Visualization Tools may Cut Through the Security Logjam
Black Hat presentations show a new spin on detecting potential threats.
On a small scale, you can look at these kinds of files in a hex editor, Conti says, but "by creating graphical displays, you can show 900 times more information in the same amount of screen space."
Even though the images may look like television static, Conti says with experience and practice, researchers may be able to discern certain kinds of structures within binary files by scrutinizing repeating patterns that emerge in the visualizations. With the high-level view, a researcher can identify regions of the file where interesting information may be located and drill down to that location.
Although the DanglyBytes program is still in a very early beta stage, it's still able to render a number of different kinds of images, providing a surprising amount of information. In his demonstration, Conti browsed through a memory dump Windows created when his copy of the Mozilla Firefox browser crashed. Buried within the memory dump were copies of graphics that had been loaded in the browser when it crashed, including the Google and Wikipedia logos. "Every time I've done a visualization, I've been surprised with the result," Conti says. "I've found things I couldn't anticipate."
Andrew Brandt writes about computer security when he's not analyzing malware at his day job.
visualization
Receive the latest security news as it breaks.
