Les virus et autres codes malveillants recouvrent une realite bien plus complexe qu'il n'y parait. De nombreuses sous-categories existent, avec de nombreuses techniques virales et des risques differents, a connaitre pour une protection et une lutte efficaces. Dans cet article, les virus sont presentes dans le contexte general, et plus realiste aujourd'hui, des infections informatiques. Dans une premiere partie, toutes les varietes existant pour ces programmes et leur fonctionnement sont expliques en detail, avec leurs techniques d'adaptation aux defenses. Dans une deuxieme partie, seront exposees les techniques de lutte antivirale utilisees de nos jours. Ces techniques ne suppriment pas tous les risques et ne peuvent que les reduire. Il est donc essentiel de ne pas faire reposer une politique de lutte antivirale sur la seule mise en œuvre d'un antivirus. Ainsi les principales regles, tres efficaces lorsque strictement observees, qui doivent, en amont de l'antivirus, etre appliquees sont presentees en conclusion.

In the domain of web security, websites strive to prevent themselves from data gathering performed by automatic programs called bots. In that way, crawler traps are an efficient brake against this kind of programs. By creating similar pages or random content dynamically, crawler traps give fake information to the bot and resulting by wasting time and resources. Nowadays, there is no available bots able to detect the presence of a crawler trap. Our aim was to find a generic solution to escape any type of crawler trap. Since the random generation is potentially endless, the only way to perform crawler trap detection is on the fly. Using machine learning, it is possible to compute the comparison between datasets of webpages extracted from regular websites from those generated by crawler traps. Since machine learning requires to use distances, we designed our system using information theory. We considered widely used distances compared to a new one designed to take into account heterogeneous data. Indeed, two pages does not have necessary the same words and it is operationally impossible to know all possible words by advance. To solve our problematic, our new distance compares two webpages and the results showed that our distance is more accurate than other tested distances. By extension, we can say that our distance has a much larger potential range than just crawler traps detection. This opens many new possibilities in the scope of data classification and data mining.

Many developers try to protect their creations (malware, video games, etc...) from different methods of analysis, first by detecting or avoiding them. To achieve this, they use a wide variety of techniques from exploiting flaws in analysis tools through code obfuscation (self-modifying code, for instance) to the use of documented API (IsDebuggerPresent). Most of the time these methods only work on one kind of tool and they fail to treat all of them at the same time. Countermeasures of the detection methods could consist in fixing the bug exploited in the analysis tool or directly modifying results returned by API calls or handling self-modifying code in a smart way. But all of these detection methods have countermeasures which leads to a never-ending war between detection and fooling detection. The aim of this paper is to propose a new technique of detection which is supposed to handle different types of analysis environment by exploiting uncovered properties from CPU. In this paper, we will describe a new method to protect software from dynamic analysis. This method works by detecting anomalies in the execution flow of a given thread based on on the actualization of the CPU’s cache. As a direct consequence, we can detect debuggers, Dynamic Binary Instrumentation (DBI) framework as well as virtual machines (VM). Without using dedicated exploits or specific flaws, our method is generic enough to be the same for each analysis environment which is detected since it is based on properties from the hardware on which it is executed. In addition, it does need neither any admin rights nor ring 0 accesses. Implementation of our method fits in dozens of assembler instructions, following operational requirements for offensive shellcodes. Indeed, it exploits some uncovered properties of the CPU’s cache from AMD and Intel CPU vendors. After having precisely detailed the operation of the algorithm we use and what kind of events are detected in each case, we will present at limits and different ways to use it.

In order to perform their goals without being detected, Malware should have a battle of wits with the analyzer. Such a way, they use a large variety of stealth methods to perform their missions. These methods allow to slow or block analysis. Most of the time, these tricks are often operating system or CPU oriented (dll injection, exception handler or API abuse). In addition, they are although focused on the most used analyst tools. These attacks, allow, among other things, to display erroneous information on the analysis tools or to silently detect it so that the malware can change its behavior in case of analysis. Depending of the degree of error of the analyzing tools used, it could become partially or totally ineffective. More than just flowed malware analysts, it is a great drawback in order to find bugs in regular software. In this article, we show how to exploits errors inside debuggers and mainly inside one of the most use: Windbg. This list of errors impacting this Microsoft’s tool mainly concerns few flaws in the disassembly engine or in the debug procedure. Some are present in the debugger from years... More directly, we show different ways to block or disturb the normal behaviour of Windbg. Thus, even if these errors are not always critical, they can negatively impact the use of software by any user. For instance, we describe a new way to know if the current process is running under the control of Windbg. This is exactly what malware author are looking for to detect analysis. Due to the complexity of architecture such as x64 and x86, it is hard to design and develop a complete disassembling tool. In fact, no disassembling tool is perfect and most of those we tested have at least one of the flaws which are shown in this article. Among the different flaws, we have int 3 misinterpretation, wrong jump interpretation, partial instruction prefix handling and unsupported instruction. Moreover, nothing prevents these tools to have other kind of errors. Thus, in order to analyze software efficiently, it is necessary to improve the analyzer tools. In this way, we offer different solution to correct the bug we encounter on the different tools.

