Hello, welcome to the Tuesday, June 6th, 2017 edition of the Sandsenet Storm Center's Stormcast.

My name is Johannes Ulrich and I am recording from Washington, D.C.

Malver is often obfuscated or encoded in order to bypass a basic signature-based detection algorithm. Now, one way how this is done is usually via

XOR. So the attacker is just taken an existing binary and then applying a key via XOR to this binary.

Of course, now your PE header and the like is no longer recognizable, and

malware analysis of course gets a little bit more difficult in order to analyze the malware.

You first have to figure out what is the key, and then of course undo the XOR operation.

Now to help you with analyzing binaries like this, DDA today has a post showing you how to find

the key that was used to encode a particular binary.

What he's really doing here is he's using a specific property of XOR. If you do XOR something with zero, nothing really changes.

So what you have to do is you have to find a section in the file that would have been all zeros normally.

And then by looking at the section, well, you can then deduct the key by just looking at the data being present in that section, hopefully, and that's actually quite common for matter.

The key is short enough where it fit into this section of zeros.

Luckily, typically, PE files do have a number of sections that are all

zeros, so what you're looking for here is a section with a somewhat random-looking data

that keeps repeating throughout the file, and chances are that this is your key. DDS promising a second part in which he'll introduce a tool that automates this process.

MCC catchers sometimes known under their brand name of Stingray are sometimes used in order to detect cell phone users. Law enforcement has been

known to use them in the past, and there have been various efforts to figure out how frequently

these systems are used and wear. Students at the University of Washington now for the first time as far as I know

managed to actually cover an entire city with detectors in order to find and then map these

emce-catchers and see where they are used. What they did is they built a little system that does

detect or attempts to detect these devices and then they deploy them with volunteers at

...