• Home

  • Documents

  • Malware - Stanford University · A trojan describes the class of malware that appears to perform a...
111
Malware CS155 Spring 2009 Elie Bursztein

Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Embed Size (px)

Citation preview

Page 1: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

MalwareCS155 Spring 2009

Elie Bursztein

Page 2: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Welcome to the zoo

• What malware are• How do they infect hosts• How do they hide• How do they propagate• Zoo visit !• How to detect them• Worms

Page 3: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

What is a malware ?

A Malware is a set of instructions that run on your computer and make your system do something that an attacker wants it to do.

Page 4: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

What it is good for ?

• Steal personal information

• Delete files

• Click fraud

• Steal software serial numbers

• Use your computer as relay

Page 5: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

A recent illustration

• Christians On Facebook

• Leader hacked on march 2009

• Post Islamic message

• Lost >10 000 members

Page 6: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

The Malware Zoo

• Virus• Backdoor• Trojan horse• Rootkit• Scareware• Adware• Worm

Page 7: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

What is a Virus ?

a program that can infect other programs by modifying them to include a, possibly

evolved, version of itself

Fred Cohen 1983

Page 8: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Some Virus Type

• Polymorphic : uses a polymorphic engine to mutate while keeping the original algorithm intact (packer)

• Methamorpic : Change after each infection

Page 9: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

What is a trojan

A trojan describes the class of malware that appears to perform a desirable function but in fact performs

undisclosed malicious functions that allow unauthorized access to the victim computer

Wikipedia

Page 10: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

What is rootkit

A root kit is a component that uses stealth to maintain a persistent and

undetectable presence on the machine

Symantec

Page 11: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

What is a worm

A computer worm is a self-replicating computer program. It uses a network to send copies of itself

to other nodes and do so without any user intervention.

Page 12: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Almost 30 years of Malware

From Malware fighting malicious code

Page 13: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

History

• 1981 First reported virus : Elk Cloner (Apple 2)

• 1983 Virus get defined

• 1986 First PC virus MS DOS

• 1988 First worm : Morris worm

• 1990 First polymorphic virus

• 1998 First Java virus

• 1998 Back orifice

• 1999 Melissa virus

• 1999 Zombie concept

• 1999 Knark rootkit

• 2000 love bug

• 2001 Code Red Worm

• 2001 Kernel Intrusion System

• 2001 Nimda worm

• 2003 SQL Slammer worm

Melissa spread by email and share

Knark rootkit made by creed demonstrate the first ideas

love bug vb script that abused a weakness in outlook

Kernl intrusion by optyx gui and efficent hidding

Page 14: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Number of malware signatures

0

500000

1000000

1500000

2000000

2002 2003 2004 2005 2006 2007 2008

Symantec report 2009

Page 15: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Malware Repartition

74%

3%1%

9%

13%

TrojanWormOtherAdwareSpyware

Panda Q1 report 2009

Page 16: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Infection methods

Page 17: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Outline

• What malware are

• How do they infect hosts

• How do they propagate

• Zoo visit !

• How to detect them

• Worms

Page 18: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

What to Infect

• Executable

• Interpreted file

• Kernel

• Service

• MBR

• Hypervisor

Page 19: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Overwriting malware

TargetedExecutable

MalwareMalware

Page 20: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

prepending malware

TargetedExecutable

Malware

Infected host

ExecutableMalware

Page 21: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

appending malware

TargetedExecutable

Malware

Infectedhost

ExecutableMalware

Page 22: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Cavity malware

TargetedExecutable Infected

hostExecutable

MalwareMalware

Page 23: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Multi-Cavity malware

TargetedExecutableMalware

Malware

Malware

Malware

Page 24: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Packers

Malware Infected hostExecutable

PackerPayload

Page 25: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Packer functionalities

• Compress

• Encrypt

• Randomize (polymorphism)

• Anti-debug technique (int / fake jmp)

• Add-junk

• Anti-VM

• Virtualization

Page 26: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Auto start

• Folder auto-start : C:\Documents and Settings\[user_name]\Start Menu

\Programs\Startup

• Win.ini : run=[backdoor]" or "load=[backdoor]".

