Making a state-backed implant invisible (introducing a new blind spot of modern A/V & HIDS solutions)

No ratings

Presented at BSidesAthens 2018 by

Dimitrios Bougioukas

This talk is about a cutting-edge A/V and HIDS evasion technique. Essentially, we will present a newly-discovered blind spot of modern endpoint security solutions, residing entirely in memory. More specifically, during the talk we will showcase how a RAM disk in conjunction with a PE loader, which loads PE files from disk (in this case a RAM disk), can be used to drop and execute any malicious executable (regardless of its A/V detection score), evading almost all endpoint security solutions. It should be noted, that during the talk we will touch the kernel land, since a kernel-level driver is involved in the process. Such a technique can also prove handy when dealing with closed-source malware whose A/V detection score is high, during the post-exploitation phase. To prove the effectiveness of our technique, we will perform a live demonstration, dropping and executing the recently leaked peddlecheap implant, designed by NSA itself, on a machine featuring an enterprise grade A/V and HIDS solution, without being detected.