FCReducer: Locating Symmetric Cryptographic Functions on the Memory

Ryoya FURUKAWA; Ryoichi ISAWA; Masakatu MORII; Daisuke INOUE; Koji NAKAO

doi:10.1587/transinf.2017EDP7143

FCReducer: Locating Symmetric Cryptographic Functions on the Memory

Ryoya FURUKAWA, Ryoichi ISAWA, Masakatu MORII, Daisuke INOUE, Koji NAKAO

Full Text Views

0

Share
Cite this

Summary :

Malicious software (malware) poses various significant challenges. One is the need to retrieve plain-text messages transmitted between malware and herders through an encrypted network channel. Those messages (e.g., commands for malware) can be a useful hint to reveal their malicious activities. However, the retrieving is challenging even if the malware is executed on an analysis computer. To assist analysts in retrieving the plain-text from the memory, this paper presents FCReducer(Function Candidate Reducer), which provides a small candidate set of cryptographic functions called by malware. Given this set, an analyst checks candidates to locate cryptographic functions. If the decryption function is found, she then obtains its output as the plain-text. Although existing systems such as CipherXRay have been proposed to locate cryptographic functions, they heavily rely on fine-grained dynamic taint analysis (DTA). This makes them weak against under-tainting, which means failure of tracking data propagation. To overcome under-tainting, FCReducer conducts coarse-grained DTA and generates a typical data dependency graph of functions in which the root function accesses an encrypted message. This does not require fine-grained DTA. FCReducer then applies a community detection method such as InfoMap to the graph for detecting a community of functions that plays a role in decryption or encryption. The functions in this community are provided as candidates. With experiments using 12 samples including four malware specimens, we confirmed that FCReducer reduced, for example, 4830 functions called by Zeus malware to 0.87% as candidates. We also propose a heuristic to reduce candidates more greatly.

Publication: IEICE TRANSACTIONS on Information Vol.E101-D No.3 pp.685-697

Publication Date: 2018/03/01

Publicized: 2017/12/14

Online ISSN: 1745-1361

DOI: 10.1587/transinf.2017EDP7143

Type of Manuscript: PAPER

Category: Information Network

Authors

Ryoya FURUKAWA
  PwC Cyber Services LLC,Kobe University
Ryoichi ISAWA
  National Institute of Information and Communications Technology
Masakatu MORII
  Kobe University
Daisuke INOUE
  National Institute of Information and Communications Technology
Koji NAKAO
  National Institute of Information and Communications Technology

Keyword

malware, dynamic taint analysis, binary analysis, sandbox, community detection

Cite this

Copy

Ryoya FURUKAWA, Ryoichi ISAWA, Masakatu MORII, Daisuke INOUE, Koji NAKAO, "FCReducer: Locating Symmetric Cryptographic Functions on the Memory" in IEICE TRANSACTIONS on Information, vol. E101-D, no. 3, pp. 685-697, March 2018, doi: 10.1587/transinf.2017EDP7143.
Abstract: Malicious software (malware) poses various significant challenges. One is the need to retrieve plain-text messages transmitted between malware and herders through an encrypted network channel. Those messages (e.g., commands for malware) can be a useful hint to reveal their malicious activities. However, the retrieving is challenging even if the malware is executed on an analysis computer. To assist analysts in retrieving the plain-text from the memory, this paper presents FCReducer(Function Candidate Reducer), which provides a small candidate set of cryptographic functions called by malware. Given this set, an analyst checks candidates to locate cryptographic functions. If the decryption function is found, she then obtains its output as the plain-text. Although existing systems such as CipherXRay have been proposed to locate cryptographic functions, they heavily rely on fine-grained dynamic taint analysis (DTA). This makes them weak against under-tainting, which means failure of tracking data propagation. To overcome under-tainting, FCReducer conducts coarse-grained DTA and generates a typical data dependency graph of functions in which the root function accesses an encrypted message. This does not require fine-grained DTA. FCReducer then applies a community detection method such as InfoMap to the graph for detecting a community of functions that plays a role in decryption or encryption. The functions in this community are provided as candidates. With experiments using 12 samples including four malware specimens, we confirmed that FCReducer reduced, for example, 4830 functions called by Zeus malware to 0.87% as candidates. We also propose a heuristic to reduce candidates more greatly.
URL: https://globals.ieice.org/en_transactions/information/10.1587/transinf.2017EDP7143/_p

Copy

@ARTICLE{e101-d_3_685,
author={Ryoya FURUKAWA, Ryoichi ISAWA, Masakatu MORII, Daisuke INOUE, Koji NAKAO, },
journal={IEICE TRANSACTIONS on Information},
title={FCReducer: Locating Symmetric Cryptographic Functions on the Memory},
year={2018},
volume={E101-D},
number={3},
pages={685-697},
abstract={Malicious software (malware) poses various significant challenges. One is the need to retrieve plain-text messages transmitted between malware and herders through an encrypted network channel. Those messages (e.g., commands for malware) can be a useful hint to reveal their malicious activities. However, the retrieving is challenging even if the malware is executed on an analysis computer. To assist analysts in retrieving the plain-text from the memory, this paper presents FCReducer(Function Candidate Reducer), which provides a small candidate set of cryptographic functions called by malware. Given this set, an analyst checks candidates to locate cryptographic functions. If the decryption function is found, she then obtains its output as the plain-text. Although existing systems such as CipherXRay have been proposed to locate cryptographic functions, they heavily rely on fine-grained dynamic taint analysis (DTA). This makes them weak against under-tainting, which means failure of tracking data propagation. To overcome under-tainting, FCReducer conducts coarse-grained DTA and generates a typical data dependency graph of functions in which the root function accesses an encrypted message. This does not require fine-grained DTA. FCReducer then applies a community detection method such as InfoMap to the graph for detecting a community of functions that plays a role in decryption or encryption. The functions in this community are provided as candidates. With experiments using 12 samples including four malware specimens, we confirmed that FCReducer reduced, for example, 4830 functions called by Zeus malware to 0.87% as candidates. We also propose a heuristic to reduce candidates more greatly.},
keywords={},
doi={10.1587/transinf.2017EDP7143},
ISSN={1745-1361},
month={March},}

Copy

TY - JOUR
TI - FCReducer: Locating Symmetric Cryptographic Functions on the Memory
T2 - IEICE TRANSACTIONS on Information
SP - 685
EP - 697
AU - Ryoya FURUKAWA
AU - Ryoichi ISAWA
AU - Masakatu MORII
AU - Daisuke INOUE
AU - Koji NAKAO
PY - 2018
DO - 10.1587/transinf.2017EDP7143
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E101-D
IS - 3
JA - IEICE TRANSACTIONS on Information
Y1 - March 2018
AB - Malicious software (malware) poses various significant challenges. One is the need to retrieve plain-text messages transmitted between malware and herders through an encrypted network channel. Those messages (e.g., commands for malware) can be a useful hint to reveal their malicious activities. However, the retrieving is challenging even if the malware is executed on an analysis computer. To assist analysts in retrieving the plain-text from the memory, this paper presents FCReducer(Function Candidate Reducer), which provides a small candidate set of cryptographic functions called by malware. Given this set, an analyst checks candidates to locate cryptographic functions. If the decryption function is found, she then obtains its output as the plain-text. Although existing systems such as CipherXRay have been proposed to locate cryptographic functions, they heavily rely on fine-grained dynamic taint analysis (DTA). This makes them weak against under-tainting, which means failure of tracking data propagation. To overcome under-tainting, FCReducer conducts coarse-grained DTA and generates a typical data dependency graph of functions in which the root function accesses an encrypted message. This does not require fine-grained DTA. FCReducer then applies a community detection method such as InfoMap to the graph for detecting a community of functions that plays a role in decryption or encryption. The functions in this community are provided as candidates. With experiments using 12 samples including four malware specimens, we confirmed that FCReducer reduced, for example, 4830 functions called by Zeus malware to 0.87% as candidates. We also propose a heuristic to reduce candidates more greatly.
ER -