"Invincibility lies in the defense; the possibility of victory in the attack." – Sun Tzu
Polymorphic viruses make up an ever-increasing percentage of daily malware collections. The sophistication of these attacks significantly exceeds the capabilities of existing classification and handling solutions. The situation goes from bad to worse when we attempt the most complicated part of incident response, file disinfection and remediation.
To combat this problem we've created a new open source project, the File Disinfection Framework (FDF), built on top of a new generation of TitanEngine and tailored specifically to aid in solving these hard problems. FDF combines both static analysis and emulation to enable users to rapidly switch between modes of operation to use the best features of each approach. Highly advanced static functions are hidden behind a simple and easy-to-use program interface that enables the broad range of capabilities that are required for decryption, decompression and disinfection. Their complement is a set of functions that enable quick and very customizable emulation. For the first time, analysts will have the ability to truly see and control everything that happens inside the emulated environment. They can run high level code inside the context of the emulated process to influence objects and files and direct the execution flow.
File disinfection framework features:
A truly unique x86 emulator written from scratch that supports the following Windows features
User can call standard Windows APIs inside the context of an emulated process. For example the user can dynamically create a new DLL file inside the virtual file system and load it into the context of an emulated process by calling LoadLibrary equivalent. Every emulated API is exposed to the user and therefore usable with the option of hooking any API one or more times.
Specific functionally designed to disinfect files infected with polymorphic viruses such as Virut and Sality with examples that show its use.
File disinfection framework has been developed under the cyber fast track program run by DARPA and built on top of the new generation of TitanEngine. It's an open source cross platform x86-x64 library that enables its user to unpack, disinfect and build PE32/PE32+ files. These and all Emulation components of the new major release of this framework have been designed to be presented as a BlackHat exclusive. This talk will be followed by the public release of the source code along with whitepapers that outline possible use case scenario for this technology.
Mario has been involved in development of advanced security solutions for the last seven years and has rich engineering background spanning the last 20 years. Before founding ReversingLabs, Mario was the Director of Research at Bit9 and one of its founding engineers. He spoke at numerous conferences over the last 6 years including CEIC, Black Hat, RSA, Defcon, Caro Workshop, Virus Bulletin and AVAR Conferences. He is author of numerous blog posts on security and has authored "Protection in Untrusted Environments" chapter for the "Virtualization for Security" book. He coordinates AMTSO Advisory Board and works with IEEE Malware Working Group.
Tomislav Pericin has been analyzing and developing software packing and protection methods for the last 9 years. He is one of the founders of ReversingLabs and the chief software architect behind such projects as TitaniumCore, TitanEngine, NyxEngine and RLPack. Recently he spoke at BlackHat, ReCon, CARO Workshop, SAS and TechnoSecurity conferences.