Show simple item record

dc.contributor.authorZarate, Carolina
dc.contributor.authorGarfinkel, Simson L.
dc.contributor.authorHeffernan, Aubin
dc.contributor.authorGorak, Kyle
dc.contributor.authorHorras, Scott
dc.date.accessioned2014-01-30T16:05:07Z
dc.date.available2014-01-30T16:05:07Z
dc.date.issued2014-01-17
dc.identifier.urihttp://hdl.handle.net/10945/38680
dc.description.abstractTo determine the usage of XOR and the need to adapt additional tools, we analyzed 2,411 drive images from devices acquired around the world for the use of bytewise XOR as an obfuscation technique. Using a modified version of the open source digital forensics tool bulk˙extractor, evidence of XOR obfuscation was found on 698 drive images, with a maximum of 21,031 XOR-obfuscated features on a single drive. XOR usage in our corpus was observed in files with timestamps between the years 1995 and 2009, but the majority use was found in unallocated space. On the corpus tested, XOR obfuscation was used to circumvent malware detection and reverse engineering, to hide information that was apparently being exfiltrated, and by malware detection tools for their quarantine directory and to distribute malware signatures. We conclude that XOR obfuscation is important to consider when performing malware investigations.en_US
dc.description.sponsorshipThe Department of the Navyen_US
dc.language.isoen_US
dc.publisherMonterey, California. Naval Postgraduate Schoolen_US
dc.rightsThis publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.en_US
dc.subjectXORen_US
dc.titleA Survey of XOR as a Digital Obfuscation Technique in a Corpus of Real Dataen_US
dc.typeTechnical Reporten_US
dc.contributor.departmentComputer Science
dc.identifier.npsreportNPS-CS-13-005
dc.description.distributionstatementApproved for public release; distribution is unlimited.


Files in this item

Thumbnail

This item appears in the following Collection(s)

Show simple item record