• System.ini : shell=”myexplorer.exe”

• Wininit

• Config.sys

Page 27: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Auto start cont.

• Assign know extension (.doc) to the malware

• Add a Registry key such as HKCU\SOFTWARE\Microsoft\Windows \CurrentVersion\Run

• Add a task in the task scheduler

• Run as service

Page 28: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Unix autostart

• Init.d

• /etc/rc.local

• .login .xsession

• crontab

• crontab -e

• /etc/crontab

Page 29: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Macro virus

• Use the builtin script engine

• Example of call back used (word)

• AutoExec()

• AutoClose()

• AutoOpen()

• AutoNew()

Page 30: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Document based malware

• MS Office

• Open Office

• Acrobat

Page 31: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Userland root kit

• Perform

• login

• sshd

• passwd

• Hide activity

• ps

• netstat

• ls

• find

• du

Page 32: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Subverting the Kernel

Kernel task

• Process management

• File access

• Memory management

• Network management

What to hide

➡ Process➡ Files ➡ Network traffic

Page 33: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Kernel rootkit

PS

KERNEL

Hardware : HD, keyboard, mouse, NIC, GPU

P1 P2

P3 P3

rootkit

Page 34: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Subverting techniques

• Kernel patch

• Loadable Kernel Module

• Kernel memory patching (/dev/kmem)

Page 35: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Windows Kernel

P1 P2 Pn Csrss.exe

Win32 subsystem DLLsUser32.dll, Gdi32.dll and Kernel32.dll

Other Subsytems(OS/2 Posix)

Ntdll.dll

ntoskrnl.exe

Hardware Abstraction Layer (HAL.dll)Hardware

Underlying kernelExecutive

Page 36: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Kernel Device driver

P2

Win32 subsystem DLLs

Ntdll.dll

ntoskrnl.exe

Interrupt Hook

System service dispatcher

System service dispatch table

Driver Overwriting functions Driver Replacing Functions

New pointer

A

C

B

Page 37: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

MBR/Bootkit

Bootkits can be used to avoid all protections of an OS, because OS consider that the system was in trusted stated at the moment the OS boot loader took control.

Page 38: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

BIOS MBR VBS NTBoot

SectorBOOTMGR.EXEWINLOAD.EXE

Windows 7 kernel HAL.DLL

Page 39: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Vboot

• Work on every Windows (vista,7)

• 3ko

• Bypass checks by letting them run and then do inflight patching

• Communicate via ping

Page 40: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Hypervisor rootkit

Target OS

Hardware

AppApp

Page 41: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Hypervisor rootkit

Target OS

Hardware

AppApp

Virtual machine Host OS

Rogue app

Page 42: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

PropagationVector

Page 43: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Outline

• What malware are

• How do they infect hosts

• How do they propagate

• Zoo visit !

• How to detect them

• Worms

Page 44: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Shared folder

Page 45: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Email propagation

from pandalab blog

Page 46: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Valentine day ...

Waledac malicious domain from pandalab blog

!"#$%&'($')*+),)-.+($%./)-)&0'$-&1#'$)+$23

2456!7689$67:;6!$:5<=585>?$@A5<4569$B$C56DE$FGGHI FJ

KKKLM.+1.'#-0N)(OL-&%

!"#$%&#' ()#(*+

!"#$%&&#'"#()"*+),-*)./#0).122%.")3%4#5%""'/%"6#78,%+97+11:"#;'3%#-"%(#<'&%.*).%4"#='8#*1">+%'(#.-5%+1-"#5'&)7)1-"#71(%"#2+15#*;%#?'&%('7#2'5)&8#*;+1-/;#%5')&"#$)*;#5'&)7)1-"-+&"@

