Victimware

Dmitry Vostokov Software Diagnostics Services

Version 1.0

Prerequisites

Interest in software diagnostics and malware

© 2012 Software Diagnostics Services

Goal

Make malware research and analysis community aware of pattern-driven software diagnostics

© 2012 Software Diagnostics Services

What is Victimware?

Definition: Software affected by execution behavior of other components.

© 2012 Software Diagnostics Services

Victimware

Malware

Why Victimware?

© 2012 Software Diagnostics Services

Victimology Software Victimology Victim thread in Mac OS X

Typology of Victimware

Modified Schafer’s functional typology:

Targeted Unrelated Self-Victimized Provocative (Impelementation- and design-

weak) Precipitative (inappropriate data communication) Political (empires of code)

© 2012 Software Diagnostics Services

Approach Use patterns of abnormal software behavior in victimware to discover malware

© 2012 Software Diagnostics Services

Behavioral Patterns … Heap Corruption Wild Code Hooked Functions Activity Resonance Deviant Module …

http://www.dumpanalysis.org/blog/index.php/crash-dump-analysis-patterns/

© 2012 Software Diagnostics Services

Structural Patterns … Memory Region Region Boundary Module Stack …

http://www.dumpanalysis.org/blog/index.php/structural-memory-analysis-patterns/

© 2012 Software Diagnostics Services

Crash Dump Analysis Example

© 2012 Software Diagnostics Services

Practice

Further Reading Victimology

Criminology: The Basics by S. Walklate The Praeger Handbook of Victimology by J. K. Wilson

Software Victimology

Software Diagnostics

Software Diagnostics Institute Memory Dump Analysis Anthology: Volumes 1, 2, 3, 4, 5, 6, 7, … Volume 6 to be released in July / Volume 7 is planned for the end of 2012

Software Trace and Memory Dump Analysis: Patterns, Tools, Processes and Best Practices

Introduction to Pattern-Driven Software Problem Solving Fundamentals of Complete Crash and Hang Memory Dump Analysis Introduction to Pattern-Driven Software Diagnostics

© 2012 Software Diagnostics Services

Q&A

Please send your feedback using the contact form on DumpAnalysis.com

© 2012 Software Diagnostics Services

Thank you for attendance!

© 2012 Software Diagnostics Services

In a few minutes Debugging TV Frames Episode 0x11 starts to show Windows and Mac OS X examples for stack memory region boundaries:

www.debugging.tv