Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2014)

Lecture Notes in Computer Science 8550 Commenced Publication in 1973 Founding and Former Series Editors: Gerhard Goos, Juris Hartmanis, and Jan van Leeuwen Editorial Board David Hutchison Lancaster University, UK Takeo Kanade Carnegie Mellon University, Pittsburgh, PA, USA Josef Kittler University of Surrey, Guildford, UK Jon M. Kleinberg Cornell University, Ithaca, NY, USA Alfred Kobsa University of California, Irvine, CA, USA Friedemann Mattern ETH Zurich, Switzerland John C. Mitchell Stanford University, CA, USA Moni Naor Weizmann Institute of Science, Rehovot, Israel Oscar Nierstrasz University of Bern, Switzerland C. Pandu Rangan Indian Institute of Technology, Madras, India Bernhard Steffen TU Dortmund University, Germany Demetri Terzopoulos University of California, Los Angeles, CA, USA Doug Tygar University of California, Berkeley, CA, USA Gerhard Weikum Max Planck Institute for Informatics, Saarbruecken, Germany Sven Dietrich (Ed.) Detection of Intrusions and Malware, and VulnerabilityAssessment 11th International Conference, DIMVA 2014 Egham, UK, July 10-11, 2014 Proceedings 13 Volume Editor Sven Dietrich Stevens Institute of Technology Department of Computer Science Castle Point on Hudson Hoboken, NJ 07030, USA E-mail: [email protected] ISSN 0302-9743 e-ISSN 1611-3349 ISBN 978-3-319-08508-1 e-ISBN 978-3-319-08509-8 DOI 10.1007/978-3-319-08509-8 Springer Cham Heidelberg New York Dordrecht London Library of Congress Control Number: 2014941759 LNCS Sublibrary: SL 4 – Security and Cryptology © Springer International Publishing Switzerland 2014 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Exempted from this legal reservation are brief excerpts in connection with reviews or scholarly analysis or material supplied specifically for the purpose of being entered and executed on a computer system, for exclusive use by the purchaser of the work. Duplication of this publication or parts thereof is permitted only under the provisions of the Copyright Law of the Publisher’s location, in ist current version, and permission for use must always be obtained from Springer. Permissions for use may be obtained through RightsLink at the Copyright Clearance Center. Violations are liable to prosecution under the respective Copyright Law. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein. Typesetting: Camera-ready by author, data conversion by Scientific Publishing Services, Chennai, India Printed on acid-free paper Springer is part of Springer Science+Business Media (www.springer.com) Preface On behalf of the Program Committee, it is my pleasure to present the proceedings of the 11th GI International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2014). Since 2004, DIMVA has been bringing together leading researchers and practitioners from academia, gov- ernment, and industry annually to present and discuss novel security research. DIMVA is organized by the Special Interest Group Security – Intrusion Detec- tion and Response (SIDAR) — of the German Informatics Society (GI). This event was technically co-sponsored by the IEEE Computer Society Technical Committee on Security and Privacy. The DIMVA 2014 Program Committee received 60 valid submissions from industrial and academic organizations from 20 different countries, an increase of over 57% in the number of submissions over last year. Each submission was carefully reviewed by at least three Program Committee members or external experts. The submissions were evaluated on the basis of scientific novelty, im- portance to the field, and technical quality. The final selection took place at the Program Committee meeting held on March 27, 2014, at Stevens Institute of Technology in Hoboken, New Jersey, USA. Thirteen full papers and one extended abstract were selected for presentation and publication in the conference proceedings. The conference took place during July 10–11, 2014, at Royal Holloway, Uni- versity of London, in Egham, UK, with the program grouped into five ses- sions. Three keynote speeches were presented by Ross Anderson (University of Cambridge), J. Alex Halderman (University of Michigan), and Susan Landau (Worcester Polytechnic Institute). A successful conference is the result of the joint effort of many people. In