Stealthy malware persistence mechanisms

MrBrian · Nov 5, 2014

From Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1:

At Shmoocon 2013 Jake Williams (@MalwareJake) and I gave a presentation entitled “Wipe the Drive”. The point of the presentation was that you should always wipe the drive and reinstall the OS after a confirmed malware infection. We all know wiping the drive is the safest move but there are business pressures to simply remove the known malware and move on. Also, because we are security professionals there is often an expectation that we are able to remove all the malware. But, in my and Jake’s opinion, relying on a “clean scan” from antivirus products isn’t the best approach. The time and effort required to accurately analyze the capabilities of malware and conduct forensic analysis to determine if those capabilities were used is usually not in the cards. There is always an element of risk management, but whenever you possibly can, just wipe the drive. To illustrate the point we began developing a list of ways that malware or an active attacker on your computer can make small configuration changes to you machine. The changes create a misconfiguration that makes the target exploitable or set events in motion that will cause the target to automatically get re-compromised in the future. There are a very large number of changes and misconfigurations that attackers can make but our talk focused around eight of them. The only criteria for these techniques is that they launch a process in an unusual way and ideally they don’t have any processes running (so you can avoid detection by memory forensics). I will discuss a few of the methods we came up with and how you might detect these changes.
Click to expand...

Part 2
Part 3
Part 4

Another one: COM Object hijacking: the discreet way of persistence.

MrBrian · Nov 5, 2014

Alternate presentation of last post:
http://scarybearsoftware.com/news/malware-persistence/
http://scarybearsoftware.com/news/malware-persistence-2/
http://scarybearsoftware.com/news/malware-persistence-3/

MrBrian · Nov 20, 2014

Another one: POWELIKS Levels Up With New Autostart Mechanism.

Hat tip: member Simplicity.

MrBrian · Nov 24, 2014

From Persist It: Using and Abusing Microsoft's Fix It Patches:

Microsoft has often used Fix It patches, which are a subset of Application Compatibility Fixes, as a way to stop newly identified active exploitation methods against their products. A common Fix It patch type used to prevent exploitation is the previously undocumented In Memory Fix It. This research first focuses on analyzing these in-memory patches. By extracting information from them researchers are able to better understand the vulnerabilities that Microsoft intended to patch. The research then focuses on reverse engineering the patches and using this information to provide the ability to create patches which can be used to maintain persistence on a system.
Click to expand...

Log in or Sign up

Stealthy malware persistence mechanisms

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Log in or Sign up

Stealthy malware persistence mechanisms

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

MrBrian Registered Member

Useful Searches