SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin...

24
SafeMachine malware needs love, too Martin Hron, Jakub Jermář AVAST Software, research

Transcript of SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin...

Page 1: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

SafeMachinemalware needs love, too

Martin Hron, Jakub Jermář

AVAST Software, research

Page 2: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Dynamic malware detection

Dynamic:dy·nam·ic adjective \dī-ˈna-mik\: changing; active; in motion

In a context of the digital “pest”: safely run it and watch what’s going inside

Tools for dynamic malware detection widely use binary instrumentation to be able to observe guest behavior on instruction level.

They may use some kind of sandboxing or virtualization to isolate the running guest.

Page 3: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

DYNAMIC BINARY TRANSLATOR - “HOST”

Binary translation (instrumentation)machine code decomposition to “basic blocks” on the fly

entry point (EP)

JMP ADDR

….….…

dis

asse

mb

ler

tra

nsl

atio

n

inst

rum

enta

tio

n

Basic Block

exit to dispatcher

basic block @ EP

basic block @ ADDR

machine codebasic blocks cache

dispatcher

cache hit

cach

e m

iss

con

tin

ue

@ A

DD

R

start on EP (hook)

execute

ADDR

JMP EP

….….…

con

tin

ue

@ E

P

metadata

PROCESS BOUNDARY

ORIGINAL CODE -“GUEST”

Page 4: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Existing GENERAL purpose frameworks

Pin - A Dynamic Binary Instrumentation Tooldeveloped and maintained by Intel®. Closed source.

Pin 2.14 User Guide:

“The following Pin switches are supported:

-smc_strict [0][1] Enable (1) or disable (0) support for SMC inside basic

blocks. By default (0), pin assumes that basic blocksdo not modify their own code.”

Page 5: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Existing GENERAL purpose frameworks

DynamoRIO - Dynamic Instrumentation Tool Platformcreated at MIT and HP in 2001. Open-sourced in February 2009

2001: Bruening, D., Duesterwald, E., Amarasinghe, S.: Design and Implementation of a Dynamic Optimization Framework for Windows

“We expected to have problems both with exception contexts and with

self-modifying code, but neither have occurred in any of the large Windows programs we have been running.”

Page 6: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Existing GENERAL purpose frameworks

DynamoRIO - Dynamic Instrumentation Tool Platformcreated at MIT and HP in 2001. Open-sourced in February 2009

2005: Bruening, D., Amarasinghe, S.: Maintaining Consistency and Bounding Capacity of Software Code Caches

“While true self-modifying code is only seen in a few applications, such as Adobe Premiere and games like Doom, general code modification is

surprisingly prevalent.”

Page 7: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Existing special purpose frameworks

?

Page 8: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Existing special purpose frameworks

SafeMachine – Dynamic binary malware introspectionDeveloped by AVAST Software. Currently closed source.

“The general purpose frameworks can handle*even the most complex instances of self-modifying code**.

But there is more, much more***.”

* Eventually and when pushed

** SMC on stack

*** And very little is actually needed to exploit it

Page 9: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Framework comparison

95.89%

98.06%

74.54%

94.20%

84.17%

90.51%

70.00%

75.00%

80.00%

85.00%

90.00%

95.00%

100.00%

Pin 2.12 / DynamoRIO 4.0.0 Pin 2.14 / DynamoRIO 5.0.0

Hu

nd

red

s

Pin SafeMachine DynamoRIO

Page 10: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Exploitable areas

Block cache vs. virtual memory statecorrect invalidation of block cache on page protection state transitions

Program counter virtualization vs. CPU instructionssome CPU instructions leak the actual program counter

Inherent weakness of the write-protecting approach to SMC

And many morewrong syscall arguments, debug registers, segmentation, single-stepping, 0x66 & 0x67, …

Page 11: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Block cache problem

Self-modifying code stresses block cache consistency wrt. virtual memory contents.

How about code that stresses block cache consistency wrt. virtual memory state?

BLOCK 1

BLOCK 3

Block cache

BLOCK 2

BLOCK 4

Virtual memory

PAGE 11

PAGE 10

PAGE 9

PAGE 8

PAGE 7

PAGE 6

PAGE 5

PAGE 4

PAGE 3

PAGE 2

PAGE 1

PAGE 0 PAGE_READWRITEPAGE_GUARD

PAGE_EXECUTE_READ

fg

PAGE_EXECUTE_READWRITE

PAGE_READWRITE

PAGE_EXECUTE_READWRITEPAGE_GUARD

PAGE_EXECUTE_READPAGE_GUARD

PAGE_READONLY

PAGE_READONLYPAGE_GUARD

PAGE_NOACCESS

Page 12: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Demo: ExecuteUnmap1.exe

