26
K. Salah 1 Malware Malware

Malware

  • Upload
    linore

  • View
    48

  • Download
    0

Tags:

Embed Size (px)

DESCRIPTION

Malware. Malcode Taxonomy. The Ten Most Common Critical Cyber Security Threats. Malware attack with Social Engineering Tactics SPAM DoS and DDoS attack Phishing and Pharming (identity theft) Botnets IM and P2P attack Mobile and Wireless attack (Wi-Fi and Bluetooth) Rootkits - PowerPoint PPT Presentation

Citation preview

Page 1: Malware

K. Salah 1

MalwareMalware

Page 2: Malware

K. Salah 2

Malcode TaxonomyMalcode Taxonomy

Page 3: Malware

K. Salah 3

Page 4: Malware

K. Salah 4

Page 5: Malware

K. Salah 5

The Ten Most Common Critical Cyber The Ten Most Common Critical Cyber Security ThreatsSecurity Threats1.1. Malware attack with Social Engineering TacticsMalware attack with Social Engineering Tactics2.2. SPAMSPAM3.3. DoS and DDoS attackDoS and DDoS attack4.4. Phishing and Pharming (identity theft)Phishing and Pharming (identity theft)5.5. BotnetsBotnets6.6. IM and P2P attackIM and P2P attack7.7. Mobile and Wireless attack (Wi-Fi and Bluetooth)Mobile and Wireless attack (Wi-Fi and Bluetooth)8.8. RootkitsRootkits9.9. Web Application HackingWeb Application Hacking10.10. Hacking with GoogleHacking with Google

Page 6: Malware

K. Salah 6

Most Advanced Critical Cyber Security Most Advanced Critical Cyber Security ThreatsThreats1.1. Zero Day AttackZero Day Attack2.2. Web 2.0 AttackWeb 2.0 Attack3.3. VoIP AttackVoIP Attack4.4. Web Services AttackWeb Services Attack5.5. USB AttackUSB Attack

Page 7: Malware

K. Salah 7

Attack on the Critical InfrastructureAttack on the Critical Infrastructure

Government OperationsGovernment OperationsTelecommunicationsTelecommunicationsElectrical EnergyElectrical EnergyGas & Oil Storage and DeliveryGas & Oil Storage and DeliveryWater Supply SystemsWater Supply SystemsBanking & FinanceBanking & FinanceTransportationTransportation

Page 8: Malware

K. Salah 8

Virus, Spam and Spyware RelationshipVirus, Spam and Spyware Relationship

Antispam

Antivirus

Antispyware

Spam

Virus Spyware

Worm Phish/ Adware

Zombie/ Trojan

Page 9: Malware

K. Salah 9

Digital Forensics AnalysisDigital Forensics Analysis1.1. Incident NotificationIncident Notification2.2. Understand Nature of IncidentUnderstand Nature of Incident3.3. InterviewInterview4.4. Obtain AuthorizationObtain Authorization5.5. Verify ScopeVerify Scope6.6. Team AssemblyTeam Assembly7.7. Document work areaDocument work area8.8. Document Incident EquipmentDocument Incident Equipment9.9. Move EquipmentMove Equipment10.10. Prepare two imagesPrepare two images11.11. Preserve/ Protect First ImagePreserve/ Protect First Image12.12. Use second Image for restoration and ExaminationUse second Image for restoration and Examination13.13. Data Extraction and AnalysisData Extraction and Analysis14.14. Watch Assumptions – Date /timeWatch Assumptions – Date /time15.15. Review Log / InterviewReview Log / Interview16.16. AnalysisAnalysis17.17. Prepare findingsPrepare findings18.18. Lesson LearnedLesson Learned

Page 10: Malware

K. Salah 10

Anti-forensic techniquesAnti-forensic techniques Anti-forensic techniquesAnti-forensic techniques try to frustrate try to frustrate forensic investigatorsforensic investigators and and

their their techniquestechniques1.1. Overwriting Data and MetadataOverwriting Data and Metadata

1. Secure Data Deletion2. Overwriting Metadata3. Preventing Data Creation

2.2. Cryptography, Steganography, and other Data Hiding ApproachesCryptography, Steganography, and other Data Hiding Approaches1. Encrypted Data2. Encrypted Network Protocols3. Program Packers4. Steganography5. Generic Data Hiding

ExamplesExamples Timestomp

Changes the dates of computer files (4 timestamps of NTFS). Encase shows blanks. Slacker

