GPU-assisted malware

Abstract

Malware writers constantly seek new methods to increase the infection lifetime of their malicious software. To that end, techniques such as code unpacking and polymorphism have become the norm for hindering automated or manual malware analysis and evading virus scanners. In this paper, we demonstrate how malware can take advantage of the ubiquitous and powerful graphics processing unit (GPU) to increase its robustness against analysis and detection. We present the design and implementation of brute-force unpacking and runtime polymorphism, two code armoring techniques based on the general-purpose computing capabilities of modern graphics processors. By running part of the malicious code on a different processor architecture with ample computational power, these techniques pose significant challenges to existing malware detection and analysis systems, which are tailored to the analysis of CPU code. We also discuss how upcoming GPU features can be used to build even more robust and evasive malware, as well as directions for potential defenses against GPU-assisted malware.

The impact of GPU-assisted malware on memory forensics: A case study

“…Several examples of GPU-assisted malware have been analyzed so far (Vasiliadis et al, Oct 2010;Ladakis et al, 2013;Triulzi, 2008;Danisevskis et al, 2014). For instance, in Ladakis et al (2013) the GPU is used to implement a stealthy keylogger.…”

“…To access the keyboard buffer, the GPU uses the physical addressing through DMA, without any CPU intervention. In (Vasiliadis et al, Oct 2010) the authors present a proof-of-concept which leverages GPU to unpack the code of a malware with a XOR-based encryption scheme using several random keys. To hinder the analysis, the malware's code is unpacked at runtime and the decryption keys are stored in the device memory, that is not accessible from the CPU.…”

“…In (Vasiliadis et al, Oct 2010), the authors propose to use the GPU to implement a stealthy keylogger that runs inside the graphic card and accesses through DMA the physical page containing the keyboard buffer. This makes the detection of the keylogger functionality more difficult, as the keyboard buffer does not appear in the list of memory pages mapped by the malicious process.…”

“…To the best of our knowledge, no GPU-assisted malware has been discovered in the wild e with the sole exception of BadMiner (ArsTechnica, 2015) which exploits the presence of a GPU to mine bitcoins. However, researchers have already shown that several malicious activities can take advantage of GPUs, for instance to steal sensitive information (Kotcher et al, 2013;Lee et al, 2014), unpack malicious code (Vasiliadis et al, Oct 2010), and hide malicious activities from malware detection and analysis tools (Triulzi, 2008;Ladakis et al, 2013). It is important to notice that these threats are not confined to the graphic environment (e.g., screen grabbing or unrestricted access to GPU memory) but that GPUs can also be abused to perform attacks that are outside the graphic domain.…”

Experiencing Cybersecurity One Game at a Time: A Systematic Review of Cybersecurity Digital Games

“…Given the increasing number of cyber-attacks, more cyber professionals are needed (Symantec Corp., 2018). However, there exists a shortage of qualified individuals.…”