particular, I would like to thank all the authors who submitted contributions. I also thank the Program Committee members and the additional reviewers for their hard work and careful evaluation of the submissions, as well as the Steering Committee chairs Ulrich Flegel and Michael Meier for providing guidance during the many months leading up to the conference. Last but not least, I would like to thank the General Chair Lorenzo Cavallaro from Royal Holloway University of London, for handling the local arrangements, the website, and the sponsorship. We are wholeheartedly thankful to our Gold Sponsors GCHQ, HP Labs Bristol, Huawei, and Kaspersky Lab, and our Sil- ver Sponsors Nominet, Silent Circle and Trend Micro for generously supporting DIMVA 2014. July 2014 Sven Dietrich Organization Organizing Committee Program Chair Sven Dietrich Stevens Institute of Technology, USA General Chair Lorenzo Cavallaro Royal Holloway University of London, UK Program Committee Magnus Almgren Chalmers University of Technology, Sweden Jean Camp Indiana University at Bloomington, USA Justin Cappos NYU Poly, USA Michael Collins RedJack LLC, USA Baris Coskun AT&T Security Research Center, USA HervéDebar Télécom SudParis, France David Dittrich University of Washington, USA José M. Fernandez Ecole´ Polytechnique de Montreal, Canada Ulrich Flegel Infineon, Germany Allen D. Householder Carnegie Mellon University, Software Engineering Institute, CERT, USA Rob Johnson Stony Brook University, USA Chris Kanich University of Illinois at Chicago, USA Pavel Laskov University of Tübingen, Germany Corrado Leita Symantec Research, USA Michael Meier University of Bonn, Germany Daniela Oliveira Bowdoin College, USA Michalis Polychronakis Columbia University, USA Konrad Rieck University of Göttingen, Germany Volker Roth Freie Universität Berlin, Germany Sebastian Schmerl AGT, Germany Cristina Serban AT&T Security Research Center, USA Micah Sherr Georgetown University, USA Asia Slowinska Vrije Universiteit Amsterdam, The Netherlands Wietse Venema IBM Research Yorktown Heights, USA VIII Organization Steering Committee Chairs Ulrich Flegel Infineon, Germany Michael Meier University of Bonn, Germany Members Herbert Bos Vrije Universiteit Amsterdam, The Netherlands Danilo M. Bruschi Università degli Studi di Milano, Italy Roland Büschkes RWE AG, Germany HervéDebar Télécom SudParis, France Bernhard Hämmerli Acris GmbH & HSLU Lucerne, Switzerland Marc Heuse Baseline Security Consulting, Germany Thorsten Holz Ruhr-Universität Bochum, Germany Marko Jahnke Fraunhofer FKIE, Germany Klaus Jülisch Deloitte, Switzerland Christian Kreibich ICSI, USA Christopher Kruegel UC Santa Barbara, USA Pavel Laskov University of Tübingen, Germany Konrad Rieck University of Göttingen, Germany Robin Sommer ICSI/LBNL, USA Diego Zamboni CFEngine AS, Norway Additional Reviewers Daniel Arp Fanny Lalonde-Lévesque Jonathan P. Chapman Antoine Lemay Bapi Chatterjee Tao Li Till Elsner W. Brad Moore Manfred Erjak Daniel Plohmann Sebastian Eschweiler Nedim Srndi´ˇ c Hugo Gascon Zhi Da Henry Tan Jan Gassen Tavish Vaidya Mohammad Halawah Tobias Wahl Alan Hall Christian Wressnegger Ronald Heinrich Matthias Wübbeling Vasileios P. Kemerlis Fabian Yamaguchi Georgios Kontaxis Yanyan Zhuang Organization IX Gold Sponsors Silver Sponsors Table of Contents Malware I Data Structure Archaeology: Scrape Away the Dirt and Glue Back the Pieces! (Or: Automated Techniques to Recover Split and Merged Variables) ....................................................... 1 Asia Slowinska, Istvan Haller, Andrei Bacs, Silviu Baranga, and Herbert Bos Identifying Shared Software Components to Support Malware Forensics ........................................................ 21 Brian Ruttenberg, Craig Miles, Lee Kellogg, Vivek Notani, Michael Howard, Charles LeDoux, Arun Lakhotia, and Avi Pfeffer Instruction-Level Steganography for Covert Trigger-Based Malware (Extended Abstract) ............................................. 41 Dennis Andriesse and Herbert Bos Mobile Security AndRadar: Fast Discovery of Android Applications in Alternative Markets ........................................................ 51 Martina Lindorfer, Stamatis Volanis, Alessandro Sisto, Matthias Neugschwandtner, Elias Athanasopoulos, Federico Maggi, Christian Platzer,

Load more