chapter7_malware.pdf

(1)

Computer Security:

Principles and Practice

First Edition First Edition

by William Stallings and Lawrie Brown by William Stallings and Lawrie Brown

Chapter 7 –

(2)

Agenda

 Review Quiz 1_{Review Quiz 1}

 Questions about Lab 3_{Questions about Lab 3}

 Grade Reports_{Grade Reports}

 Malware_Malware

 VirusesViruses

 WormsWorms

 BotsBots

 RootkitsRootkits

 Break_Break

(3)

Malicious Software

 programs exploiting system vulnerabilities_{programs exploiting system vulnerabilities}

 known as malicious software or malware_{known as malicious software or malware}

 program fragments that need a host programprogram fragments that need a host program

• e.g. viruses, logic bombs, and backdoors _{e.g. viruses, logic bombs, and backdoors}

 independent self-contained programsindependent self-contained programs

• e.g. worms, bots_{e.g. worms, bots}

 replicating or notreplicating or not

(4)

Malware Terminology (p. 217)

 _{Virus – replicates itself into other executable code}_{Virus – replicates itself into other executable code}  Worm – runs independently and propagates itself_{Worm – runs independently and propagates itself}

 Logic bomb – program inserted to execute upon trigger_{Logic bomb – program inserted to execute upon trigger}  _{Trojan horse – useful program containing malware}_{Trojan horse – useful program containing malware}

 _{Backdoor (trapdoor) – bypasses normal security check}_{Backdoor (trapdoor) – bypasses normal security check}  _{Mobile code – software that can be shipped over net}_{Mobile code – software that can be shipped over net}  _{Auto-rooter Kit (virus generator) – tools for malware}_{Auto-rooter Kit (virus generator) – tools for malware}  _{Spammer and Flooder programs – spam and DoS}_{Spammer and Flooder programs – spam and DoS}  Keyloggers – Captures keystrokes_{Keyloggers – Captures keystrokes}

 _{Rootkit – hacker tools for a compromised system}_{Rootkit – hacker tools for a compromised system}

(5)

Viruses

 _{piece of software that infects programs}_{piece of software that infects programs}

 modifying them to include a copy of the virusmodifying them to include a copy of the virus

 so it executes secretly when host program is runso it executes secretly when host program is run

 _{specific to operating system and hardware}_{specific to operating system and hardware}

 taking advantage of their details and weaknessestaking advantage of their details and weaknesses

 _{a typical virus goes through phases of:}_{a typical virus goes through phases of:}

 dormantdormant

 propagationpropagation  triggeringtriggering

execution

(6)

Virus Structure

 components:_components:

 infection mechanism - enables replicationinfection mechanism - enables replication

 trigger - event that makes payload activatetrigger - event that makes payload activate

 payload - what it does, malicious or benignpayload - what it does, malicious or benign

 prepended / postpended / embedded _{prepended / postpended / embedded}

 when infected program invoked, executes _{when infected program invoked, executes}

virus code then original program code virus code then original program code

 can block initial infection (difficult)_{can block initial infection (difficult)}

(7)

(8)

(9)

Virus Classification

 boot sector – infects master boot record_{boot sector – infects master boot record}

 file infector – infects OS files_{file infector – infects OS files}

 macro virus – code interpreted by app_{macro virus – code interpreted by app}

 encrypted virus – code encrypted with key_{encrypted virus – code encrypted with key}

 stealth virus – hides itself_{stealth virus – hides itself}

 polymorphic virus – mutates form_{polymorphic virus – mutates form}

(10)

Macro Virus

 became very common in mid-1990s since_{became very common in mid-1990s since}

 platform independentplatform independent

 infect documentsinfect documents

 easily spreadeasily spread

 exploit macro capability of office apps_{exploit macro capability of office apps}

 executable program embedded in office docexecutable program embedded in office doc

 often a form of Basicoften a form of Basic

 _{more recent releases include protection}_{more recent releases include protection}

(11)

E-Mail Viruses

 more recent development_{more recent development}

 e.g. Melissa_{e.g. Melissa}

 exploits MS Word macro in attached docexploits MS Word macro in attached doc

 if attachment opened, macro activatesif attachment opened, macro activates

 sends email to all on users address listsends email to all on users address list

 and does local damageand does local damage

 then saw versions triggered reading email_{then saw versions triggered reading email}

(12)

Virus Countermeasures

 prevention - ideal solution but difficult_{prevention - ideal solution but difficult}

 realistically need:_{realistically need:}

 detectiondetection

 identificationidentification

 removalremoval

 if detect but can’t identify or remove, must _{if detect but can’t identify or remove, must}

(13)

