What does THAT do - Ep6 - Spaces and Tabs... just about the worst things ever...

In this episode, I talk about what I consider the most interesting piece of malware I've come across at work, malicious whitespace. I go over how the original code works and show a modified version that, honestly, gives me chills. The fact that I thought of this (and coded up an example in less than an hour) makes me wonder how many bad actors have also thought of it and use it. Article list: 09 Jun 2011 - Kaspersky - Dangerous Whitespaces - https://securelist.com/dangerous-whitespaces/30648/ 02 Nov 2020 - Sucuri - CSS-JS Steganography in Fake Flash Player Update Malware - https://blog.sucuri.net/2020/11/css-js-steganography-in-fake-flash-player-update-malware.html 02 Feb 2021 - Sucuri - Whitespace Steganography Conceals Web Shell in PHP Malware - https://blog.sucuri.net/2021/02/whitespace-steganography-conceals-web-shell-in-php-malware.html Timestamps 00:00 Intro 00:16 Background 01:13 How CoreLibrariesHandler works 03:36 What to watch out for - Large blocks of whitespace 04:09 What to watch out for - File size 04:40 What to watch out for - Comment inversion 05:33 Why a video? 06:07 Retrospection 06:17 Revelations about whitespace encoding 07:20 Example of minimal integral whitespace infection 10:19 Recommendations 10:54 Outro LinkedIn: https://www.linkedin.com/in/maartenjbroekman/ GitHub: https://mjbroekman.github.io/