Kieseberg, Peter ; Huber, Markus ; Leithner, Manuel ; Mulazzani, Martin ; Weippl, Edgar (2013)
Covert Computation: Hiding Code in Code for Obfuscation Purposes.
Hangzhou, China
doi: 10.1145/2484313.2484384
Konferenzveröffentlichung, Bibliographie
Kurzbeschreibung (Abstract)
As malicious software gets increasingly sophisticated and resilient to detection, new concepts for the identification of malicious behavior are developed by academia and industry alike. While today’s malware detectors primarily focus on syntactical analysis (i.e., signatures of malware samples), the concept of semantic-aware malware detection has recently been proposed. Here, the classification is based on models that represent the underlying machine and map the effects of instructions on the hardware. In this paper, we demonstrate the incompleteness of these models and highlight the threat of malware, which exploits the gap between model and machine to stay undetectable. To this end, we introduce a novel concept we call covert computation, which implements functionality in side effects of microprocessors. For instance, the flags register can be used to calculate basic arithmetical and logical operations. Our paper shows how this technique could be used by malware authors to hide malicious code in a harmless-looking program. Furthermore, we demonstrate the resilience of covert computation against semantic-aware malware scanners.
| Typ des Eintrags: | Konferenzveröffentlichung |
|---|---|
| Erschienen: | 2013 |
| Autor(en): | Kieseberg, Peter ; Huber, Markus ; Leithner, Manuel ; Mulazzani, Martin ; Weippl, Edgar |
| Art des Eintrags: | Bibliographie |
| Titel: | Covert Computation: Hiding Code in Code for Obfuscation Purposes |
| Sprache: | Deutsch |
| Publikationsjahr: | Mai 2013 |
| Verlag: | ACM |
| Buchtitel: | Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security table of contents |
| Reihe: | ASIA CCS '13 |
| Veranstaltungsort: | Hangzhou, China |
| DOI: | 10.1145/2484313.2484384 |
| Kurzbeschreibung (Abstract): | As malicious software gets increasingly sophisticated and resilient to detection, new concepts for the identification of malicious behavior are developed by academia and industry alike. While today’s malware detectors primarily focus on syntactical analysis (i.e., signatures of malware samples), the concept of semantic-aware malware detection has recently been proposed. Here, the classification is based on models that represent the underlying machine and map the effects of instructions on the hardware. In this paper, we demonstrate the incompleteness of these models and highlight the threat of malware, which exploits the gap between model and machine to stay undetectable. To this end, we introduce a novel concept we call covert computation, which implements functionality in side effects of microprocessors. For instance, the flags register can be used to calculate basic arithmetical and logical operations. Our paper shows how this technique could be used by malware authors to hide malicious code in a harmless-looking program. Furthermore, we demonstrate the resilience of covert computation against semantic-aware malware scanners. |
| Freie Schlagworte: | code obfuscation, malware detection, side effects |
| ID-Nummer: | TUD-CS-2013-0480 |
| Fachbereich(e)/-gebiet(e): | Profilbereiche Profilbereiche > Cybersicherheit (CYSEC) |
| Hinterlegungsdatum: | 28 Aug 2017 12:40 |
| Letzte Änderung: | 22 Jan 2019 11:20 |
| PPN: | |
| Export: | |
| Suche nach Titel in: | TUfind oder in Google |
 |
Frage zum Eintrag |
Optionen (nur für Redakteure)
 |
Redaktionelle Details anzeigen |
Drucken
Impressum