Casting exploit analysis as a Weird Machine reconstruction problem
This work addresses malware analysis for security analysts by providing a method to understand exploit bytecode, though it is a first attempt and incremental in applying reconstruction to specific browser exploits.
The authors tackled the problem of analyzing malware exploits by reconstructing Weird Machines (unexpected virtual machines) from exploit primitives, focusing on JavaScript exploits in web browsers, and presented an algorithm that identifies exploit-related behavior to associate with bytecode semantics.
Exploits constitute malware in the form of application inputs. They take advantage of security vulnerabilities inside programs in order to yield execution control to attackers. The root cause of successful exploitation lies in emergent functionality introduced when programs are compiled and loaded in memory for execution, called `Weird Machines' (WMs). Essentially WMs are unexpected virtual machines that execute attackers' bytecode, complicating malware analysis whenever the bytecode set is unknown. We take the direction that WM bytecode is best understood at the level of the process memory layout attained by exploit execution. Each step building towards this memory layout comprises an exploit primitive, an exploit's basic building block. This work presents a WM reconstruction algorithm that works by identifying pre-defined exploit primitive-related behaviour during the dynamic analysis of target binaries, associating it with the responsible exploit segment - the WM bytecode. In this manner any analyst familiar with exploit programming will immediately recognise the reconstructed WM bytecode's semantics. This work is a first attempt at studying the feasibility of this method and focuses on web browsers when targeted by JavaScript exploits.