Store files in the slack of disk blocks

http://www.forensicswiki.org/index.php?title=Forensic_investigator&action=edit
http://www.forensicswiki.org/wiki/Techniques
Page 11: Malware

K. Salah 11

Virus TechniquesVirus Techniques

TSRTSR Virus can hide in memory even if program has stopped

or been detected Stealth VirusesStealth Viruses

Execute original code Size of file stays the same after infection Hide in memory within a system process

Virus infects OS so that if a user examines the infected file, it appears normal

Encrypted/Polymorphic VirusesEncrypted/Polymorphic Viruses To hide virus signatures encrypt the code Have the code mutate to prevent signatures scanning

Page 12: Malware

K. Salah 12

Polymorphic VirusesPolymorphic Viruses

Page 13: Malware

K. Salah 13

Virus CleaningVirus Cleaning

Remove virus from fileRemove virus from fileRequires skills in software reverse Requires skills in software reverse

engineeringengineering Identify beginning/end of payload and Identify beginning/end of payload and

restore to originalrestore to original

Page 14: Malware

K. Salah 14

How hard is it to write a virus?How hard is it to write a virus?

Simple Google search for “virus Simple Google search for “virus construction toolkit”construction toolkit”

www.pestpatrol.comwww.pestpatrol.comTons of othersTons of othersConclusion: Not hardConclusion: Not hard

http://www.pestpatrol.com/
Page 15: Malware

K. Salah 15

Attaching codeAttaching code

Page 16: Malware

K. Salah 16

Integrate itselfIntegrate itself

Page 17: Malware

K. Salah 17

Completely replaceCompletely replace

Page 18: Malware

K. Salah 18

Boot Sector VirusBoot Sector Virus

Page 19: Malware

K. Salah 19

How viruses workHow viruses work

AttachAttach Append to program, e-mail

Executes with program Surrounds program

Executes before and after program Erases its tracks

Integrates or replaces program code Gain controlGain control

Virus replaces target ResideReside

In boot sector Memory Application program Libraries

Page 20: Malware

K. Salah 20

Cont’dCont’d

DetectionDetection Virus signatures Storage patterns Execution patterns Transmission patterns

PreventionPrevention Don’t share executables Use commercial software from reliable sources Test new software on isolated computers Open only safe attachments Keep recoverable system image in safe place Backup executable system file copies Use virus detectors Update virus detectors often

Page 21: Malware

K. Salah 21

Virus Effects and CausesVirus Effects and CausesVirus EffectVirus Effect How it is causedHow it is caused

Attach to executableAttach to executable Modify file directoryModify file directoryWrite to executable program fileWrite to executable program file

Attach to data/control fileAttach to data/control file Modify directoryModify directoryRewrite dataRewrite dataAppend to dataAppend to dataAppend data to selfAppend data to self

Remain in memoryRemain in memory Intercept interrupt by modifying interrupt handler address tableIntercept interrupt by modifying interrupt handler address tableLoad self in non-transient memory areaLoad self in non-transient memory area

Infect disksInfect disks Intercept interruptIntercept interruptIntercept OS call (to format disk, for example)Intercept OS call (to format disk, for example)Modify system fileModify system fileModify ordinary executable programModify ordinary executable program

Conceal selfConceal self Intercept system calls that would reveal self and falsify resultsIntercept system calls that would reveal self and falsify resultsClassify self as “hidden” fileClassify self as “hidden” file

Spread selfSpread self Infect boot sectorInfect boot sectorInfect systems programInfect systems programInfect ordinary programInfect ordinary programInfect data ordinary program reads to control its executableInfect data ordinary program reads to control its executable

Prevent deactivationPrevent deactivation Activate before deactivating program and block deactivationActivate before deactivating program and block deactivationStore copy to reinfect after deactivationStore copy to reinfect after deactivation

Page 22: Malware

K. Salah 22

Virus vs. WormVirus vs. Worm

Both are Malicious Code Virus does harm Worm consumes resources

Page 23: Malware

K. Salah 23

Exploitation of Flaws:Exploitation of Flaws: Targeted Malicious Code Targeted Malicious Code TrapdoorsTrapdoors

Undocumented entry point in code Program stubs during testing Intentionally or unintentionally left

Forgotten Left for testing or maintenance Left for covert access

Salami attackSalami attack Merges inconsequential pieces to get big results A salami attack is a series of minor data-security attacks that

together results in a larger attack. • For example, a fraud activity in a bank where an employee steals a

small amount of funds from several accounts, can be considered a salami attack, i.e. deliberate diversion of fractional cents

Too difficult to audit

Page 24: Malware

K. Salah 24

Covert ChannelsCovert Channels An example of human/student covert channel Programs that leak information

Trojan horse Discovery

Analyze system resources for patterns Flow analysis from a program’s syntax

(automated) Difficult to close

Not much documented Potential damage is extreme

Exploitation of Flaws:Exploitation of Flaws: Targeted Malicious Code Targeted Malicious Code (cont’d.)(cont’d.)

Page 25: Malware

K. Salah 25

File lock covert channelFile lock covert channel

Page 26: Malware

K. Salah 26

Race ConditionsRace Conditions

In wu-ftpd v2.4 In wu-ftpd v2.4 Allows root accessAllows root accessSignal handlingSignal handling

SIGPIPE EUID=user changes to EUID=root to logout the user

and access privileged operations and files It takes some time to do this

SIGURG Logging out is broken/stopped and prompt is gotten

back with EIUD=root


Open Source Malware Lab - 0x7e0.bsidesljubljana.si · 3 All material confidential and proprietary Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware

Open Source Malware Lab - 0x7e0.bsidesljubljana.si · 3 All material confidential and proprietary Why Do I Need A Malware Analysis Lab? • Malware Research • Automated Malware

Documents
Malware & Anti-Malware

Malware & Anti-Malware

Engineering
Malware Economics and its Implication to Anti-Malware ... · Malware Economics and its Implication to Anti-Malware Situational Awareness Arun Lakhotia, Univ of Louisiana-Lafayette

Malware Economics and its Implication to Anti-Malware ... · Malware Economics and its Implication to Anti-Malware Situational Awareness Arun Lakhotia, Univ of Louisiana-Lafayette

Documents
MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Documents
Reversing & malware analysis training part 9 advanced malware analysis

Reversing & malware analysis training part 9 advanced malware analysis

Technology
Reversing malware analysis trainingpart9 advanced malware analysis

Reversing malware analysis trainingpart9 advanced malware analysis

Technology
Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab

Documents
Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Malware - Northern Kentucky University · Malware detection. 2. Theory of malware. 3. ... target backdoors and worm flaws. ... Malware factories . are software and processes to

Documents
Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Technology
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Reversing & malware analysis training part 8 malware memory forensics

Reversing & malware analysis training part 8 malware memory forensics

Technology
Malware and Anti-Malware Seminar by Benny Czarny

Malware and Anti-Malware Seminar by Benny Czarny

Technology
Android Malware Development on Public Malware Scanning ...sxz16/papers/bigdata2016.pdf · Android Malware Development on Public Malware Scanning Platforms: A Large-scale Data-driven

Android Malware Development on Public Malware Scanning ...sxz16/papers/bigdata2016.pdf · Android Malware Development on Public Malware Scanning Platforms: A Large-scale Data-driven

Documents
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents
Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Documents
Metamorphic Malware 1 Metamorphic Malware Research

Metamorphic Malware 1 Metamorphic Malware Research

Documents
Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Malware Analysis Workshop June 5, 2012 - CCDCOE · Malware Analysis Workshop June 5, 2012 ... •Malware Analysis methods ... •Some malware doesnt run in Norman Sandbox

Documents
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
HTA-T07R Malware Hunting with the Sysinternals Toolsindex-of.co.uk/Malware/hta-t07r-license-to-kill-malware-hunting-with... · malware Professional antimalware analysis requires years

HTA-T07R Malware Hunting with the Sysinternals Toolsindex-of.co.uk/Malware/hta-t07r-license-to-kill-malware-hunting-with... · malware Professional antimalware analysis requires years

Documents
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
Malwarebytes Anti-Malware Unmanaged Client Administrator Guide · Anti-Malware Unmanaged Client Administrator Guide 2 Introduction Malwarebytes Anti-Malware is a next-generation anti-malware

Malwarebytes Anti-Malware Unmanaged Client Administrator Guide · Anti-Malware Unmanaged Client Administrator Guide 2 Introduction Malwarebytes Anti-Malware is a next-generation anti-malware

Documents
Evaluating Open Source Malware Sandboxes with Linux malware

Evaluating Open Source Malware Sandboxes with Linux malware

Documents
Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Documents
Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Part 4: Malware Functionality Chapter 11: Malware Behavior Chapter 12: Covert Malware Launching Chapter 13: Data Encoding Chapter 14: Malware-focused Network

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents
An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Documents
Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Technology
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents