What does THAT do - Ep6 - Spaces and Tabs... just about the worst things ever...
Channel: Maarten Broekman
Date: 21/06/2021

In this episode, I talk about what I consider the most interesting piece of malware I've come across at work, malicious whitespace. I go over how the original code works and show a modified version that, honestly, gives me chills. The fact that I thought of this (and coded up an example in less than an hour) makes me wonder how many bad actors have also thought of it and use it.

Article list:
09 Jun 2011 - Kaspersky - Dangerous Whitespaces - https://securelist.com/dangerous-whitespaces/30648/
02 Nov 2020 - Sucuri - CSS-JS Steganography in Fake Flash Player Update Malware - https://blog.sucuri.net/2020/11/css-js-steganography-in-fake-flash-player-update-malware.html
02 Feb 2021 - Sucuri - Whitespace Steganography Conceals Web Shell in PHP Malware - https://blog.sucuri.net/2021/02/whitespace-steganography-conceals-web-shell-in-php-malware.html

Timestamps
00:00 Intro
00:16 Background
01:13 How CoreLibrariesHandler works
03:36 What to watch out for - Large blocks of whitespace 
04:09 What to watch out for - File size
04:40 What to watch out for - Comment inversion
05:33 Why a video?
06:07 Retrospection
06:17 Revelations about whitespace encoding
07:20 Example of minimal integral whitespace infection
10:19 Recommendations
10:54 Outro

LinkedIn: https://www.linkedin.com/in/maartenjbroekman/
GitHub: https://mjbroekman.github.io/