1. ToorConX - The Ultimate Deobfuscator
Stephan Chenette, Principle Security Researcher
Websense Security Labs

2. Agenda
The Ultimate Deobfuscator: Hooking versus Simulation
 The Obfuscation “Problem”
 The “Simulated Solution”
 The Ultimate Deobfuscator
 Concluding remarks
2

3. The Obfuscation “Problem”
 Most malicious webpages today are obfuscated.
3

4. An obvious malicious redirect
4

5. What we actually see in the source
5

6. DeObfuscation…how far we’ve come…
 Replacing all occurrences of "document.write" with alert.
 Replacing eval with document.write
 Forcing document.write to write between
<textarea></textarea> tags
 But malcode authors added anti-debugging traps like
arguments.callee.toString() to break the flow of execution
if code were changed in anyway.
6

7. Script Debuggers…
 Microsoft Script Editor (MSE)
 Rhino (Mozilla’s JavaScript debugger)
 IE Developer’s Toolbar
 Firebug
7

8. The “Simulated” solution
 Various toolkits have been released to Safely
Investigating Malicious JavaScript
– HTML Parser
– DOM Implementation
– Scripting Engine(s)/Interpreter(s)
8

9. The “Simulated” solution
Recent Presentations:
 Websense
– (Alex Rice & Stephan Chenette) PacSec
 Arbor
– (Jose Nazario) CanSecWest
 SecureWorks - CaffeineMonkey
– (Ben Feinstein & Daniel Peck ) Blackhat
9

10. 10

11. 11

12. 12

13. 13

14. 14

15. 15

16. 16

17. 17

18. 18

19. 19

20. 20

21. 21

22. Objects/functions that must be provided
Native JavaScript Browser Supplied
eval() alert()
String.fromCharCode() document.write()
escape() location.href
Math.random() window.status
22

23. Incomplete simulator
23

24. The ultimate goal would be….
 A headless browser basically….
 Non-graphical browser that would give us all the details
internally of what’s going on without rendering the content.
 That wouldn’t allow successful exploitation.
24

25. The Dream…
 Deobfuscation results
– eval, document.write
 Navigation to a new page
 Pop-ups prompting user to install an exe
 DNS errors
 Changes to the DOM, additional iframe elements or image
elements
 Loading of ActiveX controls, success or failure and CLSID
 Iteration of the DOM whenever we wanted.
 All to do this automatically without a debugger
25

26. Another solution…
The “Ultimate” Deobfuscator…
 What better to use to deobfuscate content than the full
browser itself?
 This presentation focuses on Internet Explorer, but this
technique works for every browser.
26

27. Is it really that easy?
 Hook the right functions insides the browser and just sit
back.
27

28. Hooking is a dirty job
 Especially when you’re functions that are neither exported
or documented.
 Requires changes if browser dlls are updated
28

29. What’s hooked…the basics
 mshtml.dll
– document.write
 jscript.dll
– eval
29

30. Other interesting events to hook
 URL redirection
 Object creation
 DOM Element additions, removals
 DOM Attribute additions
 Etc.
30

31. In action…
 Inject the DecoderHook DLL
31

32. In action…
32

33. Output now resembles browser
33

34. Malicious deobfuscation example
34

35. Malicious deobfuscation example
35

36. Malicious obfuscated source code
36

37. Malicious deobfuscation log
37

38. Malicious deobfuscation log
38

39. 39

40. Suspended, but still malicious
40

41. Hooking has multiple advantages
41

42. Conclusion
 Obfuscation != Malicious
 Security Researchers analyzing web content must have a
solid deobfuscation tools to deal with today’s malicious
webscape.
 Hooking the browser is one more solution for manual
reversing of obfuscated content.
42

43. Thank you.
 Any questions?
 I will be releasing POC code for this in a blog next week.
 Also…We’re hiring! One intern and One-Full time position
open! San Diego position - Research/Dev skills, C, PERL,
etc.!
 Check out our website and blogs
 http://securitylabs.websense.com/content/blogs.aspx
 http://securitylabs.websense.com/
43