Malicious Code By Diana Peng

What is Malicious Code? Unanticipated or undesired effects in programs/program parts, caused by an agent with damaging intentions Unanticipated or undesired effects in programs/program parts, caused by an agent with damaging intentions Uses our everyday programs as a vessel to access and change data stored Uses our everyday programs as a vessel to access and change data stored Viruses Viruses Worms Worms Trojan Horses Trojan Horses

Unpredictable Behavior Behaves in the same manner as any other program Behaves in the same manner as any other program Has the ability to stop running programs, generating a sound, erasing stored data, etc. Has the ability to stop running programs, generating a sound, erasing stored data, etc. Has the ability to remain dormant until some event triggers the code to act Has the ability to remain dormant until some event triggers the code to act

History of Malicious Code 1981 Elk Cloner – spread on Apple II floppy disks (containing the OS) originating from Texas A&M: 1981 Elk Cloner – spread on Apple II floppy disks (containing the OS) originating from Texas A&M: It will get on all your disks It will infiltrate your chips Yes it's Cloner! It will stick to you like glue It will modify ram too Send in the Cloner! 1983 – Fred Cohen Computer Viruses – Theory and Experiments 1983 – Fred Cohen Computer Viruses – Theory and Experiments 1986 Brain – 2 Pakistani brothers analyzing the boot sector of a floppy disk, develop a method to infect it. Spread quickly and widely on MS- DOS PC system Brain – 2 Pakistani brothers analyzing the boot sector of a floppy disk, develop a method to infect it. Spread quickly and widely on MS- DOS PC system.

History ( cont.) 1987 IBM Christmas Worm – fast spreading 500,000 replication per hour 1987 IBM Christmas Worm – fast spreading 500,000 replication per hour 1988 MacMag – Hypercard stack virus 1988 MacMag – Hypercard stack virus Scores – 1 st major Mac outbreak Scores – 1 st major Mac outbreak 1991 Tequila – polymorphic, originated in Switzerland and changed itself to avoid detection 1991 Tequila – polymorphic, originated in Switzerland and changed itself to avoid detection More recently – Love Letter(2000), Blaster and SoBig(2003) More recently – Love Letter(2000), Blaster and SoBig(2003)

Definitions Virus – a program that can pass on malicious code to other nonmalicious programs by modifying the them Virus – a program that can pass on malicious code to other nonmalicious programs by modifying the them 1. Transient – life is dependent on host 2. Resident – stores itself in memory and acts as a stand-alone program 2. Resident – stores itself in memory and acts as a stand-alone program Trojan Horse – contains obvious malicious intent and a 2 nd unseen effect Trojan Horse – contains obvious malicious intent and a 2 nd unseen effect

Definitions (cont.) Logic Bomb – “detonates” when a specified condition occurs Logic Bomb – “detonates” when a specified condition occurs * Time Bomb – triggered by a time/date * Time Bomb – triggered by a time/date Trapdoor/Backdoor – allows one to access a protected program through an indirect method Trapdoor/Backdoor – allows one to access a protected program through an indirect method Worm – program that replicates itself and spread those replications through a network Worm – program that replicates itself and spread those replications through a network * Rabbit – spreads w/out limits and tries to exhaust the computer’s resources * Rabbit – spreads w/out limits and tries to exhaust the computer’s resources

Virus Qualities Easily created Easily created Difficult to detect Difficult to detect Difficult to destroy or deactivate Difficult to destroy or deactivate Spreads intended infection widely Spreads intended infection widely Ability to re-infect original program or other programs Ability to re-infect original program or other programs Machine and OS independent Machine and OS independent

Attaching Viruses Must be executed in order to be activated Must be executed in order to be activated Human intervention is key for initial activation Human intervention is key for initial activation attachments attachments Once attached, the virus installs itself on a permanent storage medium and on any/all executing programs in memory Once attached, the virus installs itself on a permanent storage medium and on any/all executing programs in memory

