discount
nimhans convention center
Home
Jugaad - Linux thread injection kit
Speaker Details
Speaker / Panel Lead
Speaker User Name: 
Aseem Jakhar
Speaker Bio: 
Aseem "@" Jakhar is a security researcher at Payatu Labs, a startup in infosec trainings and consulting, with extensive experience in system programming, security research and consulting. He has worked on various security products and tools. He has been a speaker at various security conferences including Xcon, Blackhat EU, Clubhack, IBM Security & Privacy Bangalore, Cocon, ISACA Bangalore, Bangalore Cyber secuity summit, National Police Academy Cyber crime seminar Hyderabad. He is also the founder of null - The open security community (registered not-for-profit organization, http://null.co.in ). The focus and mission of null is advanced security research, awareness and assisting Govt./private organizations with security issues. null currently has eight active chapters throughout India and is now planning to expand outside India as well. One of the null initiatives is nullcon security conference http://nullcon.net which is a favourite go-to destination for hackers and security professionals in the Indian sub-continent.
Proposal Details
Session Type: 
Presentation - 45 Minutes
Abstract: 
Windows malware conveniently uses the CreateRemoteThread() api to delegate critical tasks inside of other processes. However till now there is no API on Linux to perform such operation. This paper talks about my research on creating an API similar to createRemoteThread() on *nix platform. The aim of the research is to show how a simple debugging functionality in *nix platform can be exploited by a malware to hide itself and delegate(inject) the critical(malicious) operation to an innocent process. The toolkit named "libjugaad" currently works on Linux, allocates space inside a process and injects and executes arbitrary payload as a thread into that process. It utilizes the ptrace() functionality to manipulate other processes on the system. ptrace() is an API generally used by debuggers to manipulate(debug) a program. By using the same functionality to inject and manipulate the flow of execution of a program Jugaad is able to inject the payload as a thread. Jugaad does an in-memory thread injection and hence is stealthy. It however allocates memory in the process using mmap2 system call which only shows up as allocated memory in maps file but does not reveal anything about the injection as opposed to shared object injection which reveals the name of the shared object in the process maps file. The payload to be executed runs inside the thread and is independent of the toolkit - you chose your payload, jugaad injects the payload. Finally the talk will conclude with options for protecting against any such kind of attacks.
Target Audience: 
Developers (Intermediate)
Developers (Expert)
Tracks: 
  • Databases