IEEE software taggant system in action

Igor Muttik McAfee
Mark Kennedy Symantec

A working group operating under the umbrella of IEEE has finalized its taggant system, the purpose and the design of which were described at VB2011. The main goal of the taggant system is to block the uncontrolled use of packers to obfuscate malware.

Now the taggant software library has been implemented and we have the infrastructure to support the operation of the system (PKI, revokation, etc.). We will also describe the history of the system development.

We will describe the APIs and demonstrate the following:

operation of the system when it packs the file (view the taggant and the timestamp)
verification of the taggant by AV software
revoking a taggant (aka blacklisting a packer installation)
tampering with the signed file and blocking when the taggant is invalid

We will also discuss the steps in adoption of the system and all benefits for the security community and computer users (some of which are not immediately obvious).