AppSec Village

AppSec Village will take place at Savoy, 3rd Floor, Flamingo Corporate Convention Center, Las Vegas.

Deepfactor will have four 2-hour POD (Practical-on-Demand) Challenge sessions during AppSec Village:
– August 11: 3:00-5:00pm
– August 12: 12:00-2:00pm and 3:00-5:00pm
– August 13: 12:00-2:00pm

The Challenge: How to Hide Behavior from Security Tools
Detecting application behavior by monitoring library and system calls is a popular technique employed by AppSec tools. These tools can monitor and log activity, block API requests, and so on. In this workshop, you will learn some techniques to keep your activities hidden from these types of tools, using uncommon / unmonitored APIs, using unmonitored processes as confused deputies, and other approaches. You will learn how popular monitoring frameworks like eBPF work and how to circumvent their monitoring capabilities.

Challenge Outline

1. Overview of monitoring by API interception
2. How tools categorize behavior
   1. Static rules vs behavior catalogs
3. Lab setup
   1. Where to get the exercises, where to run them, etc.
4. Simple Exercises
   1. Evade libc detection through static compilation
   2. Evade detection by changing process name
5. Difficult Exercises
   1. Evade detection by making use of confused deputy
      1. File based operations
      2. Network based operations
   2. Evade detection by not using system calls
      1. io-uring
   3. Evade detection by using uncommon syscalls to do things you want
      1. prctl, fnctl, sendfile, others
      2. write/read variants