Talk @ FIRST 2019: Analyze & Detect WebAssembly Cryptominer


2019/06/17 @ FIRST conference 2019

WebAssembly (WASM) is a new binary format currently developed and supported by all major browsers including Firefox, Chrome, WebKit /Safari and Microsoft Edge through the W3C.

More than one year after the “official” release, it’s heavily used in the wild to perform Cryptojacking (illegitimate in-browser mining) using online services, like Coinhive, that provides simple Javascript API and uses WebAssembly module to make mining even more efficient and profitable than using pure JavaScript.

First, I will introduce WebAssembly concepts and how it is currently used. Secondly, I will analyze some Cryptominer module using static and dynamic analysis (reversing, decompilation, DBI, …) applied on WebAssembly. Finally, I will expose some techniques to detect and mitigate them.

Along the talk, I will used multiple open source tools but also Octopus, a Security Analysis tool for WebAssembly module, that I have developed and already available on Github (https://github.com/quoscient/octopus).

  1. Introduction
  2. WebAssembly Basics
  3. Module dissection
  4. Program analysis
  5. WebAssembly Cryptominers
  6. Analysis (Coinhive & Cryptoloot)
  7. Cryptominers detection
  8. Conclusion

link / slides

Workshop @ Northsec 2019: Reversing WebAssembly Module 101


2019/05/21 @ Northsec 2019

WebAssembly (WASM) is a new binary format currently supported by all major browsers (Firefox, Chrome, WebKit /Safari and Microsoft Edge) and executed inside JS scripts. It is already used for malicious purposes like Cryptojacking and can be found inside some web-browsers addons.

In this workshop, I will first introduce WebAssembly concepts and why it’s consider as a “game changer for the web”. Secondly, I will expose different techniques (Static/Dynamic analysis) and tools (OctopusWasabi, …) to perform a WebAssembly module analysis. Finally, we will hands-on with basic examples (crackmes) and go throws some real-life cryptominer and web-browsers plugins using WebAssembly module.

Along the talk, I will only used open source tools.

  1. Introduction
  2. WebAssembly Basics
  3. WebAssembly Runtime VM
  4. WebAssembly VM internals
  5. Module dissection
  6. Program analysis
  7. Wasabi
  8. Cryptominers
  9. Firefox addons analysis
  10. Conclusion

link / slides (not yet) / repository

Talk @ EthCC 2019: Let’s dig inside Ethereum Smart Contracts compiled to WebAssembly

Ethereum ETHCC Paris reverse webassembly patrick ventuzelo analysis smart contract Parity Kovan mainnet testnet conference talk


2019/02/18 @ EthCC 2019

At Devcon4, Vitalik annonced that WebAssembly (wasm) will be part of Ethereum 2.0 (Serenity). It’s already possible to compile smart contracts to wasm modules and run them in the Kovan network.

Using WebAssembly smart contract doesn’t mean using secure smart contract.

In this talk, I will explain what’s inside a WebAssembly module and illustrate how to analyze wasm Ethereum smart contracts to find vulnerabilities and unoptimization.

  1. Introduction
  2. WebAssembly basics
  3. Program analysis
  4. Parity Helloworld
  5. WASM module Vulnerabilities
  6. Conclusion

link / slides / video

Talk @ ToorCon XX – 2018: Dissection of WebAssembly module

 

toorcon webassembly wasm patrick ventuzelo reversing analysis ethereum evm


2018/09/15 @ ToorCon XX – 2018

WebAssembly (WASM) is a new binary format currently developed and supported by all major browsers including Firefox, Chrome, WebKit /Safari and Microsoft Edge through the W3C. This new format have been designed to be “Efficient and fast“, “Debuggable“ and “Safe” that why it is often called as the “game changer for the web“. More than one year after the “official” release, it is not only used “for the web” by web browsers but also in some (huge) other projects like Blockchain Smart Contract platforms (EOS and Ethereum).

I will first introduce WebAssembly concepts and who currently used it in the wild. Secondly, I will show different WebAssembly VM available and explain the security measures implemented into it. Finally, I will show you, throw real life WASM modules, how to do static analysis, using techniques such as reversing, control flow and calls flow analysis, to understand deeper its behaviors. Along the talk, I will used multiple open source tools but mainly the one that I have developed and that is already available on Github (Octopus).


link / slides / video

Talk @ Recon MTL 2018: Reverse Engineering Of Blockchain Smart Contracts

recon montreal reverse ethereum blockchain smart contract neo eos webassembly patrick ventuzelo


2018/06/16 @ RECON Montreal 2018

Many platforms using blockchain technology have emerged in 2017 and take the top 10 position of the cryptocurrencies’s MarketCap. One of the main reasons behind is the possibility to create decentralized applications (dapps) by writing Smart Contracts.

During this presentation, we will analyze the implementation of smart contract mechanism (Virtual Machine, assembly language, instructions sets, …) used by those platforms. We will analyze the assembly languages and instructions sets used by the Virtual Machine of the major blockchain platforms.

We will see how to disassemble and reconstruct the CFG (Control Flow Graph) of those smart contracts and the tools actually available to perform a deeper security analysis.

This talk aims at covering the following platforms:


link / slides / video (not yet)