藍隊新曙光 - 以語意感知之的啟發式符號引擎挫敗在野勒索軟體
Blue Teams and anyone on the defensive side face various challenges when it comes to reverse engineering suspected malware or ransomware binaries, especially ones with obfuscation techniques such as variants, embedded exploits and complex ransomware. First, identifying whether the sample is even worth the effort (what makes it unique/challenging/new), and second, choosing either static, dynamic analysis, or both! With static analysis, you give up the ability to detect obfuscated malicious programs only visible during run-time, and dynamic analysis is both labor and time intensive, and requires a high-degree of skill and experience, not to mention the threat of the binary escaping your sandbox emulation or virtualization environment.
We believe there may be a new tool in the Blue Team’s toolbox, through the use of a symbolic execution engine to detect and analyze suspected malware/ransomware binaries. A practical symbolic engine can help by parsing through many of the possible execution paths of the binary, and having these pathways represented as symbols. This engine can help provide malicious execution paths analysis with relatively low computing resources, analyze contextual relationships based on instruction semantics, taint and fuzzy identification of obfuscated APIs.
Using our practical symbolic engine based on the combination and improvement of academic and practical research, you can identify and detect various exploit, techniques, and multiple malware/ransomware variants via symbolic signature attack techniques and ransomware behaviors in a fully static situation. Even if the malware binary is obfuscated, we can still statically analyze it and detect it effectively.
ShengHao Ma
馬聖豪（ShengHao Ma, @aaaddress1）目前於 TXOne Networks 擔任資安威脅研究員，專研 Windows 逆向工程分析超過十年經驗，熱愛 x86、漏洞技巧、編譯器實務、與作業系統原理。 此外，他目前為台灣資安社群 CHROOT 成員。並曾任 DEFCON、HITB、BlackHat、VXCON、HITCON、ROOTCON、CYBERSEC 等各個國內外年會講者與授課培訓，並著有熱銷資安書籍《Windows APT Warfare：惡意程式前線作戰指南》
Hank Chen
Hank Chen 目前於 TXOne Networks擔任資安威脅研究員，專注於惡意程式分析、產品安全及漏洞挖掘。曾參加過多場國內外 CTF，目前亦參與 10sec 和 TSJ 戰隊，主要擅長項目為Crypto, Reverse 和 Pwn，曾於 Black Hat USA, FIRST, CYBERSEC 等國際資安會議分享各式研究
Mars Cheng
Mars Cheng 目前為 TXOne Networks 產品資安事件應變暨威脅研究團隊經理，負責協調產品安全與威脅研究事宜。 過去曾於行政院國家資通安全會報技術服務中心（NCCST）擔任資安工程師，負責物聯網設備與工業控制環境之安全研析，強化政府機關與關鍵基礎設施資安防護能量。Mars 經常在國際資安會議中發表演講與授課培訓，這些會議包括 Black Hat、RSA Conference、DEFCON、FIRST、HITB、HITCON、SecTor、SINCON、ICS Cyber Security Conference Asia and USA、CYBERSEC、CLOUDSEC、VXCON 及 InfoSec Taiwan 等。並致力於分享各類型資安知識，於資安卓越中心（CCoE）計畫、國防部、經濟部、教育部、HITCON Training 及多間民間企業均有授課經驗。同時專注於ICS/SCADA、IoT 及企業網絡安全的相關資安議題研究，至今提交了10多個 CVE 編號，並於三本 SCI 期刊中（JCR Ranking Top 20%）發表與應用密碼學相關之論文。此外，Mars 同時還是台灣駭客年會 HITCON 2022 的總召集人，也曾擔任 HITCON 2021 的總召集人與 2020 的副總召集人。