1. DR. MIGUEL ÁNGEL OROS HERNÁNDEZ 7. Ingeniería inversa de software malicioso

2. Ingeniería inversa de software malicioso 1. Tipo de software malicioso 2. Usos del software malicioso 3. Vulnerabilidades del software malicioso

3. Malicious software or malware Any program that works againts the interests of the system’s user or owner Company CEO: Software for reporting all kinds of usage statistics and web- browsing habits  malware Reversing is the strongest weapon against creators of malware Antivirus researchers  Analyze the lastest malicious programs  Determine just how dangerous they are  Lear their weaknesses so that effective antivirus programs can be developed

4. Malicious software or malware

7. Tipos de software malicioso

8. Viruses Worms Trojan Horses Backdoors Mobile Code Adware/Spyware

9. Tipos de software malicioso Viruses Self-replicating programs that usually have a malicious intent Effects  Delete valuable information  Freeze the computer  Display annoying messages Typically attach themselves to executable program files Slowly duplicate themselves into many executable files on the infected system

10. Tipos de software malicioso worms Similar to a virus A self-replicating malicious program Replication process  Propagation: Internet, email  Does not require direct human interaction  Takes advantage of certain operating system or vulnerabilities

11. Tipos de sofware malicioso trojan horses General idea: an innocent artifact openly delivered throught the front door Artifacts used  Bening program  Video clip  Image Examples  “A Great Picture.jpg.exe”

12. Tipos de software malicioso backdoors Creates access channel that the attacker can use for connecting, controlling, spying, or otherwise interacting with the victim’s system

13. Tipos de software malicioso Mobile Code A class of benign programs Are executed on a large number of system without being installed by end users Some are design to create a more active Web-browsing experience Actions: download and launch a programa on the end user’s system Mobile code: Java scripts, Java applets

14. Tipos de software malicioso Adware/Spyware Adware  Programs that force unsolicited advertising on end users  Gathers various statistics  Distracting, annoying, reduction of performance and robustness

15. Tipos de software malicioso Sticky Software Not offer an uninstall program It is possible to install registry keys that instruct Windows to always launch the malware as soon as the system is started

16. Tipos de software malicioso Futuro sofware malicioso Information-stealing (kleptographic) worms Programs that could potentially spread like any other worm Locate valuable data on an infected system and steal it Use: public key and private key Attackers could actually blackmail their victims

17. Usos del software malicioso

18. Gains some kind of financial reward by spreading the programs Certain psychological urges or by childish desires to beat the system Backdoor access Denial-of-Service (DoS) Attacks Vandalism Resource Theft Information Theft

19. Vulnerabilidades del software malicioso

20. It runs on untrusted platforms Therefore, it is vulnerable to reversing Once the code is decrypted, the code and behaviour can be analyzed Identification of malicious programs: use unique signatures The antivirus program maintains a database of virus signatures Unique identification for every known malware program Polymorphism thwarts signature-based identification programs by randomly encoding or encrypting the program code

21. Vulnerabilidades del software malicioso weakness 1. Scanning for virus signatures in memory (searching unencrypted form) 2. The decryption code is static Metamorphism Next logial step after polymorphism Instead of encrypting the program’s body and making slight alterations in the decryption engine, it is possible to alter the entire program each tiem it is replicated Each version of the malware can look radically different from any other versions Use of a powerful code analysis engine: metamorphic engine

22. Vulnerabilidades del software malicioso algunas de las alteraciones aplicadas automáticamente a un programa Instruction and Register Selection Instruction Ordering Reversing conditions Instead of a using a statement that checks whether two operands are equal, check whether they are unequal Garbage insertion Function order

23. Bibliografía Reversing: Secrets of Reverse Engineering  Eldad Eilam  Wiley Publishing, Inc.  2005

24. Fin