Madumok

Masters Seminar About Reverse Engineering For my Masters Seminar I will focus on reverse engineering. First, I will write a post about reversing basics. In that post I will mention some useful literature for beginners and I will make a list of tools used in reverse engineering. In the next post I will explain how to set up a reversing environment with  virtual machines. I will also explain how to use the REMnux virtual machine for network monitoring. This semester I plan to reverse engineer and analyze two malicious files. First, I will analyze a Windows XP malware and after that I will analyze a malware used on Linux systems.The aim of this course is to gain experience in reverse engineering and to become more familiar with all the tools that can be used to analyze malicious files. download  file  now

Machine learning augmented reverse engineering Masters thesis Malicious software is a burning problem in todays ICT industry. There is an ongoing cat-and-mouse game between malware authors, who are writing more sophisticated code every day and returning to life old malware with new protection methods, and security researchers who are struggling to analyze malicious code and find a way how to stop it. Sophisticated malware has multiple defense layers which serve to fool anti-virus (anti-malware) software, malware analysis platforms, as well as to make it harder for security researchers to analyze malware internal workings. Security researcher has to go through mostly manual process of reverse engineering malware, document malware internal workings, write malware signature (or some other form of malware detection technique) and to see if the damage malware has caused is reversible and how to remove it from the system. By the time that is done malware has already caused often irreversible...

Working with Conpot Masters thesis For my Masters thesis I plan to familiarize myself with the Conpot honeypot service. I will study honeypots in general and then I will analyze Conpot, what are its upsides and downsides and what makes it different compared to other honeypots. After that, I will try to find some potential ways that Conpot could be upgraded. First off, I will write a general post about Conpot. After that I will make a brief tutorial about how to install this tool and how to configure and use it. I will  analyze the resulting honeypot by using tools such as Metasploit and try to find the best tool to scan the network and find potential honeypots. I will also research some of the flaws in Conpot that may result in the honeypot crashing or malfunctioning or flaws that may result in honeypots being easily recgnized. I plan to tackle some of those problems either at the end of this semester or in the next semester. download  file  now