Playing Malware Injection with Exploit thoughts

Presented at DEF CON 26 (2018), Aug. 11, 2018, 2 p.m. (20 minutes)

In the past, when hackers did malicious program code injection, they used to adopt RunPE, AtomBombing, cross-process creation threads, and other approaches. They could forge their own execution program as any critical system service. However with increasing process of anti-virus techniques, these sensitive approaches have been gradually proactively killed. Therefore, hackers began to aim at another place, namely memory-level weakness, due to the breakages of critical system service itself.

This agenda will simply introduce a new memory injection technique that emerged after 2013, PowerLoadEx. Based on this concept, three new injection methods will be disclosed as well. These makes good use of the memory vulnerability in Windows to inject malicious behavior into system critical services. The content will cover Windows reverse analysis, memory weakness analysis, how to use and utilize, and so on. The relevant PoC will be released at the end of the agenda.

Presenters:

• Sheng-Hao Ma - CSIE, NTUST
  Sheng-Hao Ma (aaaddress1) is a core member of CHROOT Security Group and TDOHacker security community in Taiwan, he has over ten years of experience in reverse engineering and machine language, and mastered the intel 8086. He expert in Windows vulnerability, reverse engineering. Moreover, Sheng-Hao Ma has many papers presented in security conferences such as BlackHat Asia Arsenal, BSidesLV, ICNC, MC2015 and CISC, he was also a speaker at HITCON (Hackers In Taiwan Conference), SITCON (Students In Taiwan Conference), iThome#Chatbot. @aaaddress1

Links:

• https://defcon.org/html/defcon-26/dc-26-speakers.html#Ma
• https://infocon.org/cons/DEF CON/DEF CON 26/DEF CON 26 video and slides/DEF CON 26 - Sheng-Hao Ma - Playing Malware Injection with Exploit thoughts.mp4
• https://infocon.org/cons/DEF CON/DEF CON 26/DEF CON 26 video and slides/DEF CON 26 - Sheng-Hao Ma - Playing Malware Injection with Exploit thoughts.srt (subtitles)
• https://www.youtube.com/watch?v=zjtqs07kQgk

Similar Presentations:

• Black Hat USA 2020 Virtual / Hiding Process Memory via Anti-Forensic Techniques
• DEF CON 30 (2022) / Master Class: Delivering a New Construct in Advanced Volatile Memory Analysis for Fun and Profit Workshop
• BSidesLV 2019 / Please inject me, a x64 code injection