Evading Identification and Detection by Messing with Binary Formats

No ratings

Presented at 44Con 2013 by

Ange Albertini

Malwares and exploits rely on many different file formats. It’s critical for security softwares to accurately identify and parse them, and ideally tell if they are corrupted, clean or malicious. Some formats can sadly be combined, making it possible to create files that evade filtering or detection. Moreover, the gap between the documentation and the possible implementations leave room for valid files to entirely evade detection.