Conference Presentation, Lecture
Giovanni Vigna
- The speaker serves as a Professor at UC Santa Barbara and the CTO of LastLine, a malware detection company co-founded with colleagues Christopher Kruegel and Ange Kurta following the open-source release of their advanced binary analysis system, Anubis.
- The speaker's DEF CON hacking team, "Shellfish," holds the record as the longest-running capture-the-flag team and recently received $750,000 in funding from DARPA's Autonomous Cyber Challenge, making it the wealthiest CTF team in history.
- Threat strategies have shifted from remote network attacks to "drive-by downloads" that bypass perimeter defenses like firewalls and intrusion detection systems.
- Malware monetization has evolved from opportunistic botnet attacks targeting mass volumes to targeted attacks designed to steal high-value specific information, such as stock market data.
- Security efforts have increasingly forced attackers to pivot from hacking computers to targeting users via social engineering, as hardware and operating system protections have become more robust.
- The fundamental challenge in security is the presence of a smart, adaptive human opponent who actively counters defenses, unlike static algorithmic problems where the target does not evolve.
- A historical pattern in the arms race includes the progression from signature-based antivirus to polymorphic viruses, then to sandbox-based detection, and finally to evasive malicious binaries.
- Evasive malware employs environmental fingerprinting to detect sandboxes; specific examples include checking for non-standard usernames (e.g., "Andy Moser") or utilizing timing delays (stalling loops) to bypass dynamic analysis windows.
- The speaker notes that Volkswagen utilized similar evasion techniques to detect emission testing environments and suppress engine output accordingly.
- Recent research into Android applications revealed backdoors that allow apps to bypass market security checks before installing malicious code.
- A study on antivirus response times using VirusTotal indicates that only approximately 50% of current antiviruses detect new samples on the first day.
- Detection rates typically improve significantly around two weeks after a sample's appearance, corresponding to the time required for human analysts to generate new signatures.
- LastLine's proprietary approach utilizes full system emulation to analyze every instruction, providing deeper visibility than traditional sandboxes that only capture privileged events.
- This fine-grained visibility allows for the detection of in-memory loops and stalling mechanisms that traditional tools miss because they do not invoke sensitive API calls.
- Effective security strategy requires making countermeasures costly for the adversary, forcing them to restructure code, infrastructure, or monetization methods rather than making trivial adjustments.
- The speaker asserts that a "final solution" for security is theoretically impossible due to the Halting Problem, meaning detection will always rely on heuristics and the ability to identify evasion behaviors as detection signals.
- The overarching philosophy is to evolve countermeasures continuously to limit the maneuvering space for attackers, using evidence of evasion itself as a primary indicator of malicious intent.