Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New powerful malware obfuscation technique

ieeexplore.ieee.org

Post reply on HN
Print view View original

11–18 of 18 posts

Re: New powerful malware obfuscation technique

#11

Post by ackbar03 »

petercooper wrote: post #7

Pretending to be a user is a good way around some anti cheat systems as well. The computer game FIFA has an online marketplace where you can buy and sell players, and a lot of people write Chrome extensions (or Puppeteer bots) to "script" hotkeys or create sniping bots, but since EA track you constantly, they can figure it out eventually. Instead, I wrote some code to control the mouse and keyboard with cliclick ( ht…

Yeah this is highly prevalent in the game botting industry. A lot of games these days have detection mechanisms if you access memory directly and change anything, or hook their functions. A friend of mine tried to drag me into game botting/farming before, and the supply chain is extremely well developed and professional, I was really surprised.

That being said, I've never written a complete game automation script before because it's a serious pain, it's essentially a super long series of rule based clicking. Is this the same case for your script? Or is there some easier trick? In China you can purchase game automations written by authors through a platform on a weekly subscription basis. It's technically illegal and you often hear stories of police busting some workshop whose been making millions of rmb a year off of them

Re: New powerful malware obfuscation technique

#13

Post by gruez »

siggen wrote: post #8

The paper doesn’t mention how an elevated token was acquired. You cannot run bcdedit without privileges. Not all users will have privileges to do this.

Yeah this "technique" is a case of being on the other side of this airtight hatchway[1]. If you had the privilege to pull this off, you also can install a kernel rootkit that does the same thing. This technique is probably very easy to detect by antivirus, as it involves several weird operations.

[1] https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

Re: New powerful malware obfuscation technique

#14

Post by petercooper »

ackbar03 wrote: post #11
petercooper wrote: post #7

Pretending to be a user is a good way around some anti cheat systems as well. The computer game FIFA has an online marketplace where you can buy and sell players, and a lot of people write Chrome extensions (or Puppeteer bots) to "script" hotkeys or create sniping bots, but since EA track you constantly, they can figure it out eventually. Instead, I wrote some code to control the mouse and keyboard with cliclick ( ht…

Yeah this is highly prevalent in the game botting industry. A lot of games these days have detection mechanisms if you access memory directly and change anything, or hook their functions. A friend of mine tried to drag me into game botting/farming before, and the supply chain is extremely well developed and professional, I was really surprised. That being said, I've never written a complete game automation script bef…

Is this the same case for your script? Or is there some easier trick?

FIFA is a simplistic game at the trading level, so the answer is yes, it's lots of rule based clicking (based on things that do or don't appear on screen) but there's little nuance required. The main mechanism is just searching for underpriced cards over and over and buying them before someone else does.

I only do it for fun, I barely play the game, it's more a "because I can" side hobby to learn and play with technologies I want to try out.

Re: New powerful malware obfuscation technique

#15

Post by magicalhippo »

PhantomHacker wrote: post #10

I want to sum up the most important facts: I. An additional desktop will be created. The Windows Explorer (WE) will be opened on this desktop. Afterwards, the command will be inserted into its input box and confirmed for execution by sending corresponding Windows Messages. The victim will NOT see a CMD or any up popping window due to all these actions do not happened on the victim's current desktop. II. Phantom Malwa…

> An additional desktop will be created.

For those not familiar with Windows internals here's the documentation for the desktop[1] object.

In particular note the following:

"Window messages can be sent only between processes that are on the same desktop. In addition, the hook procedure of a process running on a particular desktop can only receive messages intended for windows created in the same desktop.

...

During the user's session, the system switches to the Winlogon desktop when the user presses the CTRL+ALT+DEL key sequence, or when the User Account Control (UAC) dialog box is open.

The Winlogon desktop's security descriptor allows access to a very restricted set of accounts, including the LocalSystem account. Applications generally do not carry any of these accounts' SIDs in their tokens and therefore cannot access the Winlogon desktop or switch to a different desktop while the Winlogon desktop is active."

Thus the exploit program shouldn't be able to press "Yes" on the UAC dialog. It seems the paper mentions this as well, but I didn't have time to study the rest of the paper to see how they overcome this to do interesting stuff.

[1]: https://docs.microsoft.com/en-us/windows/win32/winstation/de...

Re: New powerful malware obfuscation technique

#16

Post by MisterKeylogger »

gruez wrote: post #13
siggen wrote: post #8

The paper doesn’t mention how an elevated token was acquired. You cannot run bcdedit without privileges. Not all users will have privileges to do this.

Yeah this "technique" is a case of being on the other side of this airtight hatchway[1]. If you had the privilege to pull this off, you also can install a kernel rootkit that does the same thing. This technique is probably very easy to detect by antivirus, as it involves several weird operations. [1] https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...

The mentioned technique leads to an arbitrary code execution as trusted system user. The Windows Explorer process executes the malicious actions instead of the malware process. By default actions of this trusted system process will NOT be blocked or classified as malware.

Re: New powerful malware obfuscation technique

#17

Post by MisterKeylogger »

magicalhippo wrote: post #15
PhantomHacker wrote: post #10

I want to sum up the most important facts: I. An additional desktop will be created. The Windows Explorer (WE) will be opened on this desktop. Afterwards, the command will be inserted into its input box and confirmed for execution by sending corresponding Windows Messages. The victim will NOT see a CMD or any up popping window due to all these actions do not happened on the victim's current desktop. II. Phantom Malwa…

> An additional desktop will be created. For those not familiar with Windows internals here's the documentation for the desktop[1] object. In particular note the following: "Window messages can be sent only between processes that are on the same desktop. In addition, the hook procedure of a process running on a particular desktop can only receive messages intended for windows created in the same desktop. ... During t…

> Thus the exploit program shouldn't be able to press "Yes" on the UAC dialog.

This is correct!

Post reply on HN