TY - GEN
T1 - Leave it to Weaver
AU - Mahoney, William
AU - Franco, Joseph
AU - Hoff, Greg
AU - McDonald, J. Todd
N1 - Funding Information:
This work is partially funded by National Science Foundation awards 1811560 and 1811578 in the NSF 17-576 Secure and Trustworthy Cyberspace (SaTC) program.
Publisher Copyright:
© 2018 Association for Computing Machinery.
PY - 2018/12/3
Y1 - 2018/12/3
N2 - Malware authors make use of several techniques to obfuscate code from reverse engineering tools such as IdaPro. Typically, these techniques tend to be effective for about three to six instructions, but eventually the tools can properly disassemble the remaining code once the tool is again synchronized with the operation codes. But this loss of synchronization can be used to hide information within the instructions – steganography. Our research explores an approach to this by presenting “Weaver”, a framework for executable steganography. “Weaver” differs from other techniques in how it hides malicious instructions: the hiding instructions are prepared by generating an assembly listing of the program and finding candidate hiding locations, the steganography instructions are prepared by creating an assembly listing of the program to obtain the operation codes to be hidden, and the “weaving” process merges the two. This “weaving” attempts to place all the steganography instructions into candidate locations found in the hiding instructions.
AB - Malware authors make use of several techniques to obfuscate code from reverse engineering tools such as IdaPro. Typically, these techniques tend to be effective for about three to six instructions, but eventually the tools can properly disassemble the remaining code once the tool is again synchronized with the operation codes. But this loss of synchronization can be used to hide information within the instructions – steganography. Our research explores an approach to this by presenting “Weaver”, a framework for executable steganography. “Weaver” differs from other techniques in how it hides malicious instructions: the hiding instructions are prepared by generating an assembly listing of the program and finding candidate hiding locations, the steganography instructions are prepared by creating an assembly listing of the program to obtain the operation codes to be hidden, and the “weaving” process merges the two. This “weaving” attempts to place all the steganography instructions into candidate locations found in the hiding instructions.
KW - Information retrieval
KW - Reverse engineering
KW - Steganography
UR - http://www.scopus.com/inward/record.url?scp=85059910230&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85059910230&partnerID=8YFLogxK
U2 - 10.1145/3289239.3291459
DO - 10.1145/3289239.3291459
M3 - Conference contribution
AN - SCOPUS:85059910230
T3 - ACM International Conference Proceeding Series
BT - Proceedings of the 8th Software Security, Protection, and Reverse Engineering Workshop, SSPREW 2018
PB - Association for Computing Machinery
T2 - 8th Software Security, Protection, and Reverse Engineering Workshop, SSPREW 2018
Y2 - 3 December 2018 through 4 December 2018
ER -