4

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious.

If so, what will be some of the false positives? will a normal user who just wants to install normal apps and browse the web be effected?

I just don't understand why would an benign app need to do this? And how common is it? For example, if it is only 1 in a billion benign app that does this, then why allow it at all?

  • Do you have something in mind in which such a thing is a vulnerability? – Luaan Oct 6 at 17:42
4

Well the problem with this approach is that the injection happens using the WinAPI which is also used by native windows applications. A very common chain that has been out there in the wild for a while now is the following one:

OpenProcess -> VirtualAllocEx -> WriteProcessMemory -> CreateRemoteThread

and variants. If you notice all of the above functions are part of the WinAPI. Now let's study what exactly each of these functions do. From the MSDN docs:

OpenProcess: Opens an existing local process object. The access to the process object. This access right is checked against the security descriptor for the process.

So this is a simple function that justs allows an application to get a handle and interact with another process if it has the appropriate rights. This is very common to happen on windows for various applications.

VirtualAllocEx: Reserves, commits, or changes the state of a region of memory within the virtual address space of a specified process. The function initializes the memory it allocates to zero.

So again this function can be used to allocate some memory space which is useful if e.g. someone wants to make a custom memory manager for an application. Even malloc which is used a lot in C/C++ programming in its core uses VirtualAllocEx and variants.

WriteProcessMemory: Writes data to an area of memory in a specified process. The entire area to be written to must be accessible or the operation fails.

Well, what is the point of allocating space if you can't write to it (if you have the appropriate privileges/rights of course).

CreateRemoteThread: Creates a thread that runs in the virtual address space of another process.

Creating threads is useful for many reasons. In this case - it is just a way we can execute the process we already have a handle for, using OpenProcess from above.

In addition a variant of the above routine is also used for DLL injection/hooking which is used e.g. by software debuggers.

So as you can see this technique is often used to inject malicious code but it is also used by built-in applications. For this reason there are other techniques (e.g. code signature etc...) to prevent malware infection/injection. The bad news is that unfortunately there are also ways to bypass some of these techniques.

  • why would debuggers need to do DLL injection/hooking? i thought they just instrument instructions with 0xCC and rewrite the overwritten part when its hit? and what are other use cases other than debuggers for creating remote thread? considering we don't have that many debuggers then can't AVs just say its malware if its not a known debugger? – Max Oct 6 at 14:07
  • To answer your first question there is a great post here. Also debuggers was only an example, e.g. without being 100% sure I believe that e.g. pygame uses it to monitor keystrokes etc... DLL injection/hooking can also be used for monkey patching. – game0ver Oct 6 at 14:23
  • The CreateRemoteThread is not that bad on its own, in many programming languages it's allowed to spawn a thread of another process, then it gets why process vs thread and vice versa... – game0ver Oct 6 at 14:24
  • As for the AV behavior I cannot be sure what is being used out there, there are a LOT of available AVs, I guess and from some personal research I've seen that some of them will give special attention when those functions are in use. – game0ver Oct 6 at 14:25
  • @Max, the technique you mention is really only good for breakpoints, and perhaps for profiling. For other things, such as resource leak tracking, it's much easier to inject an instrumented library than it is to identify and instrument every call to the library. – Mark Oct 6 at 19:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.