Reverse Engineering by Crayon: Game Changing Hypervisor and Visualization Analysis
|
|
|
- Albert Gaines
- 8 years ago
- Views:
Transcription
1 Reverse Engineering by Crayon: Game Changing Hypervisor and Visualization Analysis Game Changing Hypervisor Based Malware Analysis and Visualization Danny Quist Lorie Liebrock New Mexico Tech Computer Science Dept. Offensive Computing, LLC Blackhat/ Defcon USA 2009
2 Overview Reverse Engineering Process Hypervisors and You Xenand Ether Modifying the Process VERA Real! Live! Reversing! Results
3 Danny Quist Offensive Computing, LLC - Founder Ph.D. Candidate at New Mexico Tech Reverse Engineer Instructor
4 Lorie Liebrock Computer Science Department Chair, New Mexico Tech Associate Professor New Mexico Tech Scholarship for Service Principal Investigator
5 Overview Reverse Engineering Process Hypervisors and You Xenand Ether Modifying the Process VERA Real! Live! Reversing! Results
6 Process for Reverse Engineering Setup an isolated run-time environment Execution and initial analysis Deobfuscate compressed or packed code Disassembly / Code-level Analysis Identify and analyze relevant and interesting portions of the program
7 Isolated Analysis Environment Setup an Isolated Runtime Environment Virtual machines: VMWare, Xen, KVM, Need to protect yourself from malicious code Create a known-good baseline environment Quickly allows backtracking if something bad happens
8 Execution and Initial Analysis Goal: Quickly figure out what the program is doing without looking at assembly Look for: Changes to the file system Changes to the behavior of the system Network traffic Overall performance Ads or changed browser settings
9 Remove Software Armoring Program protections to prevent reverse engineering Done via packers Small encoder/decoder Self-modifying code Lots of research about this OllyBonE, Saffron, Polyunpack, Renovo, Ether, Azure My research uses Ether
10 Packing and Encryption Self-modifying code Small decoder stub Decompress the main executable Restore imports Play tricks with the executable OS Loader is inherently lazy (efficient) Hide the imports Obscure relocations Use bogus values for various unimportant fields
11 Software Armoring Compressed, obfuscated, hidden code Virtual machine detection Debugger detection Shifting decode frames
12 Normal PE File
13 Packed PE File
14 Troublesome Protections Virtual Machine Detection Redpill, ocvmdetect, Paul Ferrie s paper Debugger Detection IsDebuggerPresent() EFLAGS bitmask Timing Attacks Analyze value of RDTSC before and after Really effective
15 Thwarting Protections Two methods for circumvention 1. Know about all the protections before hand and disable them 2. Make yourself invisible
16 Virtual Machine Monitoring Soft VM Based systems Renovo Polyunpack Zynamics Bochs unpacker Problems Detection of virtual machines is easy Intel CPU never traditionally designed for virtualization Do not emulate x86 bug-for-bug
17 OS Integrated Monitoring Saffron, OllyBonE Page-fault handler based debugger Abuses the supervisor bit on memory pages High-level executions per page Problems Destabilizes the system Need dedicated hardware Fine-grain monitoring not possible
18 Fully Hardware Virtualizations Ether: A. Dinaburg, P. Royal Xen based hypervisor system Base functions for monitoring System calls Instruction traces Memory Writes All interactions done by memory page mapping Problems Old version of Xen hypervisor Requires dedicated hardware
19 Disassembly and Code Analysis Most nebulous portion of the process Largely depends on intuition Looking at assembly is tedious Suffers from not seeing the forest from the trees syndrome Analyst fatigue Level of attention required yields few results
20 Find Interesting and Relevant Portions of the Executable Like disassembly, this relies on a lot of intuition and experience Typical starting points: Look for interesting strings Look for API calls Examine the interaction with the OS This portion is fundamentally imprecise, tedious, and often frustrating for beginners and experts
21 Overview Reverse Engineering Process Hypervisors and You Xenand Ether Modifying the Process VERA Real! Live! Reversing! Results
22 Hypervisors Lots of hype over the past few years New hypervisor rootkits lead defensive tools Covert methods for analyzing runtime behavior are extremely useful Detection of hardware virtualization not widely implemented
23 Useful Hypervisor Technology VMWare ESX Server Commercial grade solution for VMs Avoids VM detection issues (mostly) Linux Kernel Virtual Machines (KVM) Separates analysis OS from target OS (slightly safer?) Uses well-tested Linux algorithms for analysis Xen Excellent set of tools for introspection Uses standard QEMU image formats API Controlled via Python Integration into tools is easier