Idea:

Test if the change of page protection to NOACCESS removes the block from the cache

DEMO

Result:

Both Pin and DR fail the test

Discovery:

Pin behaves differently if the page protection goes from EXECUTE_READWRITE directly to NOACCESS

VirtualProtect(start, 2, PAGE_EXECUTE_READ);

/* First round: create the basic block */

_asm call start

VirtualProtect(start, 2, PAGE_NOACCESS);

/* Second round: the block should no longer be there */

__try {

_asm call start

/* FAILED */

}

__except(EXCEPTION_EXECUTE_HANDLER) {

/* PASSED */

}

start: nop

ret

PAGE 1:

rundemo.bat
rundemo.bat
Page 13: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Demo: TransientException1.exe

Idea:Test if SMC handling preserves the guard page associated with the second page of the block.

DEMO

Result:Pin fails the test.DR crashes.

Discovery:Both Pin and DR cannot deal with the PAGE_GUARD protection for some combinations of other protections.

VirtualProtect(pb, 1, PAGE_EXECUTE_READWRITE|PAGE_GUARD);

__try {

_asm call start

/* FAILED */

}

__except(EXCEPTION_EXECUTE_HANDLER) {

if (GetExceptionCode() == EXCEPTION_GUARD_PAGE)

/* PASSED */

else

/* FAILED */

}

…

start:

mov byte ptr [pb - 1], 0x90

nop

PAGE 1:

pb:

nop

ret

…

PAGE 2:

rundemo.bat
rundemo.bat
Page 14: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Demo: TransientException2.exe

Idea:

Test if the first of two overlapping blocks to hit a guard page consumes it.

DEMO

Result:

Both Pin and DR fail the test.

Discovery:

Both Pin and DR cannot deal with the PAGE_GUARD protection for some combinations of other protections.

VirtualProtect(pb, 1, PAGE_EXECUTE_READWRITE|PAGE_GUARD);

__try {

_asm call start

/* FAILED */

} __except(EXCEPTION_EXECUTE_HANDLER) {

if (GetExceptionCode() != EXCEPTION_GUARD_PAGE)

/* FAILED */

}

__try {

_asm call start

/* PASSED */

} __except(EXCEPTION_EXECUTE_HANDLER) {

/* FAILED */

}

…

start:

cmp cnt, 0

jz pb

PAGE 1:

pb:

inc cnt

ret

…

PAGE 2:

rundemo.bat
rundemo.bat
Page 15: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Virtual memory state transitions (DynamoRIO 5.0.0)

PAGE_EXECUTE_READ

fg

PAGE_EXECUTE_READWRITE

PAGE_READWRITE

PAGE_EXECUTE_READWRITEPAGE_GUARD

PAGE_EXECUTE_READPAGE_GUARD

PAGE_READONLY

PAGE_READONLYPAGE_GUARD

PAGE_READWRITEPAGE_GUARD

PAGE_NOACCESS

Page 16: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Virtual memory state transitions (Pin 2.14)

PAGE_EXECUTE_READ

fg

PAGE_EXECUTE_READWRITE

PAGE_READWRITE

PAGE_EXECUTE_READWRITEPAGE_GUARD

PAGE_EXECUTE_READPAGE_GUARD

PAGE_READONLY

PAGE_READONLYPAGE_GUARD

PAGE_READWRITEPAGE_GUARD

PAGE_NOACCESS

Page 17: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Program counter virtualization problem

Binary translated guest code runs from a different addressGuest EIP different from block EIP

Some CPU instructions leak the program counterFNXSAVE, FNSAVE, FNSTENV

010A1003 fsin 006ED3F1 fsin006ED3F3 mov dword ptr ds:[0B1F5Ch],10A1003h

Page 18: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Demo: FPUContext1.exe

Idea:

Test if the EIP of the last FPU instruction is correctly virtualized.

DEMO

Result:

Pin fails the test, DR passes.

start:fsinfnstenv fpu_save_arealea eax, startcmp eax, dword ptr fpu_save_area[3 * 4]jnz FAILEDjmp PASSED

rundemo.bat
rundemo.bat
Page 19: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Demo: FPUContext2.exe

Idea:

Test if the IP of the last FPU instruction is correctly virtualized.

DEMO

Result:

Both Pin and DR fail the test.

start:fsin_emit OPERAND_SIZE_PREFIXfnstenv fpu_save_arealea eax, startcmp ax, word ptr fpu_save_area[3 * 2]jnz FAILEDjmp PASSED

rundemo.bat
rundemo.bat
Page 20: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Unused stack

Inherent weakness in write-protecting

If SMC is detected by write-protecting…

…then each SMC generates a service exception…

…which smashes a part of the unused (guest) stack

Used stack

Stack pointer

Page 21: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Demo: ServiceException1.exe

Idea:

Test if a pattern left on the stack is still there after SMC.

DEMO

Result:

DR and Sf(write-protect) fail the test.

Pin and Sf(memory-check) pass the test.

Observation:

To pass, the tool must either use memory checks or virtualize guest stack.

push 0xdeadbeefpush 0xbadcafe1pop ecxpop eaxmov byte ptr smc, 0x90

smc:_emit 0xcccmp dword ptr [esp - 4], eaxjnz FAILEDcmp dword ptr [esp - 8], ecxjnz FAILEDjmp PASSED

rundemo.bat
rundemo.bat
Page 22: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Conclusion

General purpose DBI frameworks made to work well with normal applications

SMC handling an after-thought (done well)

Many other corner cases not handled at all

Dealing with malware requires a DBI framework with a “malware mindset”

Page 23: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Conclusion

And it definitelly rewards you back

Because malware needs love, too

Page 24: SafeMachine malware needs love, too - Virus Bulletin · SafeMachine malware needs love, too Martin Hron, ... JMP ADDR …. …. ... DEMO Result: Both Pin and DR fail the test

Thank you

It’s Q&A time!

Presented and additional samples can be downloaded:

https://github.com/sf2team/vb2014

Jakub Jermář:

E-mail: [email protected]

Twitter: @jjermar

Martin Hron:

E-mail: [email protected]

Twitter: @thinkcz


Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Compositional Data Analysis - TU Wien · 2014. 3. 5. · compositional data analysis K. Hr uzov a and K. Hron: Compositional analysis of stock exchange data M. Jel nkov a, K. Hron,

Compositional Data Analysis - TU Wien · 2014. 3. 5. · compositional data analysis K. Hr uzov a and K. Hron: Compositional analysis of stock exchange data M. Jel nkov a, K. Hron,

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

MALWARE IN EDUCATION: TOP 5 CHALLENGES · One successful malware event is one too many. This guide details the top five challenges education institutions face in fighting malware

MALWARE IN EDUCATION: TOP 5 CHALLENGES · One successful malware event is one too many. This guide details the top five challenges education institutions face in fighting malware

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox .

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox .

HACKERS, CRACKERS, BOTS, MALWARE AND WEB 2 · HACKERS, CRACKERS, BOTS, MALWARE AND WEB 2.0 DATA SECURITY CHALLENGES IN THE ALL TOO PUBLIC AND NOT SO PRIVATE SECTORS Patrick Gray Principal

HACKERS, CRACKERS, BOTS, MALWARE AND WEB 2 · HACKERS, CRACKERS, BOTS, MALWARE AND WEB 2.0 DATA SECURITY CHALLENGES IN THE ALL TOO PUBLIC AND NOT SO PRIVATE SECTORS Patrick Gray Principal

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

T HE T O UNTY C;HRON GLEnewspapers.rawson.lib.mi.us/chronicle/tcc1903b (E)/issues...T HE T O UNTY C;HRON GLE O VOL. 8- CASS CITY, MICH., FRIDAY, NOV. 27, [9o3. NO. 28. i <

T HE T O UNTY C;HRON GLEnewspapers.rawson.lib.mi.us/chronicle/tcc1903b (E)/issues...T HE T O UNTY C;HRON GLE O VOL. 8- CASS CITY, MICH., FRIDAY, NOV. 27, [9o3. NO. 28. i <

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

USING ASYMPTOTIC RAY THEORY BY F. HRON AND E. R. … · SYNTHETIC SEISMOGRAMS FOR DEEP SEISMIC SOUNDING STUDIES USING ASYMPTOTIC RAY THEORY BY F. HRON AND E. R. KA~ASEWlCH* ABSTRACT

USING ASYMPTOTIC RAY THEORY BY F. HRON AND E. R. … · SYNTHETIC SEISMOGRAMS FOR DEEP SEISMIC SOUNDING STUDIES USING ASYMPTOTIC RAY THEORY BY F. HRON AND E. R. KA~ASEWlCH* ABSTRACT

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Metamorphic Malware 1 Metamorphic Malware Research.

Metamorphic Malware 1 Metamorphic Malware Research.

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network.

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

M. Hron ETFP workshop Kraków 11/09/2006 Presented by M Hron J Stockel, J Brotankova, I Duran, J Adamek, M Stepan, O Bilykova M Spolaore, E Martines, P.

M. Hron ETFP workshop Kraków 11/09/2006 Presented by M Hron J Stockel, J Brotankova, I Duran, J Adamek, M Stepan, O Bilykova M Spolaore, E Martines, P.

Akut Egzacerb Hron Si

Akut Egzacerb Hron Si

Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior