SECurity & Reverse Engineering Team (SECRET)

The SECurity & Reverse Engineering Team (SECRET) laboratory at Federal University of Paraná (@UFPR), Brazil

[SECurity & Reverse Engineering Team (SECRET) @SECRET_UFPR]

We are making Corvus, our malware analysis sandbox, public available for the first time. Check out at https://t.co/HWZCHI1yUq

[Marcus Botacin @MarcusBotacin]

Multiple of my students are looking for internships. Junior researchers of all levels: undergrads, masters, and PhDs. Open to remote positions around the world and in person in the USA. Hello security companies, reach me out for recommendations.

[Marcus Botacin @MarcusBotacin]

Our @MarcusBotacin @gracesrm @MalFuzzer ACM DTRAP @acm_dtrap special issue on memory malware and other threats is out. https://t.co/pB83A2kTrq Thanks to all who collaborated!

[Marcus Botacin @MarcusBotacin]

Just discovered I am a top reviewer for acsac!

[Marcus Botacin @MarcusBotacin]

Want to know more about how to detect memory injections with hardware-based memory monitoring? Access our poster: https://t.co/O69jMxlCZn
Access our summary: https://t.co/eIGT8oEKib

[Marcus Botacin @MarcusBotacin]

The next is to present our poster (@MalFuzzer) on the prototype of a Hardware AV

[Marcus Botacin @MarcusBotacin]

Computers are strange. When we want them to be random (e.g., random number generation), they are too deterministic (e.g., pseudo-RNG). When we want them to be deterministic (e.g., deterministic compilation), they are too random...

[Marcus Botacin @MarcusBotacin]

Among all possible obfuscations, we notice that Bogus Control Flow (BCF) is significally harder for the classifiers. We should invest more time researching how to deal with this type of obfuscation!

[Marcus Botacin @MarcusBotacin]

The effect of obfuscation and how to revert it is somethign that we should study more. Interested students?

[Marcus Botacin @MarcusBotacin]

Papers I like to remember.

[Marcus Botacin @MarcusBotacin]

[Calling all malware analysts] Our research is trying to understand what the malware analysts think and which tools analysts would like to have. Could you take a few minutes to answer our anonymous survey? https://t.co/NGqHVNOFPQ #malware #reverseengineering #redteam #dfir

[Marcus Botacin @MarcusBotacin]

0-day detectors do not exist, at least not as an absolute definition. Once again, it is all about generalization limits. I prefer to talk about generalization measurements rather than 0-day detection capabilities.

[Marcus Botacin @MarcusBotacin]

The discussion between signature vs. ML detectors is misleading. ML models are a type of signature, but that generalize more. We can convert ML models to rules. Stay tuned to see a bit more on this in one of my future papers.

[Marcus Botacin @MarcusBotacin]

[New Paper] Happy to have contributed with some discussions to this paper, more specifically the following:

[SECurity & Reverse Engineering Team (SECRET) @SECRET_UFPR]

@SECRET_UFPR guidelines for ML for security experiments.

[Fabrício Ceschin @fabriciojoc]

One of the main contributions of the papers is a checklist that serves as a reminder and prevents researchers and practitioners from committing common mistakes or at least being aware of their existence while using ML in security. https://t.co/yBwEYb9ns8

[SECurity & Reverse Engineering Team (SECRET) @SECRET_UFPR]

Check out newest @SECRET_UFPR paper on the (in)security of ML for security.

[Fabrício Ceschin @fabriciojoc]

ML for Cybersecurity is different from regular ML tasks. Attackers may create novel threats that are unknown to defense solutions. Our paper "Machine Learning (In) Security: A Stream of Problems" shows the main challenges in applying ML to security. https://t.co/LztK9sTmcV🧶

[Marcus Botacin @MarcusBotacin]

"GPThreats-3: Is Automatic Malware Generation a Threat?" My talk on how to use GPT to automatically write malware. Watch here: https://t.co/TmyPaOKjim

[SECurity & Reverse Engineering Team (SECRET) @SECRET_UFPR]

The bright future of @SECRET_UFPR alumni!

[Fabrício Ceschin @fabriciojoc]

I’m happy to share that I’m starting a new position as a Postdoctoral Researcher at @GeorgiaTech! Thanks, @szonouz for the opportunity to join your amazing team.

[Marcus Botacin @MarcusBotacin]

Presenting my paper about GPT-generated malware.
Paper: https://t.co/ie3wyuSl3b
Slides: https://t.co/7zG6FORyeA

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

First session!

"Reflections on Trusting Docker: Invisible Malware in Continuous Integration Systems"

"ROPfuscator: Robust Obfuscation with ROP" @peperunas

"GPThreats-3: Is Automatic Malware Generation a Threat?" @MarcusBotacin

"Emoji shellcoding in RISC-V" @gajaloyan

[HITBSecConf @HITBSecConf]

#HITB2023AMS #VIDEO #COMMSEC D1 - All You Always Wanted to Know About AntiViruses - Marcus Botacin - https://t.co/p0gbfBRXI8