24 Contributions Modifications to Ether Improve malware unpacking Enable advanced tracing mechanisms Automate much of the tedious portions Visualizing Execution for Reversing and Analysis (VERA) Speed up disassembly and finding interesting portions of an executable Faster identification of the Original Entry Point
25 Overview Reverse Engineering Process Hypervisors and You Xenand Ether Modifying the Process VERA Real! Live! Reversing! Results
26 What is Ether? Patches to the Xen Hypervisor Instruments a windows system Base modules available Instruction tracing API Tracing Unpacking Ether: Malware Analysis via Hardware Virtualization Extensions Dinaburg, Royal, Sharif, Lee ACM CCS 2008
27 Ether Event Tracing Detects events on an instrumented system System call execution Instruction execution Memory writes Context switches
28 Instruction Tracing EFLAGS register modified for single-step (trap flag) PUSHF and POPF instructions are intercepted Modifications to this single-stepping effectively hidden (except
29 Memory and System Calls Memory Writes Tracked by manipulating the shadow page table Gives access to the written and read memory addresses System Calls Modifies the SYSENTER_EIP register to point to non-paged address space Logged, returned to ether Overrides 0x2e interrupt to catch older syscalls
30 Ether System Architecture
31 Extensions to Ether Removed unpacking code from hypervisor into user-space Better user mode analysis PE Repair system Allows for disassembly of executables Added enhanced monitoring system for executables
32 User mode Unpacking Watch for and monitor all memory writes Allow program to execute When execution occurs in written memory, dump memory Each dump is a candidate for the OEP Not perfect, but very close Scaffolding for future modifications
33 PE Repair Dumped PE files had problems Sections were not file aligned Address of Entry Point invalid Would not load in IDA correctly Ported OllyDumpcode to Ether user mode Fix section offsets to match data on disk Repair resources as much as possible Set AddressOfEntryPoint to be the candidate OEP
34 Results Close to a truly covert analysis system Ether is nearly invisible Still subject to bluepill detections Fine-grain resolution of program execution Application memory monitoring and full analysis capabilities Dumps from Ether can now be loaded in IDA Pro without modification
35 Ether Unpacking Demo!
36 Open Problems Unpacking process produces lots of candidate dump files Better Original Entry Point discovery method Import rebuilding is still an issue Now that there is a nice tool for tracing programs covertly, we need to do analysis
37 Overview Reverse Engineering Process Hypervisors and You Xenand Ether Modifying the Process VERA Real! Live! Reversing! Results
38 Modifying the Process Knowing what to look for is often the portion that most new reversers have trouble with Having an idea of the execution flow of a program is extremely useful IDA is focused on the function view Extend to the basic block view Software armoring removal made easy
39 Visualization of Trace Data Goals: Quickly visually subvert software armoring Identify modules of the program Initialization Main loops End of unpacking code Figure out where the self-modifying code ends (OEP detection) Discover dynamic runtime program behavior Integrate with existing tools
40 Visualizing the OEP Problem Each block (vertex) represents a basic block executed in the user mode code Each line represents a transition The thicker the line, the more it was executed Colors represent areas of memory execution
41 VERA Visualization of Executables for Reversing and Analysis Windows MFC Application Integrates with IDA Pro Fast, small memory footprint
42 Visualizing Packers Memory regions marked for PE heuristics
43 Demo!
44 NetbullVirus (Not Packed)
45 NetbullZoomed View
46 Visualizing Packers Memory regions marked for PE heuristics
47 UPX
48 UPX -OEP
49 ASPack
50 FSG
51 MEW
52 TeLock
53 User Study Students had just completed week long reverse engineering course Analyzed two packed samples of the Netbull Virus with UPX and MEW Asked to perform a series of tasks based on the typical reverse engineering process Asked about efficacy of visualization tool
54 User Study: Tasks Performed Find the original entry point (OEP) of the packed samples Execute the program to look for any identifying output Identify portions of the executable: Packer code Initialization Main loops
55
56
57
58
59 Selected Comments Wonderful way to visualize analysis and to better focus on areas of interest Fantastic tool. This has the potential to significantly reduce analysis time. It rocks. Release ASAP.
