Computer Security: Principles and Practice, 1/e

Computer Security: Principles and Practice, 1/e

Malicious Software Malware Malware, short for "malicious software" [SOUP13] defines malware as: a program that is inserted into a system, usually covertly (secretly), with the intent of compromising the Confidentiality, Integrity, or Availability of the victims data, applications, or operating system or otherwise annoying or disrupting the victim. Name Description Advanced persistent threat Cybercrime directed at business and political targets, using a wide variety of intrusion technologies and malware, applied persistently and effectively to specific targets over an extended period, often attributed to state-sponsored organizations. Adware Advertising that is integrated into software. It can result in pop-up ads or redirection of a browser to a commercial site. Attack Kit Set of tools for generating new malware automatically using a variety of

supplied propagation and payload mechanisms. Auto-rooter Malicious hacker tools used to break into new machines remotely. Backdoor (trapdoor) Any mechanisms that bypasses a normal security check; it may allow unauthorized access to functionality in a program, or onto a compromised system. Downloaders Code that installs other items on a machine that is under attack. It is normally included in the malware code first inserted on to a compromised system to then import a larger malware package. Drive-by download An attack using code in a compromised web site that exploits a browser vulnerability to attack a client system when the site is viewed. Exploits Code specific to a single vulnerability or set of vulnerabilities. Flooders (DoS client) Used to generate a large volume of data to attack networked computer systems, by carrying out some form of denial-of-service (DoS) attack.

Keyloggers Captures keystrokes on a compromised system. Logic bomb Code inserted into malware by an intruder. A logic bomb lies dormant until a predefined condition is met; the code then triggers an unauthorized act. Macro Virus A type of virus that uses macro or scripting code, typically embedded in a document, and triggered when the document is viewed or edited, to run and replicate itself into other such documents. Mobile Code Software (e.g., script, macro, or other portable instruction) that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics. Rootkit Set of hacker tools used after attacker has broken into a computer system and gained root-level access. Spammer Programs Used to send large volumes of unwanted e-mail. Spyware

Software that collects information from a computer and transmits it to another system by monitoring keystrokes, screen data and/or network traffic; or by scanning files on the system for sensitive information. Trojan horse Zombie, bot A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the Trojan horse program. Virus Malware that, when executed, tries to replicate itself into other executable machine or script code; when it succeeds the code is said to be infected. When the infected code is executed, the virus also executes. Worm A computer program that can run independently and can propagate a complete working version of itself onto other hosts on a network, usually by exploiting software vulnerabilities in the target system. Program activated on an infected machine that is activated to launch attacks on other machines. Table 6.1 Malware Terminology

(Table can be found on page 201 in the textbook.) Classification of Malware Classified into two broad categories: Also classified by: Based first on how it spreads or propagates to reach the desired targets Those that need a host program (parasitic code such as viruses) Then on the actions or payloads it performs once a target is reached Those that are independent, selfcontained programs (worms, trojans, and bots) Malware that does not replicate (Trojans and spam e-mail) Malware that does replicate (viruses and worms)

Types of Malicious Software (Malware) Propagation Mechanisms include: Infection of existing content by viruses that is subsequently spread to other systems Exploit of software vulnerabilities by worms or drive-by-downloads to allow the malware to replicate Social engineering attacks that convince users to bypass security mechanisms to install Trojans or to respond to phishing attacks Payload actions performed by malware once it reaches a target system can include: Corruption of system or data files Theft of service/make the system a zombie agent of attack as part of a botnet Theft of information from the system/keylogging Stealthing /hiding its presence on the system Attack Kits Initially the development and deployment of malware required considerable technical skill by software authors o The development of virus-creation toolkits in the early 1990s and then more general attack kits in the 2000s greatly assisted in the development and deployment of malware

