I would like to announce the formation of the FireEye Labs Advanced
Reverse Engineering (FLARE) team. As part of FireEye Labs, the focus
of this team is to support all of FireEye and Mandiant from a reverse
engineering standpoint. Many FireEye groups have reversing engineering
needs: Global Services discovers malware during incident response,
Managed Defense constantly discovers threats on monitored client
networks, and Products benefit from in-depth reversing to help improve
detection capabilities.
We primarily focus on malware analysis, but we also perform
red-teaming of software and organizations, and we develop tools to
assist reverse engineering. Our research and tools assist with
automatic malware triage to quickly get initial results out to
incident responders in the field. Auto-unpackers unravel obfuscated
samples without the need for an analyst. Automatic clustering and
classifying samples helps identify if a binary is good or bad and
whether we have analyzed it before. We develop reverse engineering
scripts for IDA Pro and systems that help us quickly share our
analysis results. We also write scripts that can help incident
responders decrypt and interpret malware network traffic and host artifacts.
This elite technical enclave of reversers, malware analysts,
researchers, and teachers, will team up with our FireEye Labs peers to
help bring the best detection to our customers and promote knowledge
sharing with the security research community. We’ll continue to
provide technical training on malware analysis privately and at
conferences like Black Hat. Look for us to present webinars on malware
analysis and a blog series of scripts for IDA Pro to aid reverse
engineering of malware.
The Challenge
To commemorate our launch, the FLARE team is hosting a challenge for
all reverse engineers and malware analysts. We invite you to compete
and test your skills. The challenge runs the gamut of skills we
believe are necessary to succeed on the FLARE team. We invite everyone
who is interested to solve the challenge and get their just reward!
The puzzles were developed by Richard Wartell, a reverse engineer
with a PhD in “IDA Pro” (actually Computer Science, but his thesis
used IDA Pro) from the University of Texas at Dallas where he worked
on binary rewriting techniques for the x86 instruction set. He
recently presented this work at the REcon conference in Montreal. At
Mandiant Richard focused on incident response, but now on the FLARE
team he reverse engineers malware, teaches malware classes, and helps
develop our auto-unpacking technology.
As reverse engineers we’ve seen a variety of anti-reverse engineering
techniques. Oftentimes the armoring malware authors employ is
sophisticated and requires time to unravel. Sometimes it is misguided
and easily circumvented.
Writing these binary puzzles has given us a chance to recreate some
of the sophisticated (and sometimes ridiculous) techniques we see. The
seven puzzles start with basic skills and escalate quickly to more
difficult reversing tasks. At FLARE we have to deal with whatever
challenges come our way, so the challenge reflects this. If you take
on the challenge you might see malicious PDFs, .NET binaries,
obfuscated PHP, Javascript, x86, x64, PE, ELF, Mach-O, and so on.
And after completing the final challenge, you’ll win a prize and be
contacted by a FLARE team member. The full details can be found at:
So on behalf of the FLARE team, I say Happy Reversing!