Can I read Exorcist: Automated Differential Analysis to Detect Compromises in Closed-Source Software Supply Chains on EtoBox?

Exorcist: Automated Differential Analysis to Detect Compromises in Closed-Source Software Supply Chains by Frederick Barr-Smith; Tim Blazytko; Richard Baker; Ivan Martinovic is a scholarly article available to read on EtoBox.

What is Exorcist: Automated Differential Analysis to Detect Compromises in Closed-Source Software Supply Chains about?

The insertion of trojanised binaries into supply chains are a particularly subtle form of cyber-attack that require a multi-staged and complex deployment methodology to implement and execute. In the years preceding this research there has been a spike in closedsource software supply chain attacks used to attack downstream clients or users of a company.To detect this attack type, we present an approach to detecting the insertion of malicious functionality in supply chains via differential analysis of binaries. This approach determines whether malicious functionality has been inserted in a particular build by looking for indicators of maliciousness. We accomplish this via automated comparison of a known benign build to successive potentially malicious versions.To substantiate this approach we present a system, Exorcist, that we have designed, developed and evaluated as capable of detecting trojanised binaries in Windows software supply chains. In evaluating this system we analyse 12 samples from high-profile APT attacks conducted via the software supply chain. CCS CONCEPTS • Security and privacy → Malware and its mitigation; Intrusion detection systems.

Author

Frederick Barr-Smith; Tim Blazytko; Richard Baker; Ivan Martinovic

Publisher

ACM

Published

2022

Language

EN