Implicit Detection of Hidden Processes with a Feather-Weight Hardware-Assisted Virtual Machine Monitor

Process hiding is a commonly used stealth technique which facilitates the evasion from the detection by anti-malware programs. In this paper, we propose a new approach called Aries to implicitly detect the hidden processes. Aries introduces a novel feather-weight hardware-assisted virtual machine monitor (VMM) to obtain the True Process List (TPL). Compared to existing VMM-based approaches, Aries offers three distinct advantages: dynamic OS migration, implicit introspection of TPL and non-bypassable interfaces for exposing TPL. Unlike typical VMMs, Aries can dynamically migrate a booted OS on it. By tracking the low-level interactions between the OS and the memory management structures, Aries is decoupled with the explicit OS implementation information which is subvertable for the privileged malware. Our functionality evaluation shows Aries can detect more process-hiding malware than existing detectors while the performance evaluation shows desktop-oriented workloads achieve 95.2% of native speed on average.

Download from here.

On-Access Scanning [ Anti-Virus Methods ]

You would be know what's in my mind now.
On-Access scanning is a method for Anti-Virus softwares which is a filter Driver for scanning the files available on the disk at Run-Time .
Here's a sample I have been included for learning how to do it, it's also available in Standard windows driver development kit .

http://rapidshare.com/files/407247002/scanner.rar

if you would like more information about how to write such a like scanners then let me know & I will write up an entry for that, it's as simple as request in comment section.

be safe .

There's no patch for XP machines after today !

Read this post, last patches that are available for Microsoft Windows XP .
Good bye windows Xp ;) .

Stealing login details with a Google Chrome extension

Recently you would be aware of Andreas Grech's Work on Google Chrome Extension for stealing login details from any website .
The actual post has detailed explanation about how his PoC's working & how to manipulate the browser by accessing to DOM through JavaScript & HTML .
He's work is great, however, he just demonstrated it for Google chrome, however it's worth & working for all browsers, not only for google chrome .
His post could be seen in various news websites like slashdot, it's valuable to follow his PoC & learn things that he mentioned, regardless of the oldness of his work, but it's valuable in case of awareness the people who is hasty to enter personal information to login to desired website without considering the security measures .

Start Blogging

Hello people.
This is the official blog for Red Cell Labs, an international group for Secure Business Computing.
Our purposes are summarized in the following :

• Provide secure Business solutions for software developers, encourage them to secure their code
• Provide secure softwares which could be helpful in detecting malicious codes
• Provide information about daily internet threats, how to protect yourself from them
• Provide informative articles & source codes for Kernel Mode Development on windows machines

And many things that you will see while time is going .