Aviv Grafi & Amit Dori - Sandbox Evasion Using VBA Referencing

44 Pages·2017·1.31 MB·English

by  Amit Dori

REFERENCE THIS:
SANDBOX EVASION
USING VBA
REFERENCING
WHOAREWE
Amit Dori Aviv Grafi
Security Researcher, Votiro CEO, Votiro
•
• Graduate of Israeli Army’s elite
28 years old from Tel-Aviv.
8200 intelligence unit.
•
BSC in Computer Science, BA in •
Over 15 years of experience in
Psychology from TAU.
telecommunications and InfoSec.
• •
Formerly researched Exploit Kits at Inventor of Votiro’s enterprise
protection solutions.
Check Point.
•
BSC in Computer Science, BA in
•
Skate, swim, guitar.
economics, MBA from TAU.
•
Sushi, running, quiet walks along
the beach.
HITB Amsterdam 2018: 11.4 – 14.4
ABSTRACT
Sandbox had become a standard security solution in
organizations nowadays which makes it a prime target.
This talk will demonstrate a new way to perform sandbox
evasion.
In contrast to common evasion techniques, our technique
doesn’t require code execution to detect the sandbox
environment.
HITB Amsterdam 2018: 11.4 – 14.4
ABSTRACT
Evasion Detection
Sandbox Evasion techniques Sandbox-user Differences
VBA Referencing Server-Side Sandbox Detection
HITB Amsterdam 2018: 11.4 – 14.4
RELEVANT BACKGROUND
We assume familiarity with the following concepts:
1 2
VBA macros Office Protected View
3
4
Sandbox solutions
Tracking pixels
HITB Amsterdam 2018: 11.4 – 14.4
SANDBOX EVASION
With the introduction of the sandbox, malware
authors have introduced Sandbox Evasion.
The term is used to describe all the techniques
utilized to identify a sandbox, trick it, manipulate it
and evade it.
HITB Amsterdam 2018: 11.4 – 14.4
SANDBOX EVASION TECHNIQUES
Detect the sandbox: detect virtualization
Hypervisor, Virtualization DLLs, Side channels, unusual hardware
Detect the sandbox: Artificial Environment
Username, Cookies and browser history, recent file count, screen resolution,
Old vulnerabilities, Running processes
HITB Amsterdam 2018: 11.4 – 14.4
SANDBOX EVASION
HITB Amsterdam 2018: 11.4 – 14.4
SANDBOX EVASION TECHNIQUES
Evade the sandbox: Defeat the Monitor
Remove hooks, work around hooks, delay execution
Evade the sandbox: Context Aware
Require user interaction, check date and time-zone, encrypted payload
HITB Amsterdam 2018: 11.4 – 14.4
SANDBOX EVASION
All of the mentioned techniques, require code execution
(sandbox-side) in order to collect the data and analyze it.
As a result, most of these techniques can be identified by
static analysis tools which will flag the file as suspicious prior
to execution.
Furthermore, the actions executed to fingerprint the system
are flagged as evasion techniques - which immediately raise
a warning flag.
HITB Amsterdam 2018: 11.4 – 14.4