Just trying to understand the phrase "malware analysis evasion and counter-evasion" (https://dl.acm.org/doi/10.1145/3150376.3150378) is like evaluating a formula with nested negations. "malware" (bad!), "analysis" (good!), "evasion" (bad!) "and counter-evasion" (and also good!)
This isn't my area, but it seems that some kinds of malware have clever ways to detect that they're being run under emulation (because running malware under emulation is a thing that folks who are trying to analyze malware would do), and then behave differently if so (which, of course, makes the analyst's job harder).
It's sensible to say that a notion of "correctness" for an emulator could be something like "observationally equivalent to the system being emulated". And of course we know from work like @wilbowma's https://dl.acm.org/doi/10.1145/2784731.2784733 that "observer" is just another word for "attacker". But even so, I honestly hadn't thought about the possibility that code run under emulation might be trying to *actively detect* that it's being run under emulation and purposely behave differently then. Dang, I feel naive
@lindsey I think using emulation has become much more common for malware analysis but traditionally people used debuggers for that kind of thing and anti-debugging has been common since the mid-1990s as I remember it. https://anti-debug.checkpoint.com/
@pervognsen Interesting, thanks! I'm new to all this, but that tracks, since debuggers are conceptually similar to emulators!
Do security researchers ever get confused as to whether they're the good guys or the bad guys?
@lindsey me personally? no. others? definitely.
The title of one of the presentations I currently do is "Think like a hacker".
Precisely because if you don't, you're not securing the right things ...
@[email protected] @[email protected] @[email protected] At least one of my university friends became a sysadmin partly because he felt that it would otherwise be too tempting to try and poke around other people's systems.
