Collected research
The Adventures of AV and the Leaky Sandbox
Black Hat USA 2017
Malware on an endpoint with no direct internet access hides data in a file that the host's cloud antivirus uploads to its own internet-connected analysis sandbox, where the sample runs and beacons the data out. The AV product itself becomes the egress channel, defeating strict outbound filtering and network segregation, and the researchers released a tool implementing it.
Record
- Document
- Black Hat USA 2017
- Published by
- blackhat.com
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of blackhat.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .