Memory Analysis, Meet GPU Malware

Oct 22, 2014

Download: MP4 Video Size: 170.0MB  
Watch on YouTube

Abstract

Graphics Processing Units (GPUs) have evolved from very specialized,
idiosyncratic hardware intended to execute specialized graphics workloads
to semi-autonomous "supercomputers" that can be programmed easily using
common programming languages and powerful, portable APIs. GPUs also form
the basis for an emerging threat, GPU malware, which offloads important
aspects of malicious computations onto the GPU. The benefits of executing
malicious computations on the GPU include abundant compute power, a large
amount of semi-non-volatile memory, and perhaps most importantly, isolation
from host-based security measures. While memory analysis offers powerful
tools to detect and analyze traditional host-based malware, there are
essentially no equivalent tools for analyzing GPU malware. Furthermore,
existing general-purpose tools for debugging GPU applications are
completely ineffective if a large number of conditions are not established
before a GPU application is executed, all of which will certainly be
violated by weaponized GPU malware. This talk explores GPU malware in
detail, identifies why it's hard to analyze, and also discusses measures
that can easily employed to make analysis even more difficult. A primary
motivation for this research is the 2015 DFRWS Digital Forensics Challenge,
under development by Dr. Richard, the aim of which is to increase interest
in GPU malware analysis and foster the development of powerful tools to
analyze and combat this threat.