Anti-Virus Evolution

 virus & antivirus tech have both evolved_{virus & antivirus tech have both evolved}

 early viruses simple code, easily removed_{early viruses simple code, easily removed}

 as become more complex, so must the _{as become more complex, so must the}

countermeasures countermeasures

 generations_generations

 first - signature scannersfirst - signature scanners

 second - heuristicssecond - heuristics

 third - identify actionsthird - identify actions

(14)

Generic Decryption

 runs executable files through GD scanner:_{runs executable files through GD scanner:}

 CPU emulator to interpret instructionsCPU emulator to interpret instructions

 virus scanner to check known virus signaturesvirus scanner to check known virus signatures

 emulation control module to manage processemulation control module to manage process

 lets virus decrypt itself in interpreter_{lets virus decrypt itself in interpreter}

 periodically scan for virus signatures_{periodically scan for virus signatures}

 issue is long to interpret and scan_{issue is long to interpret and scan}

(15)

(16)

(17)

Worms

 _{replicating program that propagates over net}_{replicating program that propagates over net}

 using email, remote exec, remote login using email, remote exec, remote login

 has phases like a virus:_{has phases like a virus:}

 dormant, propagation, triggering, executiondormant, propagation, triggering, execution

 propagation phase: searches for other systems, propagation phase: searches for other systems,

connects to it, copies self to it and runs

 _{may disguise itself as a system process}_{may disguise itself as a system process}

 _{concept seen in Brunner’s “Shockwave Rider”}_{concept seen in Brunner’s “Shockwave Rider”}

(18)

Morris Worm

 one of best know worms_{one of best know worms}

 released by Robert Morris in 1988_{released by Robert Morris in 1988}

 various attacks on UNIX systems_{various attacks on UNIX systems}

 cracking password file to use login/password cracking password file to use login/password

to logon to other systems to logon to other systems

 exploiting a bug in the finger protocolexploiting a bug in the finger protocol

 exploiting a bug in sendmailexploiting a bug in sendmail

 if succeed have remote shell access_{if succeed have remote shell access}

(19)

(20)

Recent Worm Attacks

 Code Red_{Code Red}

 July 2001 exploiting MS IIS bugJuly 2001 exploiting MS IIS bug

 probes random IP address, does DDoS attackprobes random IP address, does DDoS attack  consumes significant net capacity when activeconsumes significant net capacity when active

 _{Code Red II variant includes backdoor}_{Code Red II variant includes backdoor}  _{SQL Slammer}_{SQL Slammer}

 early 2003, attacks MS SQL Serverearly 2003, attacks MS SQL Server  compact and very rapid spreadcompact and very rapid spread

 Mydoom_Mydoom

 mass-mailing e-mail worm that appeared in 2004mass-mailing e-mail worm that appeared in 2004

(21)

Worm Technology

 multi-platform_{multi-platform}

 multi-exploit_{multi-exploit}

 ultrafast spreading_{ultrafast spreading}

 polymorphic_polymorphic

 metamorphic_metamorphic

 transport vehicles_{transport vehicles}

(22)

Worm Countermeasures

 overlaps with anti-virus techniques_{overlaps with anti-virus techniques}

 once worm on system A/V can detect_{once worm on system A/V can detect}

 worms also cause significant net activity_{worms also cause significant net activity}

 worm defense approaches include:_{worm defense approaches include:}

 signature-based worm scan filteringsignature-based worm scan filtering

 filter-based worm containmentfilter-based worm containment

 payload-classification-based worm containmentpayload-classification-based worm containment

 threshold random walk scan detectionthreshold random walk scan detection

(23)

(24)

(25)

Bots

 program taking over other computers_{program taking over other computers}

 to launch hard to trace attacks_{to launch hard to trace attacks}

 if coordinated form a botnet_{if coordinated form a botnet}

 characteristics:_{characteristics:}

 remote control facilityremote control facility

• _{via IRC/HTTP etc}_{via IRC/HTTP etc}

 spreading mechanismspreading mechanism

• attack software, vulnerability, scanning strategy_{attack software, vulnerability, scanning strategy}

(26)

Rootkits

 _{set of programs installed for admin access}_{set of programs installed for admin access}

 _{malicious and stealthy changes to host O/S}_{malicious and stealthy changes to host O/S}

 _{may hide its existence}_{may hide its existence}

 subverting report mechanisms on processes, files, registry subverting report mechanisms on processes, files, registry

entries etc entries etc

 _{may be:}_{may be:}

 persistent or memory-basedpersistent or memory-based

 user or kernel modeuser or kernel mode

 _{installed by user via trojan or intruder on system}_{installed by user via trojan or intruder on system}

(27)

(28)

Summary

 introduced types of malicous software_{introduced types of malicous software}

 incl backdoor, logic bomb, trojan horse, mobileincl backdoor, logic bomb, trojan horse, mobile

 virus types and countermeasures_{virus types and countermeasures}

 worm types and countermeasures_{worm types and countermeasures}

 bots_bots