1. Lecture 15 Overview

2. Kinds of Malicious Codes Virus: a program that attaches copies of itself into other programs. – Propagates and performs some unwanted function – Viruses are not programs – Definition from RFC 1135: A virus is a piece of code that inserts itself into a host [program], including operating systems, to propagate. It cannot run independently. It requires that its host program be run to activate it. 2 CS 450/650 Lecture 15: Malicious Codes

3. Kinds of Malicious Code Worm: a program that propagates copies of itself through the network. – Independent program. – May carry other code, including programs and viruses. – Definition from RFC 1135: A worm is a program that can run independently, will consume the resources of its host [machine] from within in order to maintain itself and can propagate a complete working version of itself on to other machines. 3 CS 450/650 Lecture 15: Malicious Codes

4. Kinds of Malicious Code Rabbit/Bacteria: make copies of themselves to overwhelm a computer system's resources – Denying the user access to the resources Logic/Time Bomb: programmed threats that lie dormant for an extended period of time until they are triggered – When triggered, malicious code is executed 4 CS 450/650 Lecture 15: Malicious Codes

5. Kinds of Malicious Code Trojan Horse: secret, undocumented routine embedded within a useful program – Execution of the program results in execution of secret code Trapdoor: secret, undocumented entry point into a program, used to grant access without normal methods of access authentication Dropper: Not a virus or infected file – When executed, it installs a virus into memory, on to the disk, or into a file 5 CS 450/650 Lecture 15: Malicious Codes

6. Virus Lifecycle Dormant phase: the virus is idle – not all viruses have this stage Propagation phase: the virus places an identical copy of itself into other programs of into certain system areas Triggering phase: the virus is activated to perform the function for which it was created Execution phase: the function is performed – The function may be harmless or damaging 6 CS 450/650 Lecture 15: Malicious Codes

7. Virus Types Parasitic virus: – Attaches itself to a file and replicates when the infected program is executed – most common form Memory resident virus: – lodged in main memory as part of a resident system program – Virus may infect every program that executes 7 CS 450/650 Lecture 15: Malicious Codes

8. Virus Types Boot Sector Viruses: – Infects the boot record and spreads when system is booted – Gains control of machine before the virus detection tools – Very hard to notice Macro Virus: – virus is part of the macro associated with a document 8 CS 450/650 Lecture 15: Malicious Codes

9. Virus Types Stealth virus: – A form of virus explicitly designed to hide from detection by antivirus software Polymorphic virus: – A virus that mutates with every infection making detection by the “signature” of the virus difficult 9 CS 450/650 Lecture 15: Malicious Codes

10. How Viruses Append 10 Original program virus Original program virus Virus appended to program += CS 450/650 Lecture 15: Malicious Codes Original program Virus-1 Virus-2 Virus surrounding a program Original program Virus-1 Virus-2 Virus-3 Virus-4 Virus integrated into program

11. How Viruses Gain Control Virus V has to be invoked instead of target T – V overwrites T – V changes pointers from T to V 11 CS 450/650 Lecture 15: Malicious Codes

12. Virus Signatures Storage pattern – Code always located on a specific address – Increased file size Execution pattern Transmission pattern Polymorphic Viruses 12 CS 450/650 Lecture 15: Malicious Codes

13. Antivirus Approaches Detection: – determine infection and locate the virus Identification: – identify the specific virus Removal: – remove the virus from all infected systems, so the disease cannot spread further Recovery: – restore the system to its original state 13 CS 450/650 Lecture 15: Malicious Codes

14. Preventing Virus Infection Prevention: – Good source of software installed – Isolated testing phase – Use virus detectors Limit damage: – Make bootable diskette – Make and retain backup copies important resources 14 CS 450/650 Lecture 15: Malicious Codes

15. Worm Self-replicating (like virus) Objective: system penetration (intruder) Phases: dormant, propagation, triggering, and execution Propagation: – Searches for other systems to infect e.g., host tables – Establishes connection with remote system – Copies itself to remote system – Execute 15 CS 450/650 Lecture 15: Malicious Codes

16. Lecture 16 Targeted Malware CS 450/650 Fundamentals of Integrated Computer Security Slides are modified from Csilla Farkas and Brandon Phillips

17. Targeted Malicious Code Trapdoor – undocumented entry point to a module – forget to remove them – intentionally leave them in the program for testing – intentionally leave them in the program for maintenance of the finished program, or – intentionally leave them in the program as a covert means of access to the component after it becomes an accepted part of a production system 17 CS 450/650 Lecture 16: Targeted Malicious Codes

