Researcher's Tool Maps Malware In Elegant 3D Model

Sparrowvsrevolution writes "At the Shmoocon security conference later this month, Danny Quist plans to demo a new three-dimensional version of a tool he's created called Visualization of Executables for Reversing and Analysis, or VERA, that maps viruses' and worms' code into intuitively visible models. Quist, who teaches government and corporate students the art of reverse engineering at Los Alamos National Labs, says he hopes VERA will make the process of taking apart and understanding malware's functionality far easier. VERA observes malware running in a virtual sandbox and identifies the basic blocks of commands it executes. Then those chunks of instructions are color-coded by their function and linked by the order of the malware's operations, like a giant, 3D flow chart. Quist provides a sample video showing a model of a section of the Koobface worm."

Comments

3D visualisation

[Mannfred]

We rolled our eyes at Jurassic Park's representation of a "Unix system" back in 1993 (the directory hierarchy was basically a bunch of 3D boxes you could fly around), but here we are 20 years later looking at a code analyser which represents the information as.. a bunch of 3D boxes you can fly around :-)

Re:3D visualisation

[Rizimar]

Only that "representation" in Jurassic Park was an actual application called File System Navigator.

Re:3D visualisation

[Anonymous Coward]

We rolled our eyes at Jurassic Park's representation of a "Unix system" back in 1993 (the directory hierarchy was basically a bunch of 3D boxes you could fly around)

Then you may be surprised to learn that custom 3d interfaces like that are not (and were not) uncommon. Hammond is exactly the kind of rich intelligent fool that would want one. I've had the unfortunate experience of having to work on not one, but two vanity programs of this type. Think MS Bob, but in 3d.

The kid's "This is Unix!" exclamation makes a lot more sense once you realize this.

Re:3D visualisation

[dr_blurb]

There's an open source port called File System Visualizer.
Here are some (possibly outdated) compilation instructions.

Re:3D visualisation

[buchner.johannes]

We rolled our eyes at Jurassic Park's representation of a "Unix system" back in 1993 (the directory hierarchy was basically a bunch of 3D boxes you could fly around), but here we are 20 years later looking at a code analyser which represents the information as.. a bunch of 3D boxes you can fly around :-)

I know this!

Re:3D visualisation

[sourcerror]

This is the reason why when I first used Unix (Solaris) in a comp sci lab, I was pretty disappointed.

Re:3D visualisation

[Stenchwarrior]

Are you sure they didn't just hack the Gibson?

Re:3D visualisation

[thegarbz]

We rolled our eyes because it was 3D for 3D's sake. The interface was not intuitive and the information it provided wasn't immediately obvious or useful. Navigating an interface in 3D is often a horrendous and complicated waste.

Representing 3D information on the other hand is not. I use a utility very similar to the app used in Jurassic Park to identify what is taking up harddisk space. Instantly seeing the relative sizes of directories in 2D or 3D is much more intuitive than reading and comparing numbers on the screen.Just like the good old graph it all comes down to what information you can get out of the graphic.

A picture tells 1000 words, but it can also just be a garbage picture.

Groovy

[Anonymous Coward]

Funky map needs a legend.

More general tool?

[bughunter]

Interesting idea. It also looks like a potentially useful method for reverse engineering any code... not just trojans and worms.

Re:More general tool?

[vikingpower]

That is what I thought. Underpinning the whole of it by an easy-to-grasp and agreed-upon formalism ( the 3D equivalent of UML ? ) would be a next step, I presume.

Obligatory XKCD

[Anonymous Coward]

Here you go, as always xkcd is relevant: http://xkcd.com/350/

Re:Obligatory XKCD

[Anonymous Coward]

Here you go, as always xkcd is relevant: http://xkcd.com/350/

It also seems that XKCD got closer to a practical solution by flattening the display to 2D and using color to represent the 3rd+ dimension(s). Go XKCD.

expert programmers organically visualize...

[somethingtoremember]

... in their own heads, its what makes them expert programmers

Re:Looks like letters

[Anonymous Coward]

What operating system does this malware run on?

Looks useful for any code

[Omnifarious]

So much of modern software engineering is basically reverse engineering something someone else wrote who's no longer around. This could be an incredibly useful tool for just about anybody do software work.

