Sedating the Watchdog: Abusing Security Products to Bypass Mitigations

tools, av, Vulnerabilities, anti-virus, avulnerabilitychecker, Windows, enSilo Breaking Malware

TL;DR: Design issues in various security products, such as anti-virus, make it significantly easier for threat actors to bypass exploit mitigations. As part of our ongoing goal of complete endpoint security, we found a prevalent flaw where anti-virus products allocate memory with RWX permissions at a predictable address.

Read More

“Selfie”: A Tool to Unpack Self-Modifying Code using DynamoRIO

tools, Windows, Malware, enSilo Breaking Malware, Endpoint Protection

TL;DR: In this blog post we describe Selfie, a tool we have developed that automates finding the OEP for a majority of malwares packed with self-modifying code. The Selfie tool is now open-sourced, compiled to 32-bit, and can be found here.

Read More