SecDocs Feed for author Ero Carrera

[Slides] Reverse Engineering Automation with Python

Tue, 26 Apr 2011 20:43:38 +0200

Authors: Ero Carrera
Tags: reverse engineering python
Event: Black Hat USA 2007

[Paper] State Of Malware: Family Ties

Mon, 21 Jun 2010 06:02:36 +0200

Authors: Peter Silberman Ero Carrera
Tags: malware malware analysis
Event: Black Hat EU 2010
Abstract: Over the last few years malware has gravitated towards a few major families rather than the single or small-sized families of the past. Families of hundreds or even thousands are not uncommon. These families grouped together demonstrate the evolution of malware over time. This evolution may originate in simple bugfixes and small enhancements or entirely new sets of functionality added over an existing code base. Studying the ties between families, both within and across families, provides us with a context in which to study the development pace and technical improvements as they appear. We will examine how families grow and change amongst the mass malware and targeted attack malware. While examining how families grow and change we will attempt to identify features across all families that are both common and implemented in the same way. This could lead to quick static identification of malware features as well as signaturing these features. We hope to show how multiple families are derived from one code base, we will not just address mass malware, targeted malware but also rootkits and code sharing amongst them.

[Slides] State Of Malware: Family Ties

Mon, 21 Jun 2010 02:12:24 +0200