Malware Development: Asynchronous Backdoor Built on Public APIs
summary
Shows an asynchronous backdoor that tunnels arbitrary TCP (shell, SOCKS, file transfer) by splitting encrypted TCP data into chunks uploaded to public APIs and reassembling them on a controller. Implementations include a Python client and a Go implant that push encrypted chunks into Grafana logs (5 MB Go binary sent in ~150 requests) and use a driver/provider model to add other API endpoints; live demo provided. Advises strict API rate limits and input size checks to mitigate this covert-channel technique.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 8:00Why use public APIs
- 13:54Hidden communication channels
- 18:06Technical implementation
- 20:55Live demo
- 27:45Summary
related talks
01h 06mComputrace Backdoor Revisited
46mLiving off the Cloud: A Server-Free Approach to Malware Ops
57mHiding In Plain Sight - Advances In Malware Covert Communication Channels
46mAttacks, Lies and the Underground World
32mDissecting FINALDRAFT: Actionable Intel from a State-Sponsored Multi-Platform Backdoor
30mHow to hack an Angular app?
01h 09mThe Critical Path to Implant Backdoors and Potential Mitigation Techniques: Learnings from XZ...
47mReverse Engineering Go Malware: From Manual to AI-Powered Analysis