60 Recommendations for improvement Need better way to identify beginning and end of loops Many loops overlap and become convoluted Be able to enter memory address and see basic blocks that match
61 Future Work General GUI / bug fixes Memory access visualization System call integration Function boundaries Interactivity with unpacking process Modify hypervisor to work with WinDBG, OllyDbg, IDA Debugger
62 Conclusions Visualizations make it easy to identify the OEP No statistical analysis of data needed Program phases readily identified Graphs are relatively simple Preliminary user study shows tool holds promise for speeding up reverse engineering
63 Thanks! Artem Dinaburg Paul Royal Cort Dougan Moses Schwartz Alan Erickson Alex Kent New Mexico Tech SFS Program
64 Closing thoughts Ether is awesome. Thanks Artem Dinaburg and Paul Royal. Source, tools, and latest slides can be found at: If you use the tool, please give feedback Look for the paper at Vizsec2009
Fine-grained covert debugging using hypervisors and analysis via visualization
Reverse Engineering by Crayon: Game Changing Hypervisor and Visualization Analysis Fine-grained covert debugging using hypervisors and analysis via visualization Daniel A. Quist Lorie M. Liebrock Offensive
for Malware Analysis Daniel Quist Lorie Liebrock New Mexico Tech Los Alamos National Laboratory
Visualizing Compiled Executables for Malware Analysis Daniel Quist Lorie Liebrock New Mexico Tech Los Alamos National Laboratory Overview Explanation of Problem Overview of Reverse Engineering Process
Visualizing Compiled Executables for Malware Analysis
Visualizing Compiled Executables for Malware Analysis Daniel A. Quist New Mexico Tech Los Alamos National Laboratory Lorie M. Liebrock New Mexico Tech ABSTRACT Reverse engineering compiled executables
Virtual machines and operating systems
V i r t u a l m a c h i n e s a n d o p e r a t i n g s y s t e m s Virtual machines and operating systems Krzysztof Lichota lichota@mimuw.edu.pl A g e n d a Virtual machines and operating systems interactions
Adi Hayon Tomer Teller
Adi Hayon Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory in a remote process (and write to it) Executes the code in that memory region Frees the code Memory dump
Virtualization. Explain how today s virtualization movement is actually a reinvention
Virtualization Learning Objectives Explain how today s virtualization movement is actually a reinvention of the past. Explain how virtualization works. Discuss the technical challenges to virtualization.
Virtualization. Types of Interfaces
Virtualization Virtualization: extend or replace an existing interface to mimic the behavior of another system. Introduced in 1970s: run legacy software on newer mainframe hardware Handle platform diversity
Compromise-as-a-Service
ERNW GmbH Carl-Bosch-Str. 4 D-69115 Heidelberg 3/31/14 Compromise-as-a-Service Our PleAZURE Felix Wilhelm & Matthias Luft {fwilhelm, mluft}@ernw.de ERNW GmbH Carl-Bosch-Str. 4 D-69115 Heidelberg Agenda
Virtualization System Vulnerability Discovery Framework. Speaker: Qinghao Tang Title:360 Marvel Team Leader
Virtualization System Vulnerability Discovery Framework Speaker: Qinghao Tang Title:360 Marvel Team Leader 1 360 Marvel Team Established in May 2015, the first professional could computing and virtualization
Attacking Obfuscated Code with IDA Pro. Chris Eagle
Attacking Obfuscated Code with IDA Pro Chris Eagle Outline Introduction Operation Demos Summary 2 First Order Of Business MOVE UP AND IN! There is plenty of room up front I can't increase the font size
FRONT FLYLEAF PAGE. This page has been intentionally left blank
FRONT FLYLEAF PAGE This page has been intentionally left blank Abstract The research performed under this publication will combine virtualization technology with current kernel debugging techniques to
KVM: A Hypervisor for All Seasons. Avi Kivity avi@qumranet.com
KVM: A Hypervisor for All Seasons Avi Kivity avi@qumranet.com November 2007 Virtualization Simulation of computer system in software Components Processor: register state, instructions, exceptions Memory
Virtualization Technologies
12 January 2010 Virtualization Technologies Alex Landau (lalex@il.ibm.com) IBM Haifa Research Lab What is virtualization? Virtualization is way to run multiple operating systems and user applications on
Full and Para Virtualization
Full and Para Virtualization Dr. Sanjay P. Ahuja, Ph.D. 2010-14 FIS Distinguished Professor of Computer Science School of Computing, UNF x86 Hardware Virtualization The x86 architecture offers four levels
Peeking into Pandora s Bochs. Instrumenting a Full System Emulator to Analyse Malicious Software
Instrumenting a Full System Emulator to Analyse Malicious Software Lutz Böhne (lutz.boehne@redteam-pentesting.de) RedTeam Pentesting GmbH http://www.redteam-pentesting.de April 9th 2010, Paris Hackito
Securing Your Cloud with Xen Project s Advanced Security Features
Securing Your Cloud with Xen Project s Advanced Security Features Russell Pavlicek, Xen Project Evangelist CloudOpen North America 2013 Who is the Old, Fat Geek Up Front? Xen Project Evangelist Employed
COS 318: Operating Systems. Virtual Machine Monitors
COS 318: Operating Systems Virtual Machine Monitors Kai Li and Andy Bavier Computer Science Department Princeton University http://www.cs.princeton.edu/courses/archive/fall13/cos318/ Introduction u Have
Hypervisor Support for Identifying Covertly Executing Binaries
Hypervisor Support for Identifying Covertly Executing Binaries Lionel Litty H. Andrés Lagar-Cavilla Dept. of Computer Science University of Toronto {llitty,andreslc}@cs.toronto.edu David Lie Dept. of Elec.
