Embed Size (px)
Citation preview
If you had three
wishes, what would
they be?
xn--80aqafcrtq.cc
http://hqwallbase.com/28103-lego-stormtroopers-wallpaper-2560x1600
Marion Marschalek
@pinkflawd
MINDSETTLING THOUGHTS
THE NEED FOR INNOVATION
SO WHAT (NOW)?
www.ilikewallpaper.net
Did Highschool for
Software Engineering
Malware Analyst in
Anti-Virus Industry
Studied Information
Security
Thought Malware
sounds cool ...
Female Reverse
Engineering Challenge
BOOM.
TECHNOLOGY vs.
journalism
publishing
multimedia design
philosophy
economy
What do YOU
think you‘re
good at?
THE INNOVATION GAP
challenges
interesting
characters
more $
more
freedomfun
less personal
competition
ridiculous
appreciation
hdwallpapercorner.com
the A and the P of the T
ADVANCED[ədˈvɑ:n(t)st]
PERSISTENT[pəˈsɪstənt]
we don‘t understand it
we detected it too late
7 Sins of Today‘s Threats
http://www.dvd-ppt-slideshow.com
NOT BEING UNIQUE
Runtime packer trigger heuristics!
Altered compiler settings don‘t ...
Dynamic API resolving
String obfuscation
ONE BINARY TO RULE FOREVER
Filehash-based detection
Updating of binaries in irregular intervals
Route traffic through local proxy
REPETITIVE ARTIFACTSFile names
Domain names
Registry key names / value names
Infiltration methods
Persistence methods
ENVIRONMENTALINSENSITIVITY
Might want to refuse executing in sandboxes, emulators &
analyst‘s machines
Potentially targeted systems usually homogeneous
SINGULAR PERSISTENCERemember the P?
Registry & service list monitored
One process easy to kill
MBR regularly scanned
Why not do all?
SEPARATION OF LAYERS
In-memory scanning identifies equal payloads
Consistent evasion tricks multiply success
KNOWN SPHERESRemember the A?
Find new battle fields
Virtual machine executionKernel land code
Bootkits
BIOS
1. Unique binaries2. Irregular updates3. No repetitive artifacts4. Environmental sensitivity5. Multiple persistence techniques6. Consistent evasion7. Unknown spheres
The A and the P of the T1 2 3 4 5 6 7
BlackEnergy
Havex
BlackPOS
EvilBunny
estimated 56 Mio.
credit cards compromised
THREAT DETECTION 101
The binary has to be known.
The binary has to be recognized.
The behavior of the binary has to be recognized.
BRIGHT MINDS
http://www.deviantart.com/morelikethis/109459418
MAD SKILLShttp://paulingblog.wordpress.com
DRIVEN CHARACTERS
hdwallpapers360.com
So what (now)?
‘I have to learn this.‘
‘I'm not sure about this.‘
‘Some day I will.‘
‘I am not good at X.'
or plainly 'I can't.'
KICK ASS.
Look at what you can do,
not at what you can not do.
have to learn!
THE $-THINGCONFIDENCE.
CHOICES.
FREEDOM.
Choose Your Dreams Carefully
http://wallpaperswide.com
Choose Your Dreams Carefully
IF I HAD THREE WISHES ...
1. Everyone would have unbiased choices.
2. We would all be free to think whatever we want.
3. We would have secure systems which would assure integrated safety and privacy.
Thank you!
Marion Marschalek
@pinkflawd
http://karmadecay.com/