Toolkits are often known as crimeware o Include a variety of propagation mechanisms and payload modules that even novices can deploy o Variants that can be generated by attackers using these toolkits creates a significant problem for those defending systems against them Widely used toolkits include: o Zeus o Blackhole o Sakura o Phoenix Attack Sources Another significant malware development is the change from attackers being individuals often motivated to demonstrate their technical competence to their peers to more organized and dangerous attack sources such as: Politicall y motivate d attackers Criminals Organize d crime Organizatio ns that sell their services to

companies and nations National governme nt agencies This has significantly changed the resources available and motivation behind the rise of malware and has led to development of a large underground economy involving the sale of attack kits, access to compromised hosts, and to stolen information Viruses Piece of software that infects programs o Modifies them to include a copy of the virus o Replicates and goes on to infect other content o Easily spread through network environments

When attached to an executable program, a virus can do anything that the program is permitted to do o Executes secretly when the host program is run Specific to operating system and hardware o Takes advantage of their details and weaknesses Virus Components Infection mechanism Means by which a virus spreads or propagates Also referred to as the infection vector Trigger Event or condition that determines when the payload is activated or delivered Sometimes known as a logic bomb Payloa d What the virus does (besides spreading) May involve damage (malicious) or benign but noticeable activity Virus Phases Virus is idle 1. Dormant/asleep

phase Will eventually be activated by some event Not all viruses have this stage 2. Triggering phase Virus is activated to perform the Can be caused by a variety of system function for which it was intended events Virus places a copy of itself into other programs or into certain system areas on the disk 3. Propagation phase May not be identical to the propagating version Each infected program will now contain a clone of the virus which will itself enter a propagation phase 4. Execution phase Function is performed May be harmless or damaging

program V 1234567; Virus Structure program CV 1234567; procedureattach-to-program; begin repeat file := get-random-program; until first-program-line 1234567; prepend V to file; end; procedureexecute-payload; begin (* perform payload actions *) end; proceduretrigger-condition; begin (* return true if trigger condition is true *) end; procedureattach-to-program; begin repeat file := get-random-program; until first-program-line 1234567; compress file; (* t1 *) prepend CV to file; (* t2 *) end;

begin (* main action block *) attach-to-program; uncompress rest of this file into tempfile; (* t3 *) execute tempfile; (* t4 *) end; begin (* main action block *) attach-to-program; if trigger-condition then execute-payload; goto main; end; (a) A simplevirus (b) A compression virus Figure6.1 ExampleVirus Logic CV P'1 P2 t0: P1' is infected version of P 1; P2 is clean P2 t1: P2 is compressed into P 2' CV

CV CV P'1 P'2 P'1 t2: CV attaches itself to P 2' P'2 P1 t3: P1' is decompressed into the original program P 1 Figure6.2 A Compression Virus Virus Classifications Classification by Concealment/Hiding Strategy Classification by target Boot sector infector o Infects a master boot record (MBR) or boot record and

spreads when a system is booted from the disk containing the virus File infector o A portion of the virus creates a random encryption key and encrypts the remainder of the virus Macro virus o Infects files with macro or scripting code that is interpreted by an application Multipartite virus o Infects files in multiple ways Stealth virus (sneaking) o A form of virus explicitly designed to hide itself from detection by anti-virus software o Infects files that the operating system or shell considers to be

executable Encrypted virus Polymorphic virus o A virus that mutates with every infection Metamorphic virus o A virus that mutates and rewrites itself completely at each iteration and may change behavior as well as appearance Macro and Scripting Viruses NISTIR 7298 defines a macro virus as: a virus that attaches itself to documents and uses the macro programming capabilities of the documents application to execute and propagate Macro viruses infect scripting code used to support active content in a variety of user document types

Are threatening for a number of reasons: Is platform independent Are much easier to write or to modify than traditional executable viruses Infect documents, not executable portions of code (MS Word, PDF, etc.) Are easily spread Because they infect user documents rather than system programs, traditional file system access controls are of limited use in preventing their spread, since users are expected to modify them Worms Program that actively seeks out more machines to infect o Each infected machine serves as an automated launching pad for attacks on other machines

Exploits software vulnerabilities in client or server programs Can : o Spread through Network Connections from system to system o Spread through Shared Media (USB drives, CD, DVD data disks) o Spread through E-mails, email worms spread in macro or script code included in attachments and instant messenger file transfers Upon activation the worm may replicate and propagate again Usually carries some form of payload/action First known worm implementation o was done in Xerox Palo Alto Labs in the early 1980s o It was not malicious , searching for idle systems to use to run a computationally intensive task

