This dump is puzzle
The talk is about the methodology followed by the researcher to extract GSM APN credentials from an eSIM on IOT gateway device (the device bridges LPWAN to GSM/Private APN).
The challenge that had to solve the researcher here after dumping the chip is to construct the fragmented Zip files chunks (J2ME data).
The researcher considered that a zip file contains a lot of metadata and structures (Ange Albertini ). Then the idea is to find clues to spot these metadata and write a puzzle solver.
So the approach consists in finding within the Zip file the End of the Central Directory. that gives the final record in a zip file, the total size of file headers and data and the total number of file entries.
Some complications were faced during the implementation of this idea as the fact that basing on the signature of the End of the Central Directory (PK\x05\x06), two instances can be found in the dump. That explains the need to classify fragments. For classification automation the researcher decided to apply K-means clustering method.
Slides can be downloaded from here.
Sandbagility - Reverse Engineering Framework for Windows dynamic analysis
The talk was about a malware analysis toolset based on a modified version of virtualbox and fast debugging protocol. The objective of creating this kind of environment is to avoid having an agent (like a driver) on the guest.
So the talk gave
Slides are here.
A Code Pirate's Cutlass
The speaker tackled here a serious problem in reverse engineering. The context of his research is vulnerability analysis for embedded devices. Generally, in this context, a reverser has to deal with a single and large binary where there is no distinction between application threads, libraries and operating system. Within this all mess, understanding the software architecture is critical for the reverser.
The researcher defines the CodeCut problem as the result of liking multiple object files (multiple compiled source files) into one huge binary file (concatenation of the object files).
So given a call graph can reverser recover the different regions of the program (identify the boundaries of the different object files) ?
The speaker mentioned here that he blocked when he decided to solve this problem by using graph theory algorithms (scaling problems). So he decided to approach it as a numerical problem and introduced the LFA (Local Function Affinity) concept. And the receipt (As I got it):
I'm not a math guy, if you're interested, you will find a math definition of LFA.
The tool is not yet published but the speaker noted that he'll open source it as a futur work.
You can check for the slides here.
Taint-based return oriented programming
Sorry but I did not take much notes here and unfortunately the speaker did not published his slides.
After a brief introduction about ROP exploitation techniques, the researchers presented an approach based on taint analysis to identify a ROP chain. T-Brop is a tool that implements this technique.
Modern Linux Malware Exposed
The speakers begun their talk by stating that real life malware analyst does not turn only around Windows malware.
Then all the talk, as far as I'm concerned, a comparison between Windows and Linux malware in terms of stats, protections , obfuscation , packing and analysis techniques?
Slides are here.
Analyzing TRISIS - the first Safety Instrumented System malware
That was one of the talks that I really appreciated.
The talk is about REing an ICS malware code named TRISIS. This latter targeted a gas facility in Saudi Arabia (August 2017). The malware targeted the Safety Controller and caused a system shut down.
The SIS (Safety Instrument System) controller is a programmable logic controller designed to shut down a platform or a reactor safely. In a nutshell, This equipment is designed to protect people from being injured.
Basically, hacking a SIS doesn't mean that you won. You still have to overcome fail safe mechanism.
The attack consisted mainly in compromising a SIS-connected workstation, and then rebound to SIS system.
TRISIS malware components are:
The researchers introduced then Triconex hardware specifications that help them to start digging into the code. Blocked by some memory offsets located in the malware code they bought a Triconex controller. They explained then how they extracted and disassembled the Triconex firmware.
Slides can be downloaded from here.
Sandbagility - Reverse Engineering Framework for Windows dynamic analysis
The talk was about a malware analysis toolset based on a modified version of virtualbox and fast debugging protocol. The objective of creating this kind of environment is to avoid having an agent (like a driver) on the guest.
So the talk gave
- an overview on the state of the art of malware analysis and fast debugging protocol
- a detailed explanation about Sandbagility
- an overview about some techniques implemented by the tool
Slides are here.
A Code Pirate's Cutlass
The speaker tackled here a serious problem in reverse engineering. The context of his research is vulnerability analysis for embedded devices. Generally, in this context, a reverser has to deal with a single and large binary where there is no distinction between application threads, libraries and operating system. Within this all mess, understanding the software architecture is critical for the reverser.
The researcher defines the CodeCut problem as the result of liking multiple object files (multiple compiled source files) into one huge binary file (concatenation of the object files).
So given a call graph can reverser recover the different regions of the program (identify the boundaries of the different object files) ?
The speaker mentioned here that he blocked when he decided to solve this problem by using graph theory algorithms (scaling problems). So he decided to approach it as a numerical problem and introduced the LFA (Local Function Affinity) concept. And the receipt (As I got it):
- If we eliminate external calls
- Directionality of calls at the beginning of the module is in the positive direction
- Directionality of calls generally switch to the negative direction towards the end of the module
- We can detect edges by finding the switch from negative back to positive
I'm not a math guy, if you're interested, you will find a math definition of LFA.
The tool is not yet published but the speaker noted that he'll open source it as a futur work.
You can check for the slides here.
Taint-based return oriented programming
Sorry but I did not take much notes here and unfortunately the speaker did not published his slides.
After a brief introduction about ROP exploitation techniques, the researchers presented an approach based on taint analysis to identify a ROP chain. T-Brop is a tool that implements this technique.
Modern Linux Malware Exposed
The speakers begun their talk by stating that real life malware analyst does not turn only around Windows malware.
Then all the talk, as far as I'm concerned, a comparison between Windows and Linux malware in terms of stats, protections , obfuscation , packing and analysis techniques?
Slides are here.
Analyzing TRISIS - the first Safety Instrumented System malware
That was one of the talks that I really appreciated.
The talk is about REing an ICS malware code named TRISIS. This latter targeted a gas facility in Saudi Arabia (August 2017). The malware targeted the Safety Controller and caused a system shut down.
The SIS (Safety Instrument System) controller is a programmable logic controller designed to shut down a platform or a reactor safely. In a nutshell, This equipment is designed to protect people from being injured.
Basically, hacking a SIS doesn't mean that you won. You still have to overcome fail safe mechanism.
The attack consisted mainly in compromising a SIS-connected workstation, and then rebound to SIS system.
TRISIS malware components are:
- SIS rootkit
- PC applications : TRilog.exe, py2exe
- 3 PowerPC payloads
- A 4th unknown payload
The researchers introduced then Triconex hardware specifications that help them to start digging into the code. Blocked by some memory offsets located in the malware code they bought a Triconex controller. They explained then how they extracted and disassembled the Triconex firmware.
Slides can be downloaded from here.
