3 ms·
Shellcode detection using CPU emulation and syscall blacklisting
- nickpsecurity 11y agoI had an idea a while back for a HIDS or at least post-infection analysis. You record incoming data and files onto storage. Have a separate machine running it which is instrumented to check all jumps, etc against a whitelist generated when compiling same system. It would eventually spot the compromise plus be able to show the exact sequence of data & instructions that caused it. Which would aid patching it. Stayed on prevention instead. Thought it would be fun building & optimizing it, though.
- munin 11y agothis is control flow integrity, it's in windows 10 now as a technology called "control flow guard".
- nickpsecurity 11y agoI havent read it yet: was talking on topic in general. Cool they have CFI in Windows now, though. Most exciting thing Ive seen in that sub-field was Code Pointer Integrity. Really want the people who broke other CFI's to have a go at it. That and Softbound/Hardbound for more thorough cases.
- NickHaflinger 11y ago"Bypass control flow guard" :) https://www.blackhat.com/docs/us-15/materials/us-15-Zhang-Bypass-Control-Flow-Guard-Comprehensively-wp.pdf https://www.blackhat.com/docs/us-15/materials/us-15-Zhang-By...
- nickpsecurity 11y agoDoesn't surprise me. There's been few breaks in prior SFI/CFI's. That's why I'm not relying on CPI until strong peer review happens. There's added risk since CFI concept is really a cheat to try to avoid full data or memory safety. They think they'll get security and great performance with the cheat. They usually get the performance. ;)
- dogma1138 11y agoThat's what lastline is doing its based on Anubis.
- nickpsecurity 11y agoHoly crap, it looks like they are! Neat to see my old proposal become real. It will be interesting to compare their version functionality to my specs.