Worm Replication E-mail or instant messenger facility File sharing Remote execution capability Remote file access or transfer capability Remote login capability Worm e-mails a copy of itself to other systems Often, sends itself as an attachment via an instant message service Creates a copy of itself or infects a file as a virus on removable media (auto run mechanism ) Worm executes a copy of itself on another system Worm uses a remote file access or transfer service to copy itself from one system to another Worm logs onto a remote system as a user and then uses commands to copy itself from one system to the other

Worm Replication A worm typically uses the same phases as a computer virus: o dormant, propagation, triggering, and execution. The propagation phase generally performs the following functions: o Search for appropriate access mechanisms to other systems to infect by examining host tables, address books, buddy lists, trusted peers, scanning possible target host addresses; or by searching for suitable removable media devices to use. o Use the access mechanisms found to transfer a copy of itself to the remote system, and cause the copy to be run. o The worm may also attempt to determine whether a system has previously been infected before copying itself to the system. Target Discovery Scanning (or fingerprinting) o Propagation phase for a network, worm searches for other systems to infect Scanning strategies that a worm can use:

Random Each compromised host probes random addresses in the IP address space using a different seed This produces a high volume of Internet traffic which may cause generalized disruption even before the actual attack is launched Hit-list The attacker first compiles a long list of potential vulnerable machines Once the list is compiled the attacker begins infecting machines on the list Each infected machine is provided with a portion of the list to scan This results in a very short scanning period which may make it difficult to detect that infection is taking place Topological This method uses information contained on an infected victim machine to find more hosts Local subnet If a host can be infected behind a firewall, then it looks for targets in its own local network The host uses the subnet address structure to find other hosts that would otherwise be protected by the firewall Morris Worm One of the Earliest significant worm infection

Released by Robert Morris in 1988 Designed to spread on UNIX systems o Attempted to crack local password file to use login/password to logon to other systems o Exploited a bug in the finger protocol which reports the whereabouts/ location of a remote user o Exploited a trapdoor in the debug option of the remote process that receives and sends mail Successful attacks achieved communication with the operating system command interpreter o Sent interpreter a bootstrap program to copy worm over Recent Worm Attacks Melissa 1998 e-mail worm, first to include Virus+ Worm + Trojan in one package Code Red July 2001

exploited Microsoft IIS bug Probes/examines random IP addresses consumes significant Internet capacity when active Code Red II August 2001 also targeted Microsoft IIS installs a backdoor for access Nimda September 2001 had Worm, Virus and Mobile code characteristics spread using e-mail, Windows shares, Web servers, Web clients, backdoors SQL Slammer Early 2003 exploited a buffer overflow vulnerability in SQL server compact and spread rapidly Sobig.F Late 2003

exploited open proxy servers to turn infected machines into spam engines Mydoom 2004 mass-mailing e-mail worm installed a backdoor in infected machines Warezov 2006 creates executables in system directories sends itself as an e-mail attachment can disable security related products Conficker (Downadup ) November 2008 exploits a Windows buffer overflow vulnerability most widespread infection since SQL Slammer McAfee: What Stuxnet 2010Is Stuxnet? restricted rate of spread to reduce chance of detection targeted industrial control systems Multiplatfor m Metamorphi c Worm Technolo gy Polymorp hic Multiexploit Ultrafast spreading technology Multiplatform: not limited to Windows: UNIX; macro, scripting etc. Multi-exploit: penetrate systems in a variety of ways: o E.g. servers, browsers, e-mail, file sharing, shared media, etc.

Ultrafast Spreading: maximize locating as many vulnerable machines as possible in a short time period. Polymorphic: To evade detection, worms adopt the virus polymorphic technique. o Metamorphic: Changing their appearance and it behavioral patterns. o have a collection of behavior patterns that are unleashed at different stages of propagation Transport vehicles: Can rapidly compromise a large number of systems, o New code generated on the fly using functionally equivalent instructions & encryption techniques. they are ideal distributed DoS bots, rootkits, spam e-mail generators, and spyware. Zero-day exploit : maximum surprise and distribution, o

exploit an unknown vulnerability that is only discovered by the general network community when the worm is launched. Malicious Mobile Code Programs that can be shipped unchanged to a variety of platforms o (e.g., script, macro, or other portable instruction) Transmitted from a remote system to a local system and then executed on the local system Often acts as a mechanism for a Virus, Worm, or Trojan horse Takes advantage of vulnerabilities to perform its own exploits Popular vehicles include: o Java applets, o ActiveX, o JavaScript and o VBScript Mobile Phone Worms

