Malware vs Virtualization The endless cat and mouse play
aurelien.wail.ly/publications/hip-2013-slides.html
Plan
-
Malwares today
-
Research environment
-
Detection
-
Reaction
-
Roadmap
Virtualization
-
Easy provisionning
-
Rollback
-
Consolidation
-
Resource control
-
Rarely used
-
Often the sign of an analysis
Virtualization usages
Bright side
-
Easy sandbox VMWare player
-
No traces
-
Debug kernels
-
Try other OSes
-
-
Dark Side
-
Intercept BluePilling see after
-
Ultimate obfuscation
Mainly for testing purposes!
Malware
-
Largely dissected Anubis, malwr, GFI
-
Adaptable behavior
-
Alex recommends VM Detection
On the bright side
Malwares may detect virtualized environments
-
Adopt clean behavior
-
Targeted attacks
On the bright side
Malwares may detect virtualized environments
-
Adopt clean behavior
-
Targeted attacks
On the dark side
Games may detect virtualized environments
-
Cheat detection
-
Protect against fake hardware
On the dark side
Games may detect virtualized environments
-
Cheat detection
-
Protect against fake hardware
How to detect Virtualized environments ?
Is it easier to hide or to detect ?
Targeted escape
Sandbox environments have to
-
Extract executable actions
-
Communicate results
Demo Cuckoo
Demo Cuckoo