A;%#!"#$%&"'()*+#, #) " #" )5) &'+ #*1 #*;'* #12 #*;%#2 ) + " * #">'5#5%""'/%" #'(3%+* ) " )./>;'+5'7%-*)7'&"6#'"#*;%8#'+%#()"*+),-*%(#3)'#%5')&6#).#*;)"#7'"%#-")./#<'&%.*).%9+%&'*%(5%""'/%"#).21+5)./#+%7)>)%.*"#*;'*#"15%1.%#;'"#"%.*#*;%5#'#3)+*-'&#7'+(@#A;%#5%""'/%71.*')."#'#&).:#*;'*#)"#+%()+%7*%(#*1#'#5'&)7)1-"#(15').#).#1+(%+#*1#3)%$#*;%#7'+(@

B%&1$#)"#'.#%C'5>&%#12#'#5'&)7)1-"#(15').D

E)/-+%#FG@#H'&)7)1-"#?'&%('7#(15').@

!"#$%&$'()$&*+$%)*#,-#'#./)01#,"#$()2)3#$45)67789 6:

;;;<=>?@>ABCDEFGH<CIJ

!"#$%&#' ()#(*+

%KB)JIAG)AFL?FMFC>?G)J>NFCFIDA)CI@BA)F?)!O

!"#$%&'($)*$+&%,-&.+#+$/&$/"#$0&(12/#'$3.2/&(./)0.--4$&'$/"'&25"$2*#'$),/#'.0/)&,678&%#9#':$;&'$/"#$+&%,-&.+$/&$<#$*200#**;2-:$2*#'*$(2*/$.5'##$/&$)/=

>)52'#$??7$@&%,-&.+$&;$/"#$(.-)0)&2*$;)-#7

A4<#'B0'&&C*$0'#./#+$,2(#'&2*$+&(.),*$/&$+)*/')<2/#$/"#$D.-#+.0$%&'($2*),5$),&;;#,*)9#,.(#*$*20"$.*$0.'+7#E#:$#0.'+7#E#:$-&9#7#E#:$-&9#4&27#E#:$(#.,+4&27#E#:$#/07

F&(#$&;$/"#*#$+&(.),*$%#'#$+#*)5,#+$/&$(&+);4$/"#$;)-#$/&$<#$+&%,-&.+#+$),$&'+#'$/&+)*/')<2/#$+);;#'#,/$(.-)0)&2*$0&+#*$.,+$1'#9#,/$*#02')/4$0&(1.,)#*$;'&($+#/#0/),5$/"#(7!")*$)+#.$&;$,2(#'&2*$*(.--$),;#0/)&,*$)*$C,&%,$.*$.$*)-#,/$#1)+#()07

!"#$)(1.0/$&;$+&(.),*$+)*/')<2/),5$(.-)0)&2*$D.-#+.0$0&+#*$%.*$*&$5'#./$/"./$*&(#+&(.),*$%#'#$#9#,$")5"-4B'.,C#+$),$*#.'0"$#,5),#*7$!")*$0&2-+$0.2*#$2*#'*$/'4),5$/&$-&0./#9)'/2.-$0.'+*$/&$.00#**$(.-)0)&2*$+&(.),*$<4$.00)+#,/7

Page 47: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Email again

Symantec 2009

Page 48: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Fake codec

Page 49: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Fake antivirus

from pandalab blog

Page 50: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Hijack you browser

from pandalab blog

Page 51: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Fake page !

from pandalab blog

Page 52: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

P2P Files

• Popular query

• 35.5% are malwares (Kalafut 2006)

Page 53: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Backdoor

Page 54: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Basic

InfectedHost AttackerTCP

Page 55: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Reverse

InfectedHost AttackerTCP

Page 56: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

covert

InfectedHost AttackerICMP

Page 57: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Rendez vous backdoor

InfectedHost Attacker

RDVPoint

Page 58: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Bestiary

Page 59: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Outline

• What malware are

• How do they infect hosts

• How do they propagate

• Zoo visit !

• How to detect them

• Worms

Page 60: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Adware

Page 61: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

BackOrifice

• Defcon 1998

• new version in 2000

Page 62: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Netbus

• 1998

• Used for “prank”

Page 63: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Symantec pcAnywhere

Page 64: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Browser Toolbar ...

