Reversing Golang Binaries with Ghidra скачать в хорошем качестве

Reversing Golang Binaries with Ghidra

Reversing Golang Binaries with Ghidra Speaker: Dorka Palotay (Palotay Dorka, HU) About speaker: Dorka has a Bachelor's degree in applied mathematics. She continued her studies in the field of security and privacy, where she gained her Master's degree in computer science specializing in advanced cryptography. She started her career at Sophos, mainly focusing on ransomware analysis, but as a member of the Emerging Threats team, she had the opportunity to gain experience in reverse engineering a wide range of malware attacks. Before joining CUJO AI she was working in the financial industry as an IT security analyst, focusing on threat hunting and forensics investigations. Currently, she is working at CUJO AI as a senior threat researcher focusing on reverse engineering IoT malware. ---- Golang is Google's open-source programming language, which in recent years has gained attention among developers. It is not only used for good purposes but, in a developing trend, it is a popular choice of malware authors as well. The fact that Golang supports cross-compiling makes it a tempting option for IoT malware attacks. This has resulted in a proliferation of IoT malware written in Go. For this reason, we decided to dive deeper and develop our own toolset to become more effective at combating Go malware. When it came to dissecting Go malware, reverse engineers found themselves faced with a hurdle. Go presents new challenges that make binary analysis more difficult. In order to aid and automate this process, we have created custom scripts for Ghidra. The talk will consist of: Introduction to IoT malware families written in Go. Discussion of the unique features and hurdles of Go binaries. Tackling common problems when reverse engineering Go malware in general and specifically with Ghidra. Sharing our Ghidra scripts that we use during reverse engineering.