• Home

  • Technology

  • Malware's Most Wanted: Linux and Internet of Things Malware
30

Malware's Most Wanted: Linux and Internet of Things Malware

  • Upload
    cyphort

  • View
    154

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Malware's Most Wanted: Linux and Internet of Things Malware
Page 2: Malware's Most Wanted: Linux and Internet of Things Malware

EXOTIC CREATURESInternet of Things and Linux Malware

Page 3: Malware's Most Wanted: Linux and Internet of Things Malware

Your speakers today

Marion MarschalekSecurity Research Expert

Shel SharmaProduct Marketing Director

Page 4: Malware's Most Wanted: Linux and Internet of Things Malware

Agenda

o Linux & IoT in the spotlighto Cyphort Lab’s in-the-wild spottingso Status of Linux & IoT malware

Cyph

ort L

abs

T-sh

irt

Page 5: Malware's Most Wanted: Linux and Internet of Things Malware

Threat Monitoring & Research team

________

24X7 monitoring for malware events

________

Assist customers with their Forensics and Incident Response

We enhance malware detection accuracy

________

False positives/negatives

________

Deep-dive research

We work with the security ecosystem

________

Contribute to and learn from malware KB

________

Best of 3rd Party threat data

Page 6: Malware's Most Wanted: Linux and Internet of Things Malware

THE INTERNET

http://greendisc.dacya.ucm.es/wp-content/uploads/2014/10/Internet_of_Things.jpg

might be bigger than you thought

Page 7: Malware's Most Wanted: Linux and Internet of Things Malware

By broadening the internet surface...

http://datasciencebe.com/category/data-science-2/iot-analytics/

... we broaden our attack surface.

Page 8: Malware's Most Wanted: Linux and Internet of Things Malware

Internettechnology in everyday life

Page 9: Malware's Most Wanted: Linux and Internet of Things Malware

WEAK DEFAULT SECURITY

Page 10: Malware's Most Wanted: Linux and Internet of Things Malware

LINUX & IoT MALWARE

Page 11: Malware's Most Wanted: Linux and Internet of Things Malware

ESPIONAGE GOES LINUX

o Suspected to be Russian government malware

o Active since 2008

o Linux component uncovered 2014

o Backdoor capabilities & stealthy C&C

communication

Turla‘s Linux component

Page 12: Malware's Most Wanted: Linux and Internet of Things Malware

LINUX MARKET SHARES

o Linux on desktop systems under 5%

o Public servers ~36%

o Mainframes >96%

o Embedded systems ~30%

Page 13: Malware's Most Wanted: Linux and Internet of Things Malware

INDUSTRIAL CONTROL SYSTEMS UNDER ATTACK

o Enumerates network resources through Windows API

o OPC – OLE process controlo ICS spy:

o Network entities UNC pathso Thereof OPC serverso Server versiono OPC version supporto etc.

Havex on industrial espionage

Page 14: Malware's Most Wanted: Linux and Internet of Things Malware

BROADENING THE ATTACK SURFACE

More devices more attack vectors

IoT compromises

Hacked baby monitors and CCTV cameras in UK

Smart meters vulnerable to attacks, could harm national power network

‚Spike‘ botnet runs DoS attacks from IoT devices

Linux risks

Servers and critical infrastructure based on Unix distributions

Webservers as entry point to corporate network

Major flaws in legacy open source software show vulnerability of Linux systems

Page 15: Malware's Most Wanted: Linux and Internet of Things Malware

EXOTIC CREATURESin the wild

Page 16: Malware's Most Wanted: Linux and Internet of Things Malware

CYPHORT LAB‘S IN-THE-WILD ENCOUNTERS

o Mayday | 10:2014o Sotdas | 10:2014o Snessik | 10:2014o Ganiw | 10:2014

o SSHb |11:2014

o Darlloz |12:2014

o Zendran|12:2014

Page 17: Malware's Most Wanted: Linux and Internet of Things Malware

LINUX.MAYDAY

o DDoS bot with task schedulero Comes packed with UPXo C++ binary including object