Detecting the Presence of Virtual Machines Using the Local Data Table
Detecting the Presence of Virtual Machines Using the Local Data Table Abstract Danny Quist {chamuco@gmail.com} Val Smith {mvalsmith@metasploit.com} Offensive Computing http://www.offensivecomputing.net/
Basics of Virtualisation
Basics of Virtualisation Volker Büge Institut für Experimentelle Kernphysik Universität Karlsruhe Die Kooperation von The x86 Architecture Why do we need virtualisation? x86 based operating systems are
PE Explorer. Heaventools. Malware Code Analysis Made Easy
Heaventools PE Explorer Data Sheet Malware Code Analysis Made Easy Reverse engineers within the anti-virus, vulnerability research and forensics companies face the challenge of analysing a large number
Virtual Machines. COMP 3361: Operating Systems I Winter 2015 http://www.cs.du.edu/3361
s COMP 3361: Operating Systems I Winter 2015 http://www.cs.du.edu/3361 1 Virtualization! Create illusion of multiple machines on the same physical hardware! Single computer hosts multiple virtual machines
Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor?
Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor? Mr. Jacob Torrey February 26, 2014 Dartmouth College 153 Brooks Road, Rome, NY 315.336.3306 http://ainfosec.com @JacobTorrey
Storm Worm & Botnet Analysis
Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing
Virtualization. Pradipta De pradipta.de@sunykorea.ac.kr
Virtualization Pradipta De pradipta.de@sunykorea.ac.kr Today s Topic Virtualization Basics System Virtualization Techniques CSE506: Ext Filesystem 2 Virtualization? A virtual machine (VM) is an emulation
A Hypervisor IPS based on Hardware assisted Virtualization Technology
A Hypervisor IPS based on Hardware assisted Virtualization Technology 1. Introduction Junichi Murakami (murakami@fourteenforty.jp) Fourteenforty Research Institute, Inc. Recently malware has become more
13.1 Backup virtual machines running on VMware ESXi / ESX Server
13 Backup / Restore VMware Virtual Machines Tomahawk Pro This chapter describes how to backup and restore virtual machines running on VMware ESX, ESXi Server or VMware Server 2.0. 13.1 Backup virtual machines
Hypervisors and Virtual Machines
Hypervisors and Virtual Machines Implementation Insights on the x86 Architecture DON REVELLE Don is a performance engineer and Linux systems/kernel programmer, specializing in high-volume UNIX, Web, virtualization,
System Structures. Services Interface Structure
System Structures Services Interface Structure Operating system services (1) Operating system services (2) Functions that are helpful to the user User interface Command line interpreter Batch interface
CERIAS Tech Report 2015-9 Basic Dynamic Processes Analysis of Malware in Hypervisors Type I & II by Ibrahim Waziri Jr, Sam Liles Center for Education
CERIAS Tech Report 2015-9 Basic Dynamic Processes Analysis of Malware in Hypervisors Type I & II by Ibrahim Waziri Jr, Sam Liles Center for Education and Research Information Assurance and Security Purdue
Virtualization Technologies (ENCS 691K Chapter 3)
Virtualization Technologies (ENCS 691K Chapter 3) Roch Glitho, PhD Associate Professor and Canada Research Chair My URL - http://users.encs.concordia.ca/~glitho/ The Key Technologies on Which Cloud Computing
Virtualization. Dr. Yingwu Zhu
Virtualization Dr. Yingwu Zhu What is virtualization? Virtualization allows one computer to do the job of multiple computers. Virtual environments let one computer host multiple operating systems at the
x86 ISA Modifications to support Virtual Machines
x86 ISA Modifications to support Virtual Machines Douglas Beal Ashish Kumar Gupta CSE 548 Project Outline of the talk Review of Virtual Machines What complicates Virtualization Technique for Virtualization
