SWF and the Malware Tragedy

Auf der CCC Webseite ist die Zusammenfassung zu finden.

Some shout outs:
Nocolas Cannasse
Mark Dowd
Ben Kurtz
Stefano di Paola
Jose Nazario

Flash is hard to analyse and so vulnerabilities are hard to detect. AS3 wird bisher noch nicht übermäßig genutzt!

For analysis you have to run the Flash file ;)

Analysis Methodes:

• Search for known paterns
• Search for opcode ocurrence (has the Flash banner to load ext. URLs?)
• Search for format inconsistencies (strings too short)
• Count occurrences of functions and tags
• probability of variable names (nextid is more likely than n3k2hf7

Tools: Live PoC Scanner, erlswf

erlswf
Wenige False negatives, wesentlich mehr false positives!
Deconstructs and analyzes SWF
Focus: SWFn+AS2 bytecode+ABC bytecode