Detecting Malicious Documentations

No ratings

Presented at NinjaCon 2010 by

Nowadays, people are well-aware of malware in executable format such as EXE, and they can protect themselves with defense solutions such as anti-virus (AV). However, modern threats come from malicious files such as PDF, DOC, PPT, XLS, etc... The attacker can embed malware into any type of electronic documentations, and the victim will get exploited once he opens these files with unpatched, vulnerable applications. Unfortunately, this attack vector is increasingly popular, and it is extremely hard to know if a documentation is poisonous, especially if the attacker uses 0-day bugs. The situation is even more frustrated because current AV softwares badly fail against this upcoming malware. This paper presents a novel tool named D-Analyzer to detect malicious documentations. Using tainting analysis method, our tool is able to identify all the nasty files trying to exploit vulnerable applications. D-Analyzer supports all kind of documentation, regardless the file types. Obviously, our tool can also detect 0-day attack, with zero false positive. The presentation includes some demos, so the audience can see how D-Analyzer really works.