19) (8) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

45 (9) Execution example (18/19) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

46 Execution example (19/19) (11) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

47 (5) Big Picture (8) (11) 4. control 5. invoke 6. unpack code segment 7. return 8. exec malicious code 9. invoke 10. pack code 11. return

48 Run-time polymorphism: Strengths Only the parts of code needed at any given point are decrypted each time can use different randomly-generated encryption key every time Malware code mutates constantly Each encryption key is stored in device memory Not accessible from

49 FUTURE ATTACKS

50 Potential threats Offload computationally intensive operations e.g. password cracking Access framebuffer contents Harvest private data displayed on the user screen Display false, benign-looking information Migrate completely to the graphics card A malware that run solely on the environment

51 CONCLUSIONS

52 Summary We demonstrated how a malware can increase its robustness against detection using the Unpacking Run-time polymorphism Taking a step further, graphics cards may be a promising new environment for future malware Password cracking Framebuffer attacks and many more

53 -Assisted Malware Thank you! Giorgos Vasiliadis Michalis Polychronakis Sotiris Ioannidis

54 Publicity