Workshop @ EthCC 2020: Reversing Ewasm contract 101



2020/03/03 @ EthCC 2020

In this talk, I briefly introduce WebAssembly concepts , Ewasm specificity and opcodes/instructions. Secondly, I show how to create Ewasm smart contract and expose different techniques/tools to perform WebAssembly module closed-source analysis. Finally, we go through some basic examples to apply reversing (reverse engineering) on those Ewasm contracts and understand the logic inside.


slides

Blogpost: How to create a valid polyglot HTML/JS/WebAssembly module


2019/11/20 @ webassembly-security.com

In this blogpost, I will first explain the WebAssembly binary format and its sections. Then, I’ll demonstrate how to create a valid polyglot wasm module that contain an html/js payload embedded using 2 different techniques. Finally, I’ll give you the link to the github repository if you want to try on your own and learn more about WebAssembly 


link, pdf

Workshop @ Hack.lu 2019: Reversing WebAssembly Module 101


2019/10/22 @ Hack.lu 2019

In this workshop, I will first introduce WebAssembly concepts and why it’s consider as a “game changer for the web”. Secondly, I will expose how to analyze a WebAssembly module using different techniques (static & dynamic) as well as some open-source tools that make you the life easier (Octopus, Wasabi, …). Finally, we will hands-on with simple examples/crackmes and finally go throws the analysis of cryptominers.

The following point will be discussed in this workshop.

  1. Introduction
  2. WebAssembly Basics
  3. WebAssembly Runtime VM
  4. Module dissection
  5. Reversing wasm module
  6. Dynamic analysis
  7. Cryptominers
  8. Conclusion

link / slides / repository

Blogpost: Analysis of Google Keep WebAssembly module​

webassembly wasm security google keep patrick ventuzelo reversing analysis emscripten

2019/07/16 @ webassembly-security.com

Is WebAssembly already used in the wild?

The answer is of course YES and some WebAssembly modules are potentially running right now in your browser if you are using Google web services. Recently, Google was using WebAssembly for the beta version of Google Earth but also in production for services like Google Keep.

  1. Google Keep Wasm Module & JS File Extraction
  2. WebAssembly Module Reversing
  3. Extract Build Information
  4. What is Sketchology and Ink?
  5. Reversing Protobuf Encoded Blobs
  6. Extract WebGL Vertex Shader Structure
  7. Absolute path, Error messages, Mangling & Constant names
  8. Going Deeper & Conclusion

link, pdf

Talk @ FIRST 2019: Analyze & Detect WebAssembly Cryptominer


2019/06/17 @ FIRST conference 2019

More than one year after the “official” release, it’s heavily used in the wild to perform Cryptojacking (illegitimate in-browser mining) using online services, like Coinhive, that provides simple Javascript API and uses WebAssembly module to make mining even more efficient and profitable than using pure JavaScript.

First, I will introduce WebAssembly concepts and how it is currently used. Secondly, I will analyze some Cryptominer module using static and dynamic analysis (reversing, decompilation, DBI, …) applied on WebAssembly. Finally, I will expose some techniques to detect and mitigate them.

  1. Introduction
  2. WebAssembly Basics
  3. Module dissection
  4. Program analysis
  5. WebAssembly Cryptominers
  6. Analysis (Coinhive & Cryptoloot)
  7. Cryptominers detection
  8. Conclusion

link / slides

Workshop @ Northsec 2019: Reversing WebAssembly Module 101


2019/05/21 @ Northsec 2019

In this workshop, I will first introduce WebAssembly concepts and why it’s consider as a “game changer for the web”. Secondly, I will expose different techniques (Static/Dynamic analysis) and tools (OctopusWasabi, …) to perform a WebAssembly module analysis. Finally, we will hands-on with basic examples (crackmes) and go throws some real-life cryptominer and web-browsers plugins using WebAssembly module.

Along the talk, I will only used open source tools.

  1. Introduction
  2. WebAssembly Basics
  3. WebAssembly Runtime VM
  4. WebAssembly VM internals
  5. Module dissection
  6. Program analysis
  7. Wasabi
  8. Cryptominers
  9. Firefox addons analysis
  10. Conclusion

link / slides (not yet) / repository

Blogpost: Ethereum Threat Actors Part 3 — Phishings/Scams using Smart Contracts

Ethereum smart contract  malware  threat actor phishing patrick ventuzelo blogpost quoscient analysis scams

2019/04/03 @ QuoScient Medium

In part three of our mini-series (see part #1 & part #2) describing how cybercrime actors are using the Ethereum blockchain for fraudulent means, we analyze a phishing tactic that used a smart contract address. Interestingly, this smart contract is not unique and the exact same closed-source bytecode is used in more than 130 thousand smart contracts.

  1. Phishing on Forums/Telegram.
  2. Quick analysis of the Smart contract Bytecode
  3. Who is behind 0xAf1931c20ee0c11BEA17A41BfBbAd299B2763bc0?
  4. Similar Luno user wallets Used for Phishing
  5. Conclusion
  6. Indicator of Compromise

link / pdf