First discovery was Cabir worm in 2004 Then Lasco and CommWarrior in 2005 Communicate through Bluetooth wireless connections or MMS Target is the smartphone Can completely: o disable the phone, o delete data on the phone, or o force the device to send costly messages CommWarrior replicates by means of Bluetooth to other phones, o sends itself as an MMS file to contacts and o as an auto reply to incoming text messages Drive-By-Downloads

Exploits browser vulnerabilities to download and installs malware on the system when the user views a Web page that is controlled by the attacker o It contains code that exploits the browser bug to download and install malware on the system without the users knowledge or consent. In most cases does not actively propagate Spreads when users visit the malicious Web page A drive-by download refers to the unintentional download of malicious code to your computer or mobile device that leaves you open to a cyberattack. (press a link, or open a malicious email attachment to become infected.) Kaspersky: What Is a Drive-By Download? Clickjacking Also known as a user-interface (UI) redress/reform attack Using a similar technique,

keystrokes can also be hijacked o A user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker E.g. you may think you're viewing the bank's display after entering your ID and password, but what you actually see is a replica of the same screen laid on top of the bank's real information. Vulnerability used by an attacker to collect an infected users clicks o The attacker can force the user to do a variety of things from adjusting the users computer setters to unwittingly sending the user to Web sites that might have malicious code o By taking advantage of Adobe Flash or JavaScript an attacker could even place a button under or

over a legitimate button making it difficult for users to detect o A typical attack uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page o The attacker is hijacking clicks meant for one page and routing them to another page Kaspersky: What Is Clickjacking? Social Engineering Tricking users to assist in the compromise of their own systems or personal information. This can occur when a user views and responds to some SPAM e-mail, or permits the installation and execution of some Trojan horse program or scripting code. Spam (uninvited)

Unsolicited bulk e-mail Significant carrier of malware Used for phishing attacks Trojan horse (apparently useful) Mobile phone Trojans Program or utility containing harmful hidden code First appeared in 2004 (Skuller) Used to accomplish functions that the attacker could not accomplish directly Target is the smartphone Payload System Corruption

Chernobyl Virus First seen in 1998 Windows 95 and 98 virus Infects executable files and corrupts the entire file system when a trigger date is reached Klez Mass mailing worm infecting Windows 95 to XP systems On trigger date causes files on the hard drive to become empty Ransomware Encrypts the users data and demands payment in order to access the key needed to recover the information PC Cyborg Trojan (1989) Gpcode Trojan (2006) WannaCry (May 2017)

n n a W re a w m g r o o n s i a. a r ed y r kip C a wi c ta t a k Payload System Corruption Real-world damage Causes damage to physical equipment

o Chernobyl virus rewrites BIOS code o Stuxnet worm Targets specific industrial control system software There are concerns about using sophisticated targeted malware for industrial sabotage Logic bomb Code embedded in the malware that is set to explode when certain conditions are met Payload Attack Agents Bots Takes over another Internet attached computer and uses that computer to launch or manage attacks Botnet - collection of bots capable of acting in a coordinated manner (A botnet is a number of Internetconnected devices (bots), each of which is running one or more bots.) Can be used to cause/make: Distributed denial-of-service (DDoS) Spamming Sniffing traffic Keylogging Spreading new malware

Installing advertisement add-ons and browser helper objects (BHOs) Attacking IRC chat networks 1. The botmaster sends out malware to infect computers. 2. Once in your system, the malware will use the internet to make contact with the command & control server (C2). 3. Once the botmaster has a purpose for the botnet, he/she sends instructions to the bots via the command & control server. 4. the botmaster will be focussed on recruiting more and more computers to expand the botnet. Remote Control Facility Distinguishes a bot from a worm Worm propagates itself and activates itself Bot is initially controