Malware vs Virtualization The endless cat and mouse play

aurelien.wail.ly/publications/hip-2013-slides.html

Plan

• Malwares today
• Research environment
• Detection
• Reaction
• Roadmap

Virtualization

• Easy provisionning
• Rollback
• Consolidation
• Resource control
• Rarely used
• Often the sign of an analysis

Virtualization usages

Bright side

• Easy sandbox VMWare player
• No traces
• Debug kernels
• Try other OSes
•  
•  

Dark Side

• Intercept BluePilling see after
• Ultimate obfuscation

Malware

• Largely dissected Anubis, malwr, GFI
• Adaptable behavior
• Alex recommends VM Detection

On the bright side

Malwares may detect virtualized environments

• Adopt clean behavior
• Targeted attacks

On the bright side

Malwares may detect virtualized environments

• Adopt clean behavior
• Targeted attacks

On the dark side

Games may detect virtualized environments

• Cheat detection
• Protect against fake hardware

On the dark side

Games may detect virtualized environments

• Cheat detection
• Protect against fake hardware

Targeted escape

Sandbox environments have to

• Extract executable actions
• Communicate results

Demo Cuckoo

Demo Cuckoo