Page 65: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Toolbar again

Page 66: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Ransomware

• Trj/SMSlock.A

• Russian ransomware

• April 2009 To unlock you need to send an SMS with the text4121800286

to the number3649

Enter the resulting code:

Any attempt to reinstall the system may lead to loss of important information and computer damage

from pandalab blog

Page 67: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Detection

Page 68: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Outline

• What malware are

• How do they infect hosts

• How do they propagate

• Zoo visit !

• How to detect them

• Worms

Page 69: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Anti-virus

• Analyze system behavior

• Analyze binary to decide if it a virus

• Type :

• Scanner

• Real time monitor

Page 70: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Impossibility result

• It is not possible to build a perfect virus/malware detector (Cohen)

Page 71: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Impossibility result

• Diagonal argument

• P is a perfect detection program

• V is a virus

• V can call P

• if P(V) = true -> halt

• if P(V) = false -> spread

Page 72: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Virus signature

• Find a string that can identify the virus

• Fingerprint like

Page 73: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Heuristics

• Analyze program behavior

• Network access

• File open

• Attempt to delete file

• Attempt to modify the boot sector

Page 74: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Checksum

• Compute a checksum for

• Good binary

• Configuration file

• Detect change by comparing checksum

• At some point there will more malware than “goodware” ...

Page 75: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Sandbox analysis

• Running the executable in a VM

• Observe it

• File activity

• Network

• Memory

Page 76: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Dealing with Packer

• Launch the exe

• Wait until it is unpack

• Dump the memory

Page 77: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Worms

Page 78: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Outline

• What malware are

• How do they infect hosts

• How do they propagate• Zoo visit !

• How to detect them

• Worms

Page 79: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

79

Worm

A worm is self-replicating software designed to spread through the network Typically, exploit security flaws in widely used services

Can cause enormous damage

Launch DDOS attacks, install bot networks

Access sensitive information

Cause confusion by corrupting the sensitive information

Worm vs Virus vs Trojan horse

Page 80: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

80

Cost of worm attacks

Morris worm, 1988Infected approximately 6,000 machines10% of computers connected to the Internet

cost ~ $10 million in downtime and cleanup

Code Red worm, July 16 2001

Page 81: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

81

Internet Worm (First major attack)

Released November 1988Program spread through Digital, Sun

workstations Exploited Unix security vulnerabilitiesVAX computers and SUN-3 workstations running versions 4.2 and 4.3 Berkeley UNIX code

Page 82: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

82

Some historical worms of note

Worm Date Distinction

Morris 11/88 Used multiple vulnerabilities, propagate to “nearby” sys

ADM 5/98 Random scanning of IP address space

Ramen 1/01 Exploited three vulnerabilities

Lion 3/01 Stealthy, rootkit worm

Cheese 6/01 Vigilante worm that secured vulnerable systems

Code Red 7/01 First sig Windows worm; Completely memory resident

Walk 8/01 Recompiled source code locally

Nimda 9/01 Windows worm: client-to-server, c-to-c, s-to-s, …

Scalper 6/02 11 days after announcement of vulnerability; peer-to-peer network of compromised systems

Slammer 1/03 Used a single UDP packet for explosive growth

Kienzle and Elder

Page 83: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

83

Increasing propagation speed

Code Red, July 2001 Affects Microsoft Index Server 2.0,

Windows 2000 Indexing service on Windows NT 4.0.

Windows 2000 that run IIS 4.0 and 5.0 Web servers

Exploits known buffer overflow in Idq.dll

Vulnerable population (360,000 servers) infected in 14 hours

SQL Slammer, January 2003 Affects in Microsoft SQL 2000

Exploits known buffer overflow vulnerability

Page 84: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

84

Code Red

Initial version released July 13, 2001Sends its code as an HTTP requestHTTP request exploits buffer overflow Malicious code is not stored in a filePlaced in memory and then run

When executed,Worm checks for the file C:\Notworm

Page 85: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

85

Code Red of July 13 and July 19

Initial release of July 13 1st through 20th month: Spread

via random scan of 32-bit IP addr space

20th through end of each month: attack. Flooding attack against 198.137.240.91 (www.whitehouse.gov)

Failure to seed random number generator ⇒ linear growth

Revision released July 19, 2001. White House responds to threat of flooding attack by changing

the address of www.whitehouse.gov

Causes Code Red to die for date ≥ 20th of the month. But: this time random number generator correctly seeded

Slides: Vern Paxson

Page 86: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

86

Infection rate

Page 87: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

87

Measuring activity: network telescope

Monitor cross-section of Internet address space, measure traffic “Backscatter” from DOS floods Attackers probing blindly Random scanning from worms

LBNL’s cross-section: 1/32,768 of Internet

UCSD, UWisc’s cross-section: 1/256.

