Hello, welcome to the Friday, June 29, 2018 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Orrich, and today I'm recording from Jacksonville, Florida.

Today in inspecting some of the latest malware that was trapped in some of my honeypots, I came across a crypto coin miner that did things

a little bit different than sort of your traditional miners. First of all, this particular

miner does check if the CPU has support for the AS instruction set. So essentially, AS encryption

is built into the CPU. Many modern CPUs

do provide this feature. And this particular attacker will download a specific version of the

miner that does take advantage of this feature increasing the hash rate. In addition, this particular miner does adjust the number

of threats that are being set up by the miner to have the number of the CPU cores available,

probably not to overload the CPU and to remain more stealthy. WebAssembly or short Wasam has been showing up in browsers over the last year or so and yes,

there are some first applications that take advantage of this new feature.

WebAssembly is essentially bytecode compiled JavaScript, so it's more

compact and is also supposed to execute faster. At this point of course, one of the very prominent

application of WebAssembly is some of these crypto coin miners that are used in these ever popular cryptojacking attacks.

Now, once you run into WASM, the next question, of course, is, is it possible to decompile

and analyze these scripts?

Turns out it's not really all that hard.

The Chrome debugger will take care of it for you.

So really not that difficult. Now, there are a couple of practical issues with this. For example,

function names will be gone. Instead, each function just has a number. So the code may be a little bit

more difficult to read than

looking at the source code for the particular application. John Bergbaum from Forcepoint

has written a real nice blog post about WebAssembly how to analyze it and how it sort of works. So if you're into web application security,

...