18. Targeted Malicious Code Salami Attack – a series of many minor actions that together results in a larger action that would be difficult or illegal to perform at once – Ex. Interest computation rootkit – A program or coordinated set of programs designed to gain control over a computer system or network of computing systems 18 CS 450/650 Lecture 16: Targeted Malicious Codes

19. Targeted Malicious Code Privilege Escalation – a means for malicious code to be launched by a user with lower privileges but run with higher privileges Interface illusion – a spoofing attack in which all or part of a web page is false Keystroke Logging 19 CS 450/650 Lecture 16: Targeted Malicious Codes

20. Targeted Malicious Code Man-in-the-Middle Attacks Timing Attacks – attempts to compromise a cryptosystem by analyzing the time taken to execute cryptographic algorithms Covert Channels – programs that leak information – Ex. Hide data in output 20 CS 450/650 Lecture 16: Targeted Malicious Codes

21. Covert Channel - Trojan Horse John Spy Only John is permitted to access the document MS Word Document Spy’s Document copy TH install copy 21 CS 450/650 Lecture 16: Targeted Malicious Codes

22. Covert Channel Two active agents – Sender (has access to unauthorized information) e.g., Trojan Horse in MS Word – Receiver (reads sent information) e.g., program creating the copy Encoding schema – How the information is sent e.g., – File F exists  0 – File F is does not exist  1 Synchronization – e.g., when to check for existence of F 22 CS 450/650 Lecture 16: Targeted Malicious Codes

23. Storage Covert Channels Based on properties of resources – pass information by using presence or absence of objects in storage Examples: – File locks – Delete/create file – Memory allocation 23 CS 450/650 Lecture 16: Targeted Malicious Codes

24. File Lock Covert Channel 24

25. File Existence Channel Used to Signal 100 25

26. Timing Covert Channel Time is the factor – how fast – pass information using the speed at which things happen Examples: – Processing time – Transmission time 26 CS 450/650 Lecture 16: Targeted Malicious Codes

27. Covert Timing Channel 27

28. Covert Channel Detection and Removal Identification: – Shared resources – Program code correctness – Information flow analysis Removal: – Total removal – may not be possible – Reduce bandwidth 28 CS 450/650 Lecture 16: Targeted Malicious Codes

29. Controls Against Program Threats Prevent Threats during software development – Modularity security analysts must be able to understand each component as an independent unit and be assured of its limited effect on other components 29 CS 450/650 Lecture 16: Targeted Malicious Codes

30. Controls Against Program Threats Prevent Threats during software development – Encapsulation hide a component's implementation details minimize interfaces to reduce covert channels – Information hiding a component as a kind of black box components will have limited effect on other components 30 CS 450/650 Lecture 16: Targeted Malicious Codes

31. Controls Against Program Threats Peer Reviews – Hazard Analysis set of systematic techniques to expose potentially hazardous system states – Testing unit testing, integration testing, function testing, performance testing, acceptance testing, installation testing, regression testing 31 CS 450/650 Lecture 16: Targeted Malicious Codes

32. Controls Against Program Threats Good Design – Using a philosophy of fault tolerance – Have a consistent policy for handling failures – Capture the design rationale and history – Use design patterns Prediction – predict the risks involved in building and using the system 32 CS 450/650 Lecture 16: Targeted Malicious Codes

33. Controls Against Program Threats Static Analysis – Use tools and techniques to examine characteristics of design and code to see if the characteristics warn of possible faults Configuration Management – control changes during development and maintenance Analysis of Mistakes Proofs of Program Correctness – Can we prove that there are no security holes? 33 CS 450/650 Lecture 16: Targeted Malicious Codes

34. Operating System Controls on Use of Programs Trusted Software – code has been rigorously developed and analyzed Functional correctness Enforcement of integrity Limited privilege Appropriate confidence level 34 CS 450/650 Lecture 16: Targeted Malicious Codes

35. Operating System Controls on Use of Programs Mutual Suspicion – assume other program is not trustworthy Confinement – limit resources that program can access Access Log – list who access computer objects, when, and for how long 35 CS 450/650 Lecture 16: Targeted Malicious Codes

36. Administrative Controls Standards of Program Development Standards of design Standards of documentation, language, and coding style Standards of programming Standards of testing Standards of configuration management Security Audits Separation of Duties 36 CS 450/650 Lecture 16: Targeted Malicious Codes