BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//hack-lu-2023//speaker//D7HLMR
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20221017T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20221030T030000
RDATE:20231029T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20230326T030000
RDATE:20240331T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Using systematic code reuse analysis to create robust YARA rules -
  Jonas Wagner\, Carlos Rubio Ricote
DTSTART;TZID=Europe/Luxembourg:20231017T163000
DTEND;TZID=Europe/Luxembourg:20231017T183000
DTSTAMP:20260809T020429Z
UID:pretalx-hack-lu-2023-GL99GV@pretalx.com
DESCRIPTION:YARA is a commonly used tool to detect and identify malware. T
 here are roughly two types of YARA rules used on binary files: 1) based on
  metadata and strings and 2) based on code.\nThere are certain benefits by
  basing YARA rules on code. Since code reuse is frequent amongst binaries 
 of a malware family\, it offers plenty of options to base a YARA rule on. 
 If the chosen code is heavily reused amongst the binaries\, then it can re
 sult in very robust rules.\nThis approach comes with certain challenges. A
  key aspect is being able to find heavily reused code amongst many binarie
 s of a malware family. Unless some sort of automation is at play\, this qu
 ickly becomes difficult and time-consuming. Once suitable reused code is i
 dentified\, it needs to be turned into a YARA rule\, so that it works even
  when compiler differences\, optimizations or instruction set changes are 
 involved.\nIn this workshop we will create robust YARA rules for a handful
  of malware families based on automatically identifying shared code betwee
 n many binaries of a family.
LOCATION:Vianden&Wiltz
URL:https://pretalx.com/hack-lu-2023/talk/GL99GV/
END:VEVENT
END:VCALENDAR