Denial-of-Service Attacks on Host-Based Generic Unpackers
Denial-of-Service Attacks on Host-Based Generic Unpackers Limin Liu 1, Jiang Ming 2, Zhi Wang 2,3, Debin Gao 2, and Chunfu Jia 3 1 State Key Lab of Information Security, Graduate University of CAS, China
Under the Hood: How Actaeon Unveils Your Hypervisor
Under the Hood: How Actaeon Unveils Your Hypervisor Eurecom, Sophia Antipolis, France, EU HITB Kuala Lumpur, October 2013 Table of Contents Eurecom S3 Security Lab What s the problem we are facing Why
Dongwoo Kim : Hyeon-jeong Lee s Husband
2/ 32 Who we are Dongwoo Kim : Hyeon-jeong Lee s Husband Ph.D. Candidate at Chungnam National University in South Korea Majoring in Computer Communications & Security Interested in mobile hacking, digital
KVM: Kernel-based Virtualization Driver
KVM: Kernel-based Virtualization Driver White Paper Overview The current interest in virtualization has led to the creation of several different hypervisors. Most of these, however, predate hardware-assisted
Virtual Machines. Virtualization
Virtual Machines Marie Roch Tanenbaum 8.3 contains slides from: Tanenbaum 3 rd ed. 2008 1 Virtualization Started with the IBM System/360 in the 1960s Basic concept simulate multiple copies of the underlying
Survey on virtual machine security
Survey on virtual machine security Bright Prabahar P Post Graduate Scholar Karunya university Bijolin Edwin E Assistant professor Karunya university Abstract Virtualization takes a major role in cloud
Clouds, Virtualization and Security or Look Out Below
Clouds, Virtualization and Security or Look Out Below Lee Badger Hardware Virtualization (Box View) 1 2 dom0 HW type 1 Para-virtualization I/O Host HW type 2 dom0 HW type 1 Full virtualization I/O Host
Exploiting the x86 Architecture to Derive Virtual Machine State Information
2010 Fourth International Conference on Emerging Security Information, Systems and Technologies Exploiting the x86 Architecture to Derive Virtual Machine State Information Jonas Pfoh, Christian Schneider,
ESET Endpoint Security 6 ESET Endpoint Antivirus 6 for Windows
ESET Endpoint Security 6 ESET Endpoint Antivirus 6 for Windows Products Details ESET Endpoint Security 6 protects company devices against most current threats. It proactively looks for suspicious activity
Operating System Structures
COP 4610: Introduction to Operating Systems (Spring 2015) Operating System Structures Zhi Wang Florida State University Content Operating system services User interface System calls System programs Operating
Hypervisor-Based, Hardware-Assisted System Monitoring
Horst Görtz Institute for IT-Security, Chair for System Security VMRay GmbH Hypervisor-Based, Hardware-Assisted System Monitoring VB2013 October 2-4, 2013 Berlin Carsten Willems, Ralf Hund, Thorsten Holz
Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips
Parasitics: The Next Generation. Vitaly Zaytsev Abhishek Karnik Joshua Phillips Agenda Overview W32/Xpaj analysis Overview of a virtual machine Software protection trends W32/Winemmem analysis W32/Induc
Enabling Technologies for Distributed Computing
Enabling Technologies for Distributed Computing Dr. Sanjay P. Ahuja, Ph.D. Fidelity National Financial Distinguished Professor of CIS School of Computing, UNF Multi-core CPUs and Multithreading Technologies
The QEMU/KVM Hypervisor
The /KVM Hypervisor Understanding what's powering your virtual machine Dr. David Alan Gilbert dgilbert@redhat.com 2015-10-14 Topics Hypervisors and where /KVM sits Components of a virtual machine KVM Devices:
An overwhelming majority of IaaS clouds leverage virtualization for their foundation.