Re:Looks useful for any code

[Anonymous Coward]

Until reverse engineering in any form gets made illegal at the behest of Hollywood, Microsoft and thousands of other companies.
I'm sure an ammendment to the DMCA won't be far away to specifically make it illegal and punishable by a long stretch in federal pokey.

Re:Looks useful for any code

[Anonymous Coward]

You can combat that with... wait for it... Free software.

Release the sourcecode for anything you write under whatever Free or Free-ish licensing model you choose. That's what I do and I get more value back in interested people writing plugins and improving my own code than I "lose" in releasing it in the first place.

Polymorphic code

[fa2k]

This will probably not work for polymorphic viruses that rewrite their own code to avoid detection.

Re:Polymorphic code

[TheLink]

Probably depends on how polymorphic they are. That said I've always wondered how these AV/Antimalware researchers and software would do in detecting malware written in perl- TIMTOWTDI and all that... ;)

FWIW I personally think that malware detection is the wrong approach for protecting against malware.

Because in theory the problem of malware detection is actually harder than solving the "halting problem" (which in theory is impossible).

Think about it the halting problem can be stated as follows (from wiki):

Given a description of a computer program, decide whether the program finishes running or continues to run forever. This is equivalent to the problem of deciding, given a program and an input, whether the program will eventually halt when run with that input, or will run forever.

The malware detection problem is:

Given a computer program without a description, without the full inputs (or possibly even the full program - it could fetch more instructions from the Internet), determine whether the program is malware or not

.

So if the "halting problem" is unsolvable in theory, then so is the malware detection problem in theory :). Of course in practice, you might be able to solve some cases.

However IMO the better approach would be to use more and better sandboxing. Sandboxing would be the equivalent of avoiding the halting problem by actually limiting the amount of time the program gets to run.

Even if the program gets to politely requests for a sandbox it could still be OK- since the program is giving a hint upfront of the limits of what it could possibly do. Of course if almost every program says they need "unlimited access/time" then so much for that ;). But Microsoft and Apple may have the clout to smackdown developers who do that.

Re:Polymorphic code

[dannyquist]

Hi, Danny Quist here. I wrote VERA and was interviewed in that article. In that example it was polymorphic. The red nodes are the unpacker, and the yellow code represents the unpacked, polymorphic area of the virus.

"Researcher's Tool Maps Malware In Elegant 3D Mode

[mapkinase]

"Researcher's Tool Maps Malware In Elegant 3D Model"

Find a word in this sentence that does not belong. One attempt.

Re:"Researcher's Tool Maps Malware In Elegant 3D M

[Anonymous Coward]

Elegant

IDA Pro anyone?

[Anonymous Coward]

Having watched the video, I highly doubt that this "visualization" is of much practical use. It may look nice, but it doesn't contain much useful information. There are already disassemblers which can visualize code in a 2D graph which is much more useful than this.

intuitive

[Anonymous Coward]

A word one should never use when reporting on a human factors experiment.

then of course there was Doom process navigator

[decora]

Doom as an Interface for Process Management

http://www.cs.unm.edu/~dlchao/flake/doom/chi/chi.html

---

Re:then of course there was Doom process navigator

[Anonymous Coward]

This is Doom!

I KNOW this!

Beautiful?

[Stenchwarrior]

I guess this is one of those "beauty is in the eye of the beholder" things or whatever, but beautiful is probably not the term I would use to describe these models. They look like wire-frames for a new Pixar character. Perhaps we just didn't get to see the rendered results?

Re:"Researcher's Tool Maps Malware In Elegant 3D M

[VortexCortex]

Malware.

Re:"Researcher's Tool Maps Malware In Elegant 3D M

[mapkinase]

Correct answer is "Elegant".

Looks Mysteriously like DNA Code

[retroworks]

And is it any coincidence that a new 3D Replicator has been introduced at CES? http://tinyurl.com/8yoby4j I think not. Code was the conception. Malware is coming manifest in a hardware form. Isn't that how Terminator started?

It's a joke. Chill

[sgt scrub]

I tried doing that but always came up with the same image. :P

Danny Quist

[Anonymous Coward]

He's a pretty big deal

is that UbiGraph?

[a5an0]

http://ubietylab.net/ubigraph/