Evading and crashing anti-malware solutions via data collection overloading during...
summary
Claims a new exploit class called Telemetry Complexity Attacks that breaks analysis pipelines without elevating privileges by recursively spawning process trees to produce deeply nested, oversized telemetry; implements a self-relaunching XOR onion binary and triggers JSON/BSON depth and size limits and the 16 MB MongoDB cap. Evaluated 18 platforms: 7 fail at serialize/store/render stages, 4 CVEs (two assigned, one pending, one library), dashboards freeze, inserts reject or truncate, and the payload can run unreported; recommends strict agent caps, throttling, and streaming parsers.
AI-written summary · about
chapters (15)
- 0:00Telemetry complexity attacks
- 1:13Opposite of evasion techniques
- 2:36Attack pipeline and process tree
- 3:40Formalizing telemetry attacks
- 5:26Experimental setup and evaluation
- 6:28Case studies on security platforms
- 7:33Cuckoo sandbox failure
- 8:35JSON library vulnerability
- 8:57Recorded Future Triads CVE
- 9:19Wazuh and Velociraptor failures
- 10:00Why EDRs resisted the attack
- 10:44Mitigations and defenses
- 11:49Limitations and attack vectors
- 12:10Responsible disclosure and CVEs
- 12:30Conclusion
related talks
26mWhen Models Write Malware: Defending Against On-demand Exploits
52mFlying Under the Radar - New Security Evasion Techniques
33mProactive EDR Against Adaptive Evasion: Countering Self‑Modifying Agentic Malware
47mDenial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
50mThe Anatomy of Cloud Attacks
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
28mFuzzing Malware for Fun & Profit