Page 88: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

88

Spread of Code Red

Network telescopes estimate of # infected hosts: 360K. (Beware DHCP & NAT)Course of infection fits classic logistic.Note: larger the vulnerable population, faster the worm spreads.

That night (⇒ 20th), worm dies … … except for hosts with inaccurate clocks!

It just takes one of these to restart the worm on August 1st … Slides: Vern

Paxson

Page 89: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

89

Slides: Vern Paxson

Page 90: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

90

Code Red 2

Released August 4, 2001.Comment in code: “Code Red 2.” But in fact completely different code base.

Payload: a root backdoor, resilient to reboots.Bug: crashes NT, only works on Windows 2000.

Localized scanning: prefers nearby addresses.

Kills Code Red 1.

Safety valve: programmed to die Oct 1, 2001.Slides: Vern

Paxson

Page 91: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

91

Striving for Greater Virulence: Nimda

Released September 18, 2001.Multi-mode spreading: attack IIS servers via infected clients email itself to address book as a virus copy itself across open network shares modifying Web pages on infected servers w/ client

exploit scanning for Code Red II backdoors (!)

worms form an ecosystem!Leaped across firewalls. Slides: Vern

Paxson

Page 92: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

92

Code Red 2 kills off Code Red 1

Code Red 2 settles into weekly pattern

Nimda enters the ecosystem

Code Red 2 dies off as programmed

CR 1 returns thanksto bad clocks

Slides: Vern Paxson

Page 93: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

93

How do worms propagate?

Scanning worms : Worm chooses “random” address

Coordinated scanning : Different worm instances scan different addresses

Flash worms Assemble tree of vulnerable hosts in advance, propagate along tree

Not observed in the wild, yet

Potential for 106 hosts in < 2 sec ! [Staniford]

Meta-server worm :Ask server for hosts to infect (e.g., Google for “powered by phpbb”)

Topological worm: Use information from infected hosts (web server logs, email address books, config files, SSH “known hosts”)

Contagion worm : Propagate parasitically along with normally initiated communication

Page 94: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

slammer

• 01/25/2003

• Vulnerability disclosed : 25 june 2002

• Better scanning algorithm

• UDP Single packet : 380bytes

Page 95: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Slammer propagation

Page 96: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Number of scan/sec

Page 97: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Packet loss

Page 98: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

A server view

Page 99: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

Consequences

• ATM systems not available

• Phone network overloaded (no 911!)

• 5 DNS root down

• Planes delayed

Page 100: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

100

Worm Detection and DefenseDetect via honeyfarms: collections of “honeypots” fed by a network telescope. Any outbound connection from honeyfarm = worm.

(at least, that’s the theory)

Distill signature from inbound/outbound traffic. If telescope covers N addresses, expect detection when worm

has infected 1/N of population.

Thwart via scan suppressors: network elements that block traffic from hosts that make failed connection attempts to too many other hosts 5 minutes to several weeks to write a signature Several hours or more for testing

Page 101: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

101

months

days

hrs

mins

secs

ProgramViruses Macro

Viruses E-mailWorms Network

Worms

FlashWorms

Pre-automation

Post-automation

Con

tagi

on P

erio

d

Sign

atur

eR

espo

nse

Perio

d

Need for automation•Current threats can spread faster than defenses can reaction

•Manual capture/analyze/signature/rollout model too slow

1990 Time 2005

Contagion PeriodSignature Response Period

Slide: Carey Nachenberg, Symantec

Page 102: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

102

Signature inference

Challenge need to automatically learn a content “signature” for each

new worm – potentially in less than a second!

Some proposed solutions Singh et al, Automated Worm Fingerprinting, OSDI ’04

Kim et al, Autograph: Toward Automated, Distributed Worm Signature Detection, USENIX Sec ‘04

Page 103: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

103

Signature inference

Monitor network and look for strings common to traffic with worm-like behaviorSignatures can then be used for content

filtering

Slide: S Savage

Page 104: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

104

Content sifting

Assume there exists some (relatively) unique invariant bitstring W across all instances of a particular worm (true today, not tomorrow...)

Two consequences Content Prevalence: W will be more common in traffic than

other bitstrings of the same length

Address Dispersion: the set of packets containing W will address a disproportionate number of distinct sources and destinations

Content sifting: find W’s with high content prevalence and high address dispersion and drop that traffic

Slide: S Savage

Page 105: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

105

Observation:High-prevalence strings are rare

(Stefan Savage, UCSD *)

Only 0.6% of the 40 byte substrings repeat more than 3 times in a minute

Page 106: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

106

Address Dispersion Table Sources Destinations Prevalence Table

The basic algorithm

Detector in network

A B

cnn.com

C

DE

(Stefan Savage, UCSD *)

Page 107: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

107

1 (B)1 (A)

Address Dispersion Table Sources Destinations

1

Prevalence Table

Detector in network

A B

cnn.com

C

DE

(Stefan Savage, UCSD *)

Page 108: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

1081 (A)1 (C)1 (B)1 (A)

Address Dispersion Table Sources Destinations

11

Prevalence Table

Detector in network

A B

cnn.com

C

DE

(Stefan Savage, UCSD *)

Page 109: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

1091 (A)1 (C)

2 (B,D)2 (A,B)

Address Dispersion Table Sources Destinations

12

Prevalence Table

Detector in network

A B

cnn.com

C

DE

(Stefan Savage, UCSD *)

Page 110: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

1101 (A)1 (C)

3 (B,D,E)

3 (A,B,D)

Address Dispersion Table Sources Destinations

13

Prevalence Table

Detector in network

A B

cnn.com

C

DE

(Stefan Savage, UCSD *)

Page 111: Malware - Stanford University · A trojan describes the class of malware that appears to perform a desirable function but in fact performs undisclosed malicious functions that allow

111

Challenges

Computation To support a 1Gbps line rate we have 12us to process each

packet, at 10Gbps 1.2us, at 40Gbps… Dominated by memory references; state expensive

Content sifting requires looking at every byte in a packet

State On a fully-loaded 1Gbps link a naïve implementation can easily

consume 100MB/sec for table

Computation/memory duality: on high-speed (ASIC) implementation, latency requirements may limit state to on-chip SRAM

(Stefan Savage, UCSD *)


A Brief History of Mobile Malware - CounterMeasures · PDF fileA Brief History of Mobile Malware The first ever Trojan for Android was discovered in August of 2010 and Trend Micro

A Brief History of Mobile Malware - CounterMeasures · PDF fileA Brief History of Mobile Malware The first ever Trojan for Android was discovered in August of 2010 and Trend Micro

Documents
A Brief History of Mobile Malware - Rik Fergusoncountermeasures.trendmicro.eu/.../02/History-of-Mobile-Malware.pdf · A Brief History of Mobile Malware The first ever Trojan for Android

A Brief History of Mobile Malware - Rik Fergusoncountermeasures.trendmicro.eu/.../02/History-of-Mobile-Malware.pdf · A Brief History of Mobile Malware The first ever Trojan for Android

Documents
Spyware & Internet Security. Different Types of Spyware Spyware Adware Embedded Programs Trojan Horse Browser Hijackers Dialers Malware

Spyware & Internet Security. Different Types of Spyware Spyware Adware Embedded Programs Trojan Horse Browser Hijackers Dialers Malware

Documents
GinMaster - Virus Bulletin · 2013-10-11 · Top 3 Android Malware by Volume 19100, 4% GinMaster Rest of Malware 300+ malware ... Downloader Trojan Spy Rootkit. 12 ... Android 4 months

GinMaster - Virus Bulletin · 2013-10-11 · Top 3 Android Malware by Volume 19100, 4% GinMaster Rest of Malware 300+ malware ... Downloader Trojan Spy Rootkit. 12 ... Android 4 months

Documents
A Study of Malware Propagation via Online Social Networkingutn/papers/a-study-of-malware-propagation-via-OSN.pdf · sources of infection (Figure 3). Since Trojan and clickjacking

A Study of Malware Propagation via Online Social Networkingutn/papers/a-study-of-malware-propagation-via-OSN.pdf · sources of infection (Figure 3). Since Trojan and clickjacking

Documents
Investigation of Linux.Mirai Trojan family - Dr. Web · PDF file3 3 Introduction A Trojan for Linux that was named Linux.Mirai has several predecessors. The first malware program be-longing

Investigation of Linux.Mirai Trojan family - Dr. Web · PDF file3 3 Introduction A Trojan for Linux that was named Linux.Mirai has several predecessors. The first malware program be-longing

Documents
Malware. 2 Inhoud Historisch overzicht Malware Soorten Malware (+ werking) Virus, Worm, Trojan, botnet Andere Terminologie Exploit, Payload, Zero-day

Malware. 2 Inhoud Historisch overzicht Malware Soorten Malware (+ werking) Virus, Worm, Trojan, botnet Andere Terminologie Exploit, Payload, Zero-day

Documents
Analysis of Banking Trojan Vawtrak - AVG Now · PDF fileAnalysis of Banking Trojan Vawtrak White Paper AVG Technologies, Virus Lab ... Analyzing this malware is time consuming as it

Analysis of Banking Trojan Vawtrak - AVG Now · PDF fileAnalysis of Banking Trojan Vawtrak White Paper AVG Technologies, Virus Lab ... Analyzing this malware is time consuming as it

Documents
Defending Against an Invisible Threat Pragmatic …...a Trojan, or other virus, downloads into your system. Once the Trojan downloads the payload, often malware or ransomware, your

Defending Against an Invisible Threat Pragmatic …...a Trojan, or other virus, downloads into your system. Once the Trojan downloads the payload, often malware or ransomware, your

Documents
TROJAN TROJAN TROJAN TROJAN

TROJAN TROJAN TROJAN TROJAN

Documents
Malware – Vírus, Worms, Bots, Trojan Horses, Rookits…

Malware – Vírus, Worms, Bots, Trojan Horses, Rookits…

Documents
SplitScreen: Enabling Efficient, Distributed Malware Detectiondga/papers/splitscreen-nsdi2010.pdfThe amount of malicious software (malware)—viruses, worms, Trojan horses, and the

SplitScreen: Enabling Efficient, Distributed Malware Detectiondga/papers/splitscreen-nsdi2010.pdfThe amount of malicious software (malware)—viruses, worms, Trojan horses, and the

Documents
Hardware Malware Detectors - Columbia Universityjdd/papers/isca13_malware_slides.pdf · Hardware Malware Detectors John Demme, Matthew Maycock, Jared Schmitz, Adrian Tang, ... Trojan

Hardware Malware Detectors - Columbia Universityjdd/papers/isca13_malware_slides.pdf · Hardware Malware Detectors John Demme, Matthew Maycock, Jared Schmitz, Adrian Tang, ... Trojan

Documents
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
MTvScan (Malware , Trojan, Viruses Scanner) Enterprise Class Security Scanner

MTvScan (Malware , Trojan, Viruses Scanner) Enterprise Class Security Scanner

Documents
JANET M. HEROLD Regional Solicitor SUSAN SELETSKY · Angel Ruiz Velazquez, Juan Carmona, Jaime 2, Undisclosed 3, Undisclosed 4, Undisclosed 5, Undisclosed C Perez, Manuel 6, Undisclosed

JANET M. HEROLD Regional Solicitor SUSAN SELETSKY · Angel Ruiz Velazquez, Juan Carmona, Jaime 2, Undisclosed 3, Undisclosed 4, Undisclosed 5, Undisclosed C Perez, Manuel 6, Undisclosed

Documents
SplitScreen: Enabling Efficient, Distributed Malware Detection · The amount of malicious software (malware)—viruses, worms, Trojan horses, and the like—is exploding. As the amount

SplitScreen: Enabling Efficient, Distributed Malware Detection · The amount of malicious software (malware)—viruses, worms, Trojan horses, and the like—is exploding. As the amount

Documents
SHELLTEA + POSLURP MALWARE - root9B Malware... · The source code to the Carberp banking trojan was leaked a few years ago ... performs HTTP requests with a user-agent created with

SHELLTEA + POSLURP MALWARE - root9B Malware... · The source code to the Carberp banking trojan was leaked a few years ago ... performs HTTP requests with a user-agent created with

Documents
SECURIT RESPONSE - Wired · which was used to sign malware. ... signature-based antivirus solutions, ... The attackers installed Backdoor.Hikit, a Trojan

SECURIT RESPONSE - Wired · which was used to sign malware. ... signature-based antivirus solutions, ... The attackers installed Backdoor.Hikit, a Trojan

Documents
Citadel Trojan Malware Analysis

Citadel Trojan Malware Analysis

Documents
DISSECTING A BANKING MALWARE TINYNUKE { OR NUKEBOT OR NUCLEARBOT OR MICROBANKINGTROJAN OR XBOT } × Malware type: Banking Trojan × First sample identified: March 2017 × Analyzed

DISSECTING A BANKING MALWARE TINYNUKE { OR NUKEBOT OR NUCLEARBOT OR MICROBANKINGTROJAN OR XBOT } × Malware type: Banking Trojan × First sample identified: March 2017 × Analyzed

Documents
The Cyber Threat No Boundaries · Virus Worm Trojan 19 . Malware Trojan - (Ex. Bowling for Elves) An “impostor,” a program that appears legitimate, but contains malicious code,

The Cyber Threat No Boundaries · Virus Worm Trojan 19 . Malware Trojan - (Ex. Bowling for Elves) An “impostor,” a program that appears legitimate, but contains malicious code,

Documents
Undisclosed Podcast

Undisclosed Podcast

Documents
An Introduction To Keyloggers, RATS And Malware - Websmemberfiles.freewebs.com/99/60/67186099/documents/An Introductio… · How does antivirus work? ... Trojan Horse – Trojan virus

An Introduction To Keyloggers, RATS And Malware - Websmemberfiles.freewebs.com/99/60/67186099/documents/An Introductio… · How does antivirus work? ... Trojan Horse – Trojan virus

Documents
Kindsight Security Labs Malware Report – Q2 2013€¦ · Kindsight security Labs MaLware report – Q2 2013 ALCATELfiLUCENT alureon.dX is a bootkit Trojan that steals usernames,

Kindsight Security Labs Malware Report – Q2 2013€¦ · Kindsight security Labs MaLware report – Q2 2013 ALCATELfiLUCENT alureon.dX is a bootkit Trojan that steals usernames,

Documents
White paper on the anatomy of malware, virus, and Trojan threats to Mac OS X

White paper on the anatomy of malware, virus, and Trojan threats to Mac OS X

Documents
Trojan Malware for BlackBerry Devices OttSec – July 6 2009

Trojan Malware for BlackBerry Devices OttSec – July 6 2009

Documents
An Efficient Trojan Horse Classification (ETC) · An Efficient Trojan Horse Classification (ETC) ... malware or also known as malicious code is ... for the dynamic analysis, cuckoo

An Efficient Trojan Horse Classification (ETC) · An Efficient Trojan Horse Classification (ETC) ... malware or also known as malicious code is ... for the dynamic analysis, cuckoo

Documents
Undisclosed Spells

Undisclosed Spells

Documents
Automatic Analysis of Malware Behavior using Machine Learning Analysis of... · Automatic Analysis of Malware Behavior using Machine Learning ... Internet worms and Trojan ... the

Automatic Analysis of Malware Behavior using Machine Learning Analysis of... · Automatic Analysis of Malware Behavior using Machine Learning ... Internet worms and Trojan ... the

Documents