Security Research and Development Framework · Security Research and Development Framework By Amr...

Security Research and Development

Framework

By Amr Thabet

Malware Researcher

@Q-CERT

About The Author

Malware Researcher at Q-CERT

Wrote a Stuxnet Malware Analysis Paper

Author of Pokas x86 Emulator

Author of SRDF (what we will talk about)

Introduction

Development Framework (Library)

Contains many security classes/tools

Created For:

Malware Analysis

Packet Analysis

Antivirus and Firewall Tools

Free and Open Source

Why SRDF?

For This Guy !!

Why SRDF?

Implement your Inovative Idea

Don’t re-invent The Wheel

Don’t waste your time

Flexible Design

Production Quality

Community Based Development and Beta-testing

Contents

Design

• User-Mode

• Kernel-Mode

• Features

Major Projects

• Packetyzer

• x86 Emulator

Projects Based on SRDF

• Inspector’s Gadget

• Exploitation Detection System (EDS)

User-Mode Design

Infrastructure:

The Common Part at any Framework … not related to

security

Targets:

What you will secure or secure from

Libraries:

The Security Tools are here … it’s divided into Malware

and Network

The interface and the managment

Features

Full OOP

PE, ELF, PDF and Andorid File Parsers

x86 Disassembler, Debugger and Emulator

API Hooking

Packet, Protocol and Network Flow Analysis

Production Quality

FREE and Open Source

Kernel-Mode

Support x32 Bits until now

Little bit old

Should be extended to x64

Under Construction

Kernel- Mode Design

Major Projects

• Packetyzer

• x86 Emulator

Packetyzer

Created By Anwar Mohamed

Packet Analysis Tool

Session Separation

Generating Packets and Send (Winpcap)

Decodes:

ARP,ICMP,TCP,UDP

HTTP, DNS

Parse PCAP Files

Reassemble Packets

Design

Simple Demo – Read Pcap File

Simple Demo – DNS Streams

Simple Demo – HTTP Streams

Simple Demo – HTTP Output

Packetyzer

Reach it at:

https://github.com/AnwarMohamed/Packetyzer

It’s also a Part of SRDF

Pokas Emulator

For win32 Applications

very powerful debugger

Monitor Memory Writes

Emulate PE Files and Shellcode

Dump The Process

Reconstruct Import Table

SRDF has a Wrapper Class for it

Design

The Emulator’s Debugger

Take String Condition

Convert it into Native Code

Very Fast

Easy to Customize

Have Predefined Functions

Allow to Add Function

Examples

“__isdirty(eip)“

"__disp() >=0x00401000 &&ecx>10“

"(eax& 0xff)> 5*(edx& 0xff) || __read(0x401000)==0x500“

"__isapiequal('getprocaddress') || __isapiequal('loadlibraryA')“

Demo: Unpack UPX - PEid

Demo: Unpack UPX – ImportTable

Demo: Unpack UPX - Code

Demo: Unpack UPX – Run Code

Demo: Unpack UPX - Unpacked

Demo: Unpack UPX - ImportTable

x86 Emulator

Reach it at:

https://github.com/AmrThabet/x86Emulator

Projects Based on SRDF

• Inspector’s Gadget

• Exploitation Detection System

Inspector’s Gadget

Created by Jonas lykkegaard

ROP gadget indexing and searching tool.

Emulating Gadgets

Scoring and Categorizing

Flexible Search

Design

Features

Categorizing by Behavior

Scoring Gadgets

Allow ret, pop/jmp, iret and ret far

Depends on SQLite

SQL Searching

Predefined SQL Queries

GUI Based

Exploitation Detection System

Security Mitigation Tool

Detect memory corruption exploits

Based on SRDF

Talked about it in

Reach it at:Defcon 21 archive

Normal API call check

API call with Ret

Reach Us

SRDF Links:

https://github.com/AmrThabet/winSRDF

FB: http://www.facebook.com/SecDevelop

Twitter: https://twitter.com/winSRDF

Website: http://security-framework.com/

Conclusion

Development Framework for security

Contains many tools in Malware and Network

Flexible expandable Design

Kernel-Mode and User-Mode

Free and Open Source

Join Us

Any Question?

Security Research and Development Framework · Security Research and Development Framework By Amr...

Documents

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

NET MALWARE THREAT: INTERNALS AND REVERSING … CON 27/DEF CON 27 presentations/DEFCON-27... · ALEXANDRE BORGES – MALWARE AND SECURITY RESEARCHER DEF CON USA 2019 5 9Motivationsto

HERE - Cuckoo Sandbox - Automated Malware Analysis€¢Creator of Cuckoo Sandbox •Founder of Malwr.com HERE •Mark “rep” Schloesser @repmovsb •Security Researcher at Rapid7

Nicolas Brulez (@nicolasbrulez) Principal Malware Researcher Global Research & Analysis Team

CERT 2009 Research Report - Carnegie Mellon …...2009 Research Report Abstracts Applying Function Extraction (FX) Techniques to Reverse Engineer Virtual Machines Malware that has

MALWARE TREND REPORT - OIC-CERT

Malware & Anti-Malware

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Christian Wojner, CERT - FIRST · Wh01am 02.04.2013 2 Person Christian Wojner Malware Analysis, Reverse Engineering, Computer Forensics CERT.at / GovCERT.gv.at Papers Mass Malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Marta Janus Malware Researcher A tale of encounters with novel evasive malware

Visiting the snake nest - RECON.CX · 2019. 3. 5. · Visiting the snake nest Recon Brussels 2018 Jean-Ian Boutin | Senior Malware Researcher Matthieu Faou | Malware Researcher. Jean-Ian

Malware Trend Report H2 2017 - Nexxy Technologies · The OIC-CERT Malware Trend Report H2-2017 is the 3rd of its kind covering malware trends for the 2nd half of ... multiple ways

ENISA CERT TRAINING · PDF fileFamiliarisation with tools related to Mobile Forensics Familiarisation with Mobile Applications Perform static mobile malware analysis

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Are there Spectre-based malware on your Android smartphone? · Are there Spectre malware on your Android smartphone? I am an Anti-Virus researcher at Fortinet Predestined for a talk

Metamorphic Malware 1 Metamorphic Malware Research

Backoff: New Point of Sale Malware - US-CERT · 2017-09-04 · to deploy the point-of-sale (PoS) malware and subsequently exfiltrate consumer payment data via an encrypted POST request

Coordinated Vulnerability Disclosure Part 5 · Coordinated Vulnerability Disclosure . by Dan Klinedinst. And Dan is a . vulnerability researcher at CMU CERT . Coordination Center

Graph, Entropy and Grid Computing: Automatic Comparison … · Graph, Entropy and Grid Computing: Automatic Comparison of Malware Ismael Briones Aitor Gomez PandaLabs Malware Researcher