informationo Contains a logger class for

categories:INFO, DEBUG, FATAL and WARNING

Page 18: Malware's Most Wanted: Linux and Internet of Things Malware

LINUX.GANIWo Backdoor / DDoS boto Exfiltrates the following

information:o OS name and versiono System’s MAC addresso Amount of RAMo Number of network interfaceso CPU usage and frequency

o Calculates stats on the attacks it performs

o Kills instances of malware already present

Page 19: Malware's Most Wanted: Linux and Internet of Things Malware

LINUX.SOTDASo DDoS bot, no binary protectiono Target URL downloaded from C&Co The following methods are supported:

o UDP floodo TCP floodo Syn floodo DNS floodo DIY with custom built

TCP and HTTP packetso Shuts down iptables,

SuSEfirewall2 or ebtables services

Page 20: Malware's Most Wanted: Linux and Internet of Things Malware

LINUX.SNESSIK

o Backdoor / DDoS boto Spawns shells to execute commands from its botmastero Uses curl for file up-/downloado Data exchanged with C&C is BASE64 & XOR encodedo The binary contains HTTP headers for US English and

Chinese

Page 21: Malware's Most Wanted: Linux and Internet of Things Malware

LINUX.SSHB

o Simple backdooro Enabling access to the machine through SSHo Implementing source from OpenSSH

Page 22: Malware's Most Wanted: Linux and Internet of Things Malware

IoT WORM DARLLOZ

o Targets Linux distributions on routers, security cameras & gaming systems

o Spreads by bruteforcing telnet logins or by exploiting PHP vulnerability CVE-2012-1823

o Cross compiled for:o armo ppco mipselo mipso x86

Page 23: Malware's Most Wanted: Linux and Internet of Things Malware

o DDoS bot based on IRC based scannerLightaidra

o Cross-compiled for x86, x64, PPC, MIPS, MIPSEL, ARM and SuperH

o Comes packed with UPXo Communicates to C&C via IRCo 2 stages:

o Downloader scripto Platform specific binary

IoT BOT ZENDRAN

Page 24: Malware's Most Wanted: Linux and Internet of Things Malware

WHERE ARE WE NOW

and what does the future hold

Page 25: Malware's Most Wanted: Linux and Internet of Things Malware

EXOTIC CREATURE‘S FEATURES

Unprotected binariesLow evasivenessLack of stealthBinaries coming with symbolsA lot of source code re-use

Low AV detectionConsistently low default security for Linux & IoTEasy prey for attackersRising number of infections

Page 26: Malware's Most Wanted: Linux and Internet of Things Malware

REMEDIES

1. Network focussed security

2. Reviewing security settings of devices / machines

3. Regular updates and patches, where applicable

4. Network segmentation to counter lateral movement

Page 27: Malware's Most Wanted: Linux and Internet of Things Malware

Q and A

o Information sharing and advanced threats resources

o Blogs on latest threats and findings

o Tools for identifying malware

Page 28: Malware's Most Wanted: Linux and Internet of Things Malware

Thank You!

Page 29: Malware's Most Wanted: Linux and Internet of Things Malware
Page 30: Malware's Most Wanted: Linux and Internet of Things Malware

FURTHER READINGo Havex attacks Industrial Control Systems

http://www.cyphort.com/windows-meets-industrial-control-systems-ics-havex-rat-spells-security-risks-2/

o Baby monitors hacken in UK homeshttp://www.independent.co.uk/life-style/gadgets-and-tech/baby-monitors-cctv-cameras-and-webcams-from-uk-homes-and-businesses-hacked-and-uploaded-onto-russian-website-9871830.html

o Smart meters vulnerable to attackhttp://securityaffairs.co/wordpress/29353/security/smart-meters-hacking.html

o Spike botnet runs DoS attacks from IoT deviceshttp://securityaffairs.co/wordpress/28642/cyber-crime/spike-botnet-runs-ddos.html

