On-Demand Workshop Challenge

As seen at AppSec Village @ DEF CON 31

The Challenge: How to Hide Behavior from Security Tools
Detecting application behavior by monitoring library and system calls is a popular technique employed by AppSec tools. These tools can monitor and log activity, block API requests, and so on. In this on-demand workshop, you will learn some techniques to keep your activities hidden from these types of tools, using uncommon / unmonitored APIs, unmonitored processes as confused deputies, and other approaches. You will also learn how popular monitoring frameworks like eBPF work and how to circumvent their monitoring capabilities.

Take the challenge at your convenience: https://github.com/deepfactor-io/appsec-village-pod-dc31

Challenge Outline

1. Overview of monitoring by API interception
2. How tools categorize behavior
   1. Static rules vs behavior catalogs
3. Lab setup
   1. Where to get the exercises, where to run them, etc.
4. Simple Exercises
   1. Evade libc detection through static compilation
   2. Evade detection by changing process name
5. Difficult Exercises
   1. Evade detection by making use of confused deputy
      1. File based operations
      2. Network based operations
   2. Evade detection by not using system calls
      1. io-uring
   3. Evade detection by using uncommon syscalls to do things you want
      1. prctl, fnctl, sendfile, others
      2. write/read variants

Take the challenge at your convenience: https://github.com/deepfactor-io/appsec-village-pod-dc31