1 2 3 An overwhelming majority of IaaS clouds leverage virtualization for their foundation. 4 With the use of virtualization comes the use of a hypervisor. Normally, the hypervisor simply provisions resources
TitanMist: Your First Step to Reversing Nirvana TitanMist. mist.reversinglabs.com
TitanMist: Your First Step to Reversing Nirvana TitanMist mist.reversinglabs.com Contents Introduction to TitanEngine.. 3 Introduction to TitanMist 4 Creating an unpacker for TitanMist.. 5 References and
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE)
Melde- und Analysestelle Informationssicherung MELANI Torpig/Mebroot Reverse Code Engineering (RCE) Andreas Greulich, MELANI Swiss Cyber Storm, 18 April 2009 Agenda Part 1: Introduction (~5 ) Infection
How do Users and Processes interact with the Operating System? Services for Processes. OS Structure with Services. Services for the OS Itself
How do Users and Processes interact with the Operating System? Users interact indirectly through a collection of system programs that make up the operating system interface. The interface could be: A GUI,
Peach Fuzzer Platform
Fuzzing is a software testing technique that introduces invalid, malformed, or random data to parts of a computer system, such as files, network packets, environment variables, or memory. How the tested
Uses for Virtual Machines. Virtual Machines. There are several uses for virtual machines:
Virtual Machines Uses for Virtual Machines Virtual machine technology, often just called virtualization, makes one computer behave as several computers by sharing the resources of a single computer between
LASTLINE WHITEPAPER. In-Depth Analysis of Malware
LASTLINE WHITEPAPER In-Depth Analysis of Malware Abstract Malware analysis is the process of determining the purpose and functionality of a given malware sample (such as a virus, worm, or Trojan horse).
Virtualization. Jukka K. Nurminen 23.9.2015
Virtualization Jukka K. Nurminen 23.9.2015 Virtualization Virtualization refers to the act of creating a virtual (rather than actual) version of something, including virtual computer hardware platforms,
VIRTUALIZATION INTROSPECTION SYSTEM ON KVM-BASED CLOUD COMPUTING PLATFORMS. 100356010@nccu.edu.tw Advisor: yuf@nccu.edu.tw Software Security Lab.
VIRTUALIZATION INTROSPECTION SYSTEM ON KVM-BASED CLOUD COMPUTING PLATFORMS 100356010@nccu.edu.tw Advisor: yuf@nccu.edu.tw Software Security Lab. Motivation The era of cloud computing Motivation In the
VMware Security Briefing. Rob Randell, CISSP Senior Security Specialist SE
VMware Security Briefing Rob Randell, CISSP Senior Security Specialist SE Agenda Security Advantages of Virtualization Security Concepts in Virtualization Architecture Operational Security Issues with
File Disinfection Framework (FDF) Striking back at polymorphic viruses
File Disinfection Framework (FDF) Striking back at polymorphic viruses 1 CONTENTS Introduction 3 File Disinfection Framework (FDF) 4 Disinfection solution development today 5 Goals 6 Target audience 6
PRACTICAL MALWARE ANALYSIS Kris Kendall kris.kendall@mandiant.com
PRACTICAL MALWARE ANALYSIS Kris Kendall kris.kendall@mandiant.com WHY PERFORM MALWARE ANALYSIS? What are some of the reasons that one might want to invest the (sometimes significant) resources required
Practical Threat Intelligence. with Bromium LAVA
Practical Threat Intelligence with Bromium LAVA Practical Threat Intelligence Executive Summary Threat intelligence today is costly and time consuming and does not always result in a reduction of successful
Secure In-VM Monitoring Using Hardware Virtualization
Secure In-VM Monitoring Using Hardware Virtualization Monirul Sharif Georgia Institute of Technology Atlanta, GA, USA msharif@cc.gatech.edu Wenke Lee Georgia Institute of Technology Atlanta, GA, USA wenke@cc.gatech.edu
Enabling Technologies for Distributed and Cloud Computing
Enabling Technologies for Distributed and Cloud Computing Dr. Sanjay P. Ahuja, Ph.D. 2010-14 FIS Distinguished Professor of Computer Science School of Computing, UNF Multi-core CPUs and Multithreading
Intro to Virtualization
Cloud@Ceid Seminars Intro to Virtualization Christos Alexakos Computer Engineer, MSc, PhD C. Sysadmin at Pattern Recognition Lab 1 st Seminar 19/3/2014 Contents What is virtualization How it works Hypervisor
A Survey on Virtual Machine Security
A Survey on Virtual Machine Security Jenni Susan Reuben Helsinki University of Technology jreubens@cc.hut.fi Abstract Virtualization plays a major role in helping the organizations to reduce the operational
Outline. Outline. Why virtualization? Why not virtualize? Today s data center. Cloud computing. Virtual resource pool