http://www.cyphort.com/windows-meets-industrial-control-systems-ics-havex-rat-spells-security-risks-2/
http://www.cyphort.com/windows-meets-industrial-control-systems-ics-havex-rat-spells-security-risks-2/
http://www.cyphort.com/windows-meets-industrial-control-systems-ics-havex-rat-spells-security-risks-2/
http://www.cyphort.com/windows-meets-industrial-control-systems-ics-havex-rat-spells-security-risks-2/
http://www.independent.co.uk/life-style/gadgets-and-tech/baby-monitors-cctv-cameras-and-webcams-from-uk-homes-and-businesses-hacked-and-uploaded-onto-russian-website-9871830.html
http://www.independent.co.uk/life-style/gadgets-and-tech/baby-monitors-cctv-cameras-and-webcams-from-uk-homes-and-businesses-hacked-and-uploaded-onto-russian-website-9871830.html
http://www.independent.co.uk/life-style/gadgets-and-tech/baby-monitors-cctv-cameras-and-webcams-from-uk-homes-and-businesses-hacked-and-uploaded-onto-russian-website-9871830.html
http://www.independent.co.uk/life-style/gadgets-and-tech/baby-monitors-cctv-cameras-and-webcams-from-uk-homes-and-businesses-hacked-and-uploaded-onto-russian-website-9871830.html
http://securityaffairs.co/wordpress/29353/security/smart-meters-hacking.html
http://securityaffairs.co/wordpress/29353/security/smart-meters-hacking.html
http://securityaffairs.co/wordpress/29353/security/smart-meters-hacking.html
http://securityaffairs.co/wordpress/28642/cyber-crime/spike-botnet-runs-ddos.html
http://securityaffairs.co/wordpress/28642/cyber-crime/spike-botnet-runs-ddos.html

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

MALWARES MALWARE REVIEWED ISE DE Malware Reviewed · MALWARES There are public reports about spreading of malware named as ServHelper malware. It is a backdoor malware used by attacker

Documents
Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Documents
Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Documents
Malware and Anti-Malware Seminar by Benny Czarny

Malware and Anti-Malware Seminar by Benny Czarny

Technology
Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Malware and anti-malware (fun with Trojans) - Z. …z.cliffe.schreuders.org/edu/FS/Malware and anti-malware... · 2014-04-02 · Malware and anti-malware (fun with Trojans) ... with

Documents
Malware's Most Wanted: Financial Trojans

Malware's Most Wanted: Financial Trojans

Technology
THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

THE EVOLUTION OF MALWARE & FUTURE MALWARE MITIGATION

Documents
Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile

Documents
Malware's Most Wanted: The Many Faces of Malware

Malware's Most Wanted: The Many Faces of Malware

Technology
Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Documents
Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Malware Analysis Analysis.pdf · Definisi Malware Analysis • What is a malware? • Malware (malicious software) ... Malware Sinkronisasi Token • Pelaku: Zeus Banking Trojan •

Documents
Evaluating Open Source Malware Sandboxes with Linux malware

Evaluating Open Source Malware Sandboxes with Linux malware

Documents
Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Documents
Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Documents
Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Documents
Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Documents
Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Education
Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Documents
The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

The power of cyber protection fileCyBrave Certified Malware Analysis Investigator (CCMAI|CCMAIE) Malware Analysis Investigator Entry Level Malware Analysis Investigator Malware Analysis

Documents
Malware's Most Wanted: How to tell BADware from adware

Malware's Most Wanted: How to tell BADware from adware

Technology
Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Technology
Metamorphic Malware 1 Metamorphic Malware Research

Metamorphic Malware 1 Metamorphic Malware Research

Documents
Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL

Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL

Technology
Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Chapter 8 Malware - FTMS · – Boot virus – Logic Bomb virus – Directory virus – Resident virus. CSCA0101 Computing Basics 8 Malware Types of Malware ... Malware Types of Malware

Documents
An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Documents
Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Documents
Malware Most Wanted: Evil Bunny

Malware Most Wanted: Evil Bunny

Technology
Evasive Techniques: An Introduction - Amazon S3 · research[AT]minerva-labs.com 5 The Sum of All (Malware) Fears Classifying Malware's Phobias In order to better understand the usage

Evasive Techniques: An Introduction - Amazon S3 · research[AT]minerva-labs.com 5 The Sum of All (Malware) Fears Classifying Malware's Phobias In order to better understand the usage

Documents
Advanced malware analysis training session6 malware sandbox analysis

Advanced malware analysis training session6 malware sandbox analysis

Technology
Malware's most wanted-zberp-the_financial_trojan

Malware's most wanted-zberp-the_financial_trojan

Technology