The cyber world is plagued with ever-evolving malware that readily infiltrate all defense mechanisms, operate viciously unbeknownst to the user, and surreptitiously exfiltrate sensitive data. Understanding the inner workings of such malware provides a leverage to effectively combat them. This understanding is pursued often through dynamic analysis which is conducted manually or automatically. Malware authors accordingly, have devised and advanced evasion techniques to thwart or evade these analyses. In this article, we present a comprehensive survey on malware dynamic analysis evasion techniques. In addition, we propose a detailed classification of these techniques and further demonstrate how their efficacy holds against different types of detection and analysis approaches. Our observations attest that evasive behavior is mostly concerned with detecting and evading sandboxes. The primary tactic of such malware we argue is fingerprinting followed by new trends for reverse Turing test tactic which aims at detecting human interaction. Furthermore, we will posit that the current defensive strategies, beginning with reactive methods to endeavors for more transparent analysis systems, are readily foiled by zero-day fingerprinting techniques or other evasion tactics such as stalling. Accordingly, we would recommend the pursuit of more generic defensive strategies with an emphasis on path exploration techniques that has the potential to thwart all the evasive tactics.

Since Windows Vista, Microsoft has offered us a new life companion called SysMain or Superfetch from its old name. This is a service which analyzes and records the user daily software use to increase the speed of his or her experience on the operating system. However, this service provides the opportunity to track software used and private files seen such as movies or confidential files, reveal his or her lifetime activities and map directories. More than just a privacy issue, this constitutes a reliable approach in forensic analysis. Furthermore, this service is often misunderstood due to its little documentation and myths surrounding it, which makes things soon complicated to investigate. This paper is an extended version of the talk presented at Black Hat USA 2020: it aims at debunking partial and fake news about SysMain and its files. This paper will examine in detail its architecture, analyze its mechanisms and explain its operating method. It will detail the format of all the prefetch files which has been undocumented or obsolete so far. In addition, this paper will illustrate forensic concrete cases in which SysMain turns out to be useful.

While powerful techniques enable to perform efficient forensics and police activities, more or less soon legal aspects limit the capacity for technical action. Aside the fact that what is technically feasible may be legally forbidden, from the judge's point of view, the evidence must be admissible and therefore comply with a rigorous legal framework. Moreover the forensics expert or the criminal investigator must not put himself in danger. In this paper, we are addressing the case of criminal investigation and surveillance over the Darknet. In this parallel network, a lot of criminal activities are conducted and most the time the fact to collect evidences might be considered as itself criminal. We could mention the particular case of child pornography among many others. We have designed an architecture that enables anyone to take part in the surveillance and criminal investigations over the Darknet while complying with all the known legal constraints. Our tools also succeed in bypassing several securities deployed on websites or hidden services such as banishment by IP address or crawler traps.

Whenever a bug occurs in a program, software developers assume that the code is flawed, not the compiler. In fact, if compilers should be correct, they are just normal software with their own bugs. Hard to find, errors in them have significant impact, since it could result to vulnerabilities, especially when they silently miscompile a critical application. Using assembly language to write such software is quite common, especially when time constraint is involved in such program. This paper exposes a bug found in Microsoft Macro Assembler (ml for short) compiler, developed by Microsoft since 1981. This assembly has the characteristics to get high level-like constructs and high level-like records which help the developer to write assembly code. It is in the management of one of this level-like construct the bug has been found. This study aims to show how a compiler-bug can be audited and possibly corrected. For application developers, it shows that even old and mature compilers can present bugs. For security researcher, it shows possibilities to hide some unexpected behavior in software with a clear and officially non-bogus code. It highlights opportunities for including stealth backdoors even in open-source software.

In the context of the OpenDAVFI project (a fork of the French initiative DAVFI for giving birth to a new generation, open antivirus engine which has been funded by the French Government), different AV filters have been developped and chained to detect both known and unknown malware very accurately while requiring a very limited number of updates. While most AV software use different static and dynamic detection techniques which are mostly based on the general concept of (static or heuristic) signature, we have observed that many malware do not comply to the Microsoft specifications with respect to the MZ-PE format. In this technical correspondence, we present structural analysis tests which have been implemented in the DAVFI/OpenDAVFi project. These tests accurately detect malware and therefore greatly reduce the number of malware that have to be analyzed by subsequent modules in our detection chain.

In the context of the DAVFI National research Project, we have designed a heuristic algorithm which is able to detect both known and unknown malware (binary executable files) very accurately while requiring a very limited number of updates. Our method is based on an original approach which mostly use supervised learning algorithms when considering vectors built with relevant information extracted from binary executable files (Import Address Table [IAT] and Export Address Table [EAT]). Our heuristic module is designed to detect both unknown malware and known malware. The overall performance gives a true positive rate of at least 96 % and false positive rate of less than 4 % (with respect to truly unknown malware). Moreover, our module is chained with other modules (classical black listing techniques, combinatorial detection module.) and the overall performances yields a true positive rate of 99 % with a false positive rate which tends towards 0.

Nowadays, more and more companies have to use databases in which they store their essential or confidential data for the society like client lists, product specifications, stock situations, etc.. Such pieces of data are the heart of a company and have to be protected. In fact, in the context of economic intelligence, getting such information is quite interesting for competitors who want to know how rival companies work for example. Databases need software to be managed. There is a variety of software, called database management system, which is able to manage database like MySQL, Oracle Database, Microsoft Access, etc... This paper will focus on Microsoft Access 2010 64 bits which is part of the Microsoft Office 2010 suite. Microsoft Access is currently used by small and medium enterprises (SMEs) who have subcontracted the creation of their database to specialized companies. SMEs represent a huge part of the economic area and could be an interesting target because of the large range of activities it gather. This technical paper analyses the Access Security and explains how an attacker could hijack an Access database in order to steal information or to perform malicious actions on the targeted computer. It deals with macro-viruses, still present after many years, and give then the possibility to use them to insert major security weaknesses into Access databases.