Malware Riding Badware: Challenges in Analyzing (Malicious/Benign) Web Applications

Abstract

The Web has become a dangerous place, where simple rules of behavior no longer keep a user out of trouble. Sophisticated drive-by download attacks delivered through compromised web sites are reaching users through seemingly innocuous search engine queries. Malicious web pages are turning helpless victims into armies of bots that participate in a historically unprecedented transfer of wealth in the form of intellectual property, trade secrets, and classified information. This talk describes how this problem can be tackled from two different points of view: the identification of the web application vulnerabilities that allow for site compromise and the detection of web-based malware that attacks the users’ browsers. These two issues go hand-in-hand, and require automated approaches in order to keep up with the pace at which cybercriminals devise new ways to exploit and hijack web applications and browsers.