Outline CS 6V81-05: System Security and Malicious Code Analysis Overview of System ization: The most powerful platform for program analysis and system security Zhiqiang Lin Department of Computer Science
Virtualization. Jia Rao Assistant Professor in CS http://cs.uccs.edu/~jrao/
Virtualization Jia Rao Assistant Professor in CS http://cs.uccs.edu/~jrao/ What is Virtualization? Virtualization is the simulation of the software and/ or hardware upon which other software runs. This
IOS110. Virtualization 5/27/2014 1
IOS110 Virtualization 5/27/2014 1 Agenda What is Virtualization? Types of Virtualization. Advantages and Disadvantages. Virtualization software Hyper V What is Virtualization? Virtualization Refers to
kvm: Kernel-based Virtual Machine for Linux
kvm: Kernel-based Virtual Machine for Linux 1 Company Overview Founded 2005 A Delaware corporation Locations US Office Santa Clara, CA R&D - Netanya/Poleg Funding Expertise in enterprise infrastructure
Virtual Switching Without a Hypervisor for a More Secure Cloud
ing Without a for a More Secure Cloud Xin Jin Princeton University Joint work with Eric Keller(UPenn) and Jennifer Rexford(Princeton) 1 Public Cloud Infrastructure Cloud providers offer computing resources
Hypervisor Memory Forensics
Hypervisor Memory Forensics Mariano Graziano and Davide Balzarotti SANS DFIR EU SUMMIT October 2013 - Prague S3 GROUP S3 GROUP Actaeon Memory forensics of virtualization environments Locate any Intel Hardware
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A monnappa22@gmail.com
Automating Linux Malware Analysis Using Limon Sandbox Monnappa K A monnappa22@gmail.com A number of devices are running Linux due to its flexibility and open source nature. This has made Linux platform
Machine Virtualization: Efficient Hypervisors, Stealthy Malware
Machine Virtualization: Efficient Hypervisors, Stealthy Malware Muli Ben-Yehuda Technion & Hypervisor Technologies and Consulting Ltd Muli Ben-Yehuda (Technion & Hypervisor) Efficient Hypervisors, Stealthy
Tom Eastep Linuxfest NW April 26-27, 2008 Bellingham, Washington
Tom Eastep Linuxfest NW April 26-27, 2008 Bellingham, Washington 1. Introduction to Virtualization Techniques 2. Pros and Cons 3. Where does KVM fit in 4. QEMU-kvm 5. Creating a virtual disk 6. Installing
Enterprise-Class Virtualization with Open Source Technologies
Enterprise-Class Virtualization with Open Source Technologies Alex Vasilevsky CTO & Founder Virtual Iron Software June 14, 2006 Virtualization Overview Traditional x86 Architecture Each server runs single
Chapter 2 Addendum (More on Virtualization)
Chapter 2 Addendum (More on Virtualization) Roch Glitho, PhD Associate Professor and Canada Research Chair My URL - http://users.encs.concordia.ca/~glitho/ More on Systems Virtualization Type I (bare metal)
Virtualization Technologies and Blackboard: The Future of Blackboard Software on Multi-Core Technologies
Virtualization Technologies and Blackboard: The Future of Blackboard Software on Multi-Core Technologies Kurt Klemperer, Principal System Performance Engineer kklemperer@blackboard.com Agenda Session Length:
CS 695 Topics in Virtualization and Cloud Computing and Storage Systems. Introduction
CS 695 Topics in Virtualization and Cloud Computing and Storage Systems Introduction Hot or not? source: Gartner Hype Cycle for Emerging Technologies, 2014 2 Source: http://geekandpoke.typepad.com/ 3 Cloud
Virtualization Technology. Zhiming Shen
Virtualization Technology Zhiming Shen Virtualization: rejuvenation 1960 s: first track of virtualization Time and resource sharing on expensive mainframes IBM VM/370 Late 1970 s and early 1980 s: became
Detecting the One Percent: Advanced Targeted Malware Detection
Detecting the One Percent: Advanced Targeted Malware Detection Tomer Teller Check Point Software Technologies Session ID: SP02-T19 Session Classification: Intermediate Antivirus 20 th+ Anniversary The
Cloud Sure - Virtual Machines
Cloud Sure - Virtual Machines Maximize your IT network The use of Virtualization is an area where Cloud Computing really does come into its own and arguably one of the most exciting directions in the IT
Cloud Terminal: Secure Access to Sensitive Applications from Untrusted Systems
Cloud Terminal: Secure Access to Sensitive Applications from Untrusted Systems Lorenzo Martignoni, Pongsin Poosankam, y Matei Zaharia, Jun Han, y Stephen McCamant, Dawn Song, Vern Paxson, Adrian Perrig,
Comparing Virtualization Technologies
CHAPTER 2 Comparing Virtualization Technologies With this chapter, we begin our exploration of several popular virtualization strategies and explain how each works. The aim is to bring you the operational
Virtual Machine Security
