HTTP Statuses as C2 Commands and Compromised TLS
Explore advanced malware techniques and innovative command and control methods in this Hack In The Box Security Conference talk. Delve into the analysis of COMPFun malware, examining its evolution from 2014 to 2019. Learn about the malware's ability to compromise TLS-encrypted communications in HTTPS, its use of rare HTTP statuses as commands, and its sophisticated injection methods. Discover how the malware manipulates system PRNG functions to mark and distinguish target traffic, even after NAT routing. Investigate the malware's spreading capabilities through USB devices and its potential for air-gap breaches. Gain insights into the creative and persistent nature of COMPFun developers, and understand the challenges faced by security researchers in analyzing such advanced threats.