Date of Publication :7th July 2015

Abstract: Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. Nowadays malwares are becoming increasingly stealthy, most of malwares are using cryptographic algorithms to protect themselves from being analyzed. The use of cryptographic algorithms and truly transient cryptographic secrets inside the malware binary imposes a key obstacle to effective malware analysis and defense. CipherXRay is a novel binary analysis framework that can be used for effective malware analysis and defense. It can automatically identify and recover the cryptographic operations and transient secrets from the execution of potentially obfuscated binary executables. CipherXRay is based on the avalanche effect, which is a desirable property of cryptographic functions. The avalanche effect means that, a slight change in the input causes a significant change in the output, ie flipping a single bit in the input changes half of the output bits. Another feature of the avalanche effect is that it allows us to accurately pinpoint the location, size and boundary of both the input and output buffers. Using avalanche effect, CipherXRay is able to accurately pinpoint the boundary of cryptographic operation and recover truly transient cryptographic secrets that only exist in memory for one instant in between multiple nested cryptographic operations.

Reference :