Appended Viruses Most common attachment – easy to program and effective Most common attachment – easy to program and effective Attaches to an existing program and is activated whenever whenever the program is running Attaches to an existing program and is activated whenever whenever the program is running Virus instructions execute 1 st, after the last virus instruction control is given back to the 1 st program instruction Virus instructions execute 1 st, after the last virus instruction control is given back to the 1 st program instruction User is unaware of virus – original program still runs the way it’s intended User is unaware of virus – original program still runs the way it’s intended

Appended Virus (cont.) Program Virus +=

Surrounding Viruses To avoid detection on the disk, the virus will attach itself to the program constructing the listing of files on the disk To avoid detection on the disk, the virus will attach itself to the program constructing the listing of files on the disk The virus has control after the listing program is generated and before it is displayed to delete itself from the listing The virus has control after the listing program is generated and before it is displayed to delete itself from the listing

Surrounding Virus (cont.) Program Virus

Integrated Viruses Virus will replace the program and integrate itself into the original code Virus will replace the program and integrate itself into the original code Requires the creator of the virus to know the original program in order to insert pieces of the virus into it Requires the creator of the virus to know the original program in order to insert pieces of the virus into it Replacement – the virus replaces the entire program with itself; user will only see the performance of the virus Replacement – the virus replaces the entire program with itself; user will only see the performance of the virus

Integrated Viruses (cont.) Program Virus +=

Document Virus Implemented inside a formatted document (ex. Word document, database, spreadsheet, etc.) Implemented inside a formatted document (ex. Word document, database, spreadsheet, etc.) Highly structured files containing both data and commands Highly structured files containing both data and commands Command codes are a part of rich programming language Command codes are a part of rich programming language

Gaining Control The virus program must be activated in place of the original program The virus program must be activated in place of the original program Presents itself as the original program Presents itself as the original program Substitutes the original program by pushing the original one out of the way Substitutes the original program by pushing the original one out of the way Overwriting - the virus replaces the original code in a file structure Overwriting - the virus replaces the original code in a file structure Pointer Changing - directs the file system to itself and skips the original code Pointer Changing - directs the file system to itself and skips the original code

One-Time Execution Majority of viruses today Majority of viruses today Activated and executed only once Activated and executed only once attachments attachments

Boot Sector Viruses Gains control early in the boot process before detection tools are active Gains control early in the boot process before detection tools are active Boot area is crucial to the OS and is usually kept hidden from the user to avoid modification/deletion Boot area is crucial to the OS and is usually kept hidden from the user to avoid modification/deletion Virus code is difficult to notice Virus code is difficult to notice

Memory Resident Viruses Resident code – code that is frequently used by the OS that has a permanent space in memory Resident code – code that is frequently used by the OS that has a permanent space in memory Resident code is activated many times and simultaneously activates the virus each time Resident code is activated many times and simultaneously activates the virus each time Ability to look for and infect uninfected carriers Ability to look for and infect uninfected carriers

Virus Signatures Cannot be completely invisible Cannot be completely invisible Code is stored on computer and must be in memory to execute Code is stored on computer and must be in memory to execute Signature – the pattern the virus executes and the method it uses to spread Signature – the pattern the virus executes and the method it uses to spread Virus Scanner Virus Scanner – detects virus signatures by searching memory – detects virus signatures by searching memory & long-term storage, and monitors execution & long-term storage, and monitors execution – must be kept up-to-date to be effective – must be kept up-to-date to be effective

Storage Patterns Most viruses attach to programs stored on disks – file size grows Most viruses attach to programs stored on disks – file size grows Attachment is usually invariant and the start of the virus code is detectable (Appended Attachment) Attachment is usually invariant and the start of the virus code is detectable (Appended Attachment) JUMP instruction (Surrounding Attachment) JUMP instruction (Surrounding Attachment)

Execution Patterns Spread infection Spread infection Avoid detection – Boot Sector Avoid detection – Boot Sector Cause harm – erasing files/disks, preventing booting/writing to disk, shutting down, etc. Cause harm – erasing files/disks, preventing booting/writing to disk, shutting down, etc.

Transmission Patterns Virus is only effective if it has the ability to transmit itself from location to location Virus is only effective if it has the ability to transmit itself from location to location Virus execution behaves just like any other program execution and it’s form of transmission is not confined to one medium. Virus execution behaves just like any other program execution and it’s form of transmission is not confined to one medium.