Shakacon #6 presentation: Fuck you Hacking Team, From Portugal with Love.

Fuck you Hacking Team, From Portugal with Love.

Aloha,

Shakacon number 6 is over, it was a blast and I must confess it beat my expectations. Congratulations to everyone involved in making it possible. Definitely recommended if you want to speak or attend, and totally worth the massive jet lag.

My presentation was about reverse engineering Hacking Team OS X malware latest known sample. The slide count is 206 and I was obviously not able to present everything. The goal is that you have a nice reference available for this malware and also MPRESS unpacking (technically dumping).

This sample in particular was thought to be a newer version of this malware but I try to show you that I don’t think it’s the case and instead, it’s the oldest version of Hacking Team OS X malware. If this theory is true, it means we have a two years knowledge gap about the OS X version. Interesting challenge ahead!

The tool I promised to release will have to wait a couple more days since I need to fix its code to implement the fixes I suggest regarding the file and memory sizes differences. Keep watching this space, Github or Twitter.

Update: MPRESS dumper source code now available at Github.

Mahalo,
fG!

Links to slides (34.3Mb):
ShakaCon6-FuckYouHackingTeam.pdf