Mutating the Mutators
Sean O'Toole explores mutating the mutators at DEF CON 12, examining malware-analysis and practical defenses.
Summary
Architecture and Background
Sean O'Toole, Mutating the Mutators Since the introduction of metamorphic stealth in the computer virus world, it has been suggested that the method can also be used to protect any, even legitimate, code. The only downfall of this technique is that how the engine manipulates the code remains constant.
Vulnerability Analysis
This allows the original code to be obtained by using an optimizer. The next step for this stealth method is to create an engine that will change how the code in manipulated.
Exploitation and Demonstrations
This speech will outline how to create an engine that integrates random code with alternate encoding of an instruction to create a semi-random set of instructions, which will fit into the metamorphic engine paradigm. Sean O'Toole is fresh out of college for Computer Science and Mathematics.
Remediation and Defensive Strategies
He has been playing around with viruses since high school and had also taken independent studies on computer viruses in college. As well as the above, he also helped institutions such as NCAR use Artificial Life Algorithms for modeling.
Related talks
Main Stage·42 min
Rakan El-Khalil
Rakan El-Khalil explores information hiding in executable binaries at DEF CON 12, examining malware-analysis and practical defenses.
Main Stage·39 min
Agostino Panico
Presents a dynamic analysis framework for automatically unpacking and deobfuscating nested virtual-machine-based software protectors used in advanced malware.
Main Stage·21 min
Patrick Wardle
Patrick Wardle presents specialized reverse engineering techniques and tooling to automatically extract obfuscated AppleScript and shell payloads from macOS malware.