Bugger The Debugger
- Pre Interaction Debugger Code Execution
The use of debuggers to analyse malicious or otherwise unknown binaries
has become a requirement for reverse engineering executables to help
determine their purpose.
While researchers in places such as anti-virus laboratories have always
done this, with the availability of free and easy to use debuggers it has
also become popular with corporate security officers and home users.
One of the main purposes of a debugger is to allow the user to control
the execution of a binary in such a way as to determine what instructions
or commands the binary is executing. During malware analysis the user
can modify what the binary is trying to execute, or prevent it all together.
This paper will demonstrate methods that may be used by malware to
execute code, simply by being loaded into a debugging session.
The paper can be downloaded from the whitepapers section of our website.
http://www.security-assessment.com
Brett Moore
Network Intrusion Specialist, CTO
Security-Assessment.com
######################################################################
CONFIDENTIALITY NOTICE:
This message and any attachment(s) are confidential and proprietary.
They may also be privileged or otherwise protected from disclosure. If
you are not the intended recipient, advise the sender and delete this
message and any attachment from your system. If you are not the
intended recipient, you are not authorised to use or copy this message
or attachment or disclose the contents to any other person. Views
expressed are not necessarily endorsed by Security-Assessment.com
Limited. Please note that this communication does not designate an
information system for the purposes of the New Zealand Electronic
Transactions Act 2003.
######################################################################
--
NTBugtraq Editor's Note:
Most viruses these days use spoofed email addresses. As such, using an
Anti-Virus product which automatically notifies the perceived sender of a
message it believes is infected may well cause more harm than good. Someone who
did not actually send you a virus may receive the notification and scramble
their support staff to find an infection which never existed in the first
place. Suggest such notifications be disabled by whomever is responsible for
your AV, or at least that the idea is considered.
--
