NET 311 Information Security Networks and Communication Department Lecture 7: Malicious Software (Cont.) (Chapter 21)

lecture contents: Malicious Software Trojan horses Worms Backdoors Spammers 19-Sep-18 Networks and Communication Department

Trojan Horse A program that appears to have some useful purpose, but really masks some hidden malicious functionality Usually superficially attractive with hidden side-effects ** eg game, s/w upgrade etc when run performs some additional tasks allows attacker to indirectly gain access they do not have directly Often used to propagate a virus/worm or install a backdoor or simply to destroy data 19-Sep-18 Networks and Communication Department

Trojans Unlike viruses, Trojan horses do not replicate themselves . Unlike viruses, which are just bad tricks, Trojan horses usually attempt to do something useful for their creator The main use of Trojans is to collect information from your computer This is why they are called spyware 19-Sep-18 Networks and Communication Department

Trojans’ behaviour Simple examples of typical behavior of a Trojan include: Attempting to send e-mail messages to its creator. Opening a TCP/IP port on your computer, to allow its creator to connect to your computer. 19-Sep-18 Networks and Communication Department

How Trojans collect information Keystroke trackers (also known as keystroke recorders) – record what the user has typed Fake login screens – they emulate login to find out your password Garbage trackers – they look in the RAM or on the disk for documents which might be encrypted when they are stored in files. - 85% of documents edited yesterday can be found in unused sectors of the hard drive 6

Protection against Trojans Before your computer is infected: * Do not download software from untrusted sources When your computer is infected: * Checking logs * Using sandboxes (what is a sandbox?) * Using firewalls (what is a firewall?) 7

Worms A worm is a self-replicating piece of code that spreads via networks and usually doesn’t require human interaction to propagate. Example: Melissa virus from the previous lecture could be also classified as a worm

Trapdoors/backdoors A backdoor is a secret entry point to a program . It allows attackers to bypass normal security procedures, gaining access on the attacker’s own terms. a threat when left in production programs allowing exploited by attackers requires good s/w development & update (this is the definition given with respect to one separate program) A backdoor, or trapdoor, is a secret entry point into a program that allows someone that is aware of it to gain access without going through the usual security access procedures. Have been used legitimately for many years to debug and test programs, but become a threat when left in production programs, allowing intruders to gain unauthorized access. It is difficult to implement operating system controls for backdoors. Security measures must focus on the program development and software update activities. A BACKDOOR HAS multiple meanings. It can refer to a legitimate point of access embedded in a system or software program for remote administration. Generally this kind of backdoor is undocumented and is used for the maintenance and upkeep of software or a system. Some administrative backdoors are protected with a hardcoded username and password that cannot be changed; though some use credentials that can be altered. Often, the backdoor’s existence is unknown to the system owner and is known only to the software maker. Built-in administrative backdoors create a vulnerability in the software or system that intruders can use to gain access to a system or data. Attackers also can install their own backdoor on a targeted system. Doing so allows them to come and go as they please and gives them remote access to the system. Malware installed on systems for this purpose is often called a remote access Trojan, or a RAT, and can be used to install other malware on the system or exfiltrate data. A programmer may sometimes install a backdoor so that the program can be accessed for troubleshooting and testing.  9

Backdoors (relative to one program)

Trapdoors/backdoors A backdoor is a is a program that allows attackers to bypass normal security controls on a system, gaining access on the attacker’s own terms. (this is the definition given with respect to the whole computer system)

Backdoors (relative to a computer) A program to be infected

Backdoors Remote execution of individual commands Remote command-line access Remote control of the GUI

Code in e-mail messages These are simple techniques which an attacker can use. It is possible to include executable code (e.g. JavaScript) in e-mail messages. This can be used to collect information about the receiver of the message. In more dangerous cases, the code can affect the work of the receiver’s computer

Code in e-mail messages Example: spammers check the validity of e-mail addresses using HTML messages <html> <body> <imgsrc=“www.spam.com/script.php?id=3495"> </body> </html>

How spammers check the validity of e-mail addresses The idea is as follows. the spammer generates a numbered list of e-mail addresses, for example: 1 aaa@essex.ac.uk 2 bbb@essex.ac.uk ………… 3495 asvern@essex.ac.uk The spammer sends a message to each address, which includes the number of this address in the list as an argument of a script 19-Sep-18 Networks and Communication Department

Code in e-mail messages <img src=“www.spam.com/script.php?id=3495">

Code in e-mail messages Spammers can organize a denial-of-service attack using images in messages. Messages are sent to multiple addresses, including a request of information from a server. <img src=“www.good.com/image.jpg"> Distributed denial of service (DDoS) attacks present a significant security threat to corporations, and the threat appears to be growing. DDoS attacks make computer systems inaccessible by flooding servers, networks, or even end user systems with useless traffic so that legitimate users can no longer gain access to those resources. In a typical DDoS attack, a large number of compromised (zombie) hosts are amassed to send useless packets. In recent years, the attack methods and tools have become more sophisticated, effective, and more difficult to trace to the real attackers, while defense technologies have been unable to withstand large-scale attacks. 19-Sep-18 Networks and Communication Department

Code in e-mail messages <img src=“www.good.com/image.jpg">

References Cryptography and Network Security: Principles and practice’, William Stallings Fifth edition, 2011. Lecture slides by Lawrie Brown for “Cryptography and Network Security”, 5/e, by William Stallings, Chapter 21 – “Malicious Software”. Lecture slides by Dr Alexei Vernitski, University of Essex , 2013 19-Sep-18 Networks and Communication Department