Virtual Machine Security CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ 1 Operating System Quandary Q: What is the primary goal
12. Introduction to Virtual Machines
12. Introduction to Virtual Machines 12. Introduction to Virtual Machines Modern Applications Challenges of Virtual Machine Monitors Historical Perspective Classification 332 / 352 12. Introduction to
Virtualization. P. A. Wilsey. The text highlighted in green in these slides contain external hyperlinks. 1 / 16
1 / 16 Virtualization P. A. Wilsey The text highlighted in green in these slides contain external hyperlinks. 2 / 16 Conventional System Viewed as Layers This illustration is a common presentation of the
Confinement Problem. The confinement problem Isolating entities. Example Problem. Server balances bank accounts for clients Server security issues:
Confinement Problem The confinement problem Isolating entities Virtual machines Sandboxes Covert channels Mitigation 1 Example Problem Server balances bank accounts for clients Server security issues:
COS 318: Operating Systems
COS 318: Operating Systems OS Structures and System Calls Andy Bavier Computer Science Department Princeton University http://www.cs.princeton.edu/courses/archive/fall10/cos318/ Outline Protection mechanisms
Code Injection From the Hypervisor: Removing the need for in-guest agents. Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs
Code Injection From the Hypervisor: Removing the need for in-guest agents Matt Conover & Tzi-cker Chiueh Core Research Group, Symantec Research Labs SADE: SteAlthy Deployment and Execution Introduction
Enterprise Deployment: Laserfiche 8 in a Virtual Environment. White Paper
Enterprise Deployment: Laserfiche 8 in a Virtual Environment White Paper August 2008 The information contained in this document represents the current view of Compulink Management Center, Inc on the issues
9/26/2011. What is Virtualization? What are the different types of virtualization.
CSE 501 Monday, September 26, 2011 Kevin Cleary kpcleary@buffalo.edu What is Virtualization? What are the different types of virtualization. Practical Uses Popular virtualization products Demo Question,
Windows Server Virtualization & The Windows Hypervisor
Windows Server Virtualization & The Windows Hypervisor Brandon Baker Lead Security Engineer Windows Kernel Team Microsoft Corporation Agenda - Windows Server Virtualization (WSV) Why a hypervisor? Quick
CPS221 Lecture: Operating System Structure; Virtual Machines
Objectives CPS221 Lecture: Operating System Structure; Virtual Machines 1. To discuss various ways of structuring the operating system proper 2. To discuss virtual machines Materials: 1. Projectable of
Contents UNIFIED COMPUTING DATA SHEET. Virtual Data Centre Support. www.interoute.com
Contents Scope of this Document... 2 Product Overview... 2 Virtual Data Centre and VDC Dedicated Infrastructure... 2 Service Levels... 3 Severity and Support Response Times... 4 On-boarding... 5 Incident
Example of Standard API
16 Example of Standard API System Call Implementation Typically, a number associated with each system call System call interface maintains a table indexed according to these numbers The system call interface
Virtualization and Other Tricks.
Virtualization and Other Tricks. Pavel Parízek, Tomáš Kalibera, Peter Libič DEPARTMENT OF DISTRIBUTED AND DEPENDABLE SYSTEMS http://d3s.mff.cuni.cz CHARLES UNIVERSITY PRAGUE Faculty of Mathematics and
The Virtualization Practice
The Virtualization Practice White Paper: Security Requirements of Hybrid Clouds: A Product Comparison! Edward L. Haletky Analyst Virtualization and Cloud Security! The Virtualization Practice Sponsored
Architecture of the Kernel-based Virtual Machine (KVM)
Corporate Technology Architecture of the Kernel-based Virtual Machine (KVM) Jan Kiszka, Siemens AG, CT T DE IT 1 Corporate Competence Center Embedded Linux jan.kiszka@siemens.com Copyright Siemens AG 2010.
Chapter 5 Cloud Resource Virtualization
Chapter 5 Cloud Resource Virtualization Contents Virtualization. Layering and virtualization. Virtual machine monitor. Virtual machine. Performance and security isolation. Architectural support for virtualization.
Monitoring, Tracing, Debugging (Under Construction)
Monitoring, Tracing, Debugging (Under Construction) I was already tempted to drop this topic from my lecture on operating systems when I found Stephan Siemen's article "Top Speed" in Linux World 10/2003.
Hotpatching and the Rise of Third-Party Patches
Hotpatching and the Rise of Third-Party Patches Alexander Sotirov asotirov@determina.com BlackHat USA 2006 Overview In the next one hour, we will cover: Third-party security patches _ recent developments