Malware Analysis and Intrusion Detection

Thanks to an enormeous effort of your tutor, the MAID exam has already been corrected. Good news: All exam participants have passed! Note that we had to withdraw the IDS task, as you were not able to answer the questions based on the material covered in the MAID lecture (mea culpa). The maximum number of points in the exam is thus 80 pts instead of 90 pts. Overall MAID grade distribution (16 people passed, new record!):

You can view your grade in CMS under Final Results (Exam 1) (mixed exam and project, each 50%), and can inspect your points for exam subtasks under Exam 1. The exam inspection will be on Tue 10:00 - 11:00 am in room 0.06 of CISPA (E9 1).

We have received 17 registrations for the MAID exam. The exam will be on Thursday (April 4) in HS002 (E1 3) and last 90 min from 10-11:30. We'll start at 10am sharp. Please arrive 15 min earlier such that we can place your seats.

The written exam will be for pen and paper only. It is not allowed to bring any books and/or calculators. We will have one printed copy of the Intel Instruction Set Reference available that you can use to look up instruction details (in emergency situations, given that it's just one copy). Having said this: If you want to solve the exam on time, you should know the instruction semantics by heart.

Alice,

You did a fabulous job. We received 19 submissions, out of which 17 are of sufficient quality (>= 50 points) to proceed with the exam. You can inspect your personal project score in CMS. More feedback will be shared upon request via email to your favorite MAID tutor (s8sewall@stud.uni-saarland.de). Please do not forget to register to (and prepare for) the exam by March 28.

Bernd

Dear Alice,

About 4 weeks to go until the final submission deadline for your MAID report. You may start to wonder about the report itself. We would like to give you some ideas on what level of detail and what contents we expect from you in this document.

Please note that the reports make up 50% of your overall project grade. This means that we do not only expect correct results and annotated reversing database for each project, but also a detailed (yet concise) description of the technical workings. Put serious efforts in the reports. Past experience has shown that you will loose points mainly because the report lacks findings, rather than submitting wrong solutions.

For each project, this means the following:

• p2png: We expect that you document the P2P protocol in such a detail that shows that you have understood how the network works. This includes bootstrapping the network, the types of exchanged messages, message formats, encryption, and peering details. Also, you should also describe how you identified the peers, and what challenges needed to be solved first.
• ransomware: We are obviously interested in the en-/decryption routine, but also in the core technical details of the obfuscation engine. How on earth did it work, why, and why so complex?
• RAT: Please describe dat evil RAT, but in particular, also highlight how a Suricata module helps to detect it (and also explain why standard rules are insufficient).

Good luck!
Bernd

Dear Alice,

Bad news on the horizon: Left-wing populists have discovered severe flaws in our p2png implementation, which made it trivial for everyone to identify all party members. We were just forced to release a new version of p2png (p2png.v2) that mitigates this trivial vulnerability and makes peer discovery much harder. You can download the new binary here. p2png.v2 is largely the same binary as the previous one, we just had to change one constant and add one check. Note that the default port was updated to 13337 (which, obviously, is significantly more leet than 1337). Furthermore, all existing peers updated their software and changed their addresses. Please make sure that your assignment solution is based on this particular binary. Given the trivial solution of the old version, p2png solutions that were created before today will be invalid.

I can totally feel your pain. But wait! Normally, a new binary would have meant that your reversing efforts completely start from scratch, as you'd need to start a new IDA database. Yet, we spent significant amount of time to create an in-line patch that, luckily, leaves code offsets and everything in place. You can apply this patch to your IDA database and continue working on your existing IDB. To be on the safe side, make sure to make a copy of your database before applying the script.

To cope with this extra burden, we will grant you two things:
 a) The submission deadline will be extended by 4 days to March 4 23:59 CET.
 b) We will give bonus points if you describe in your report how we fixed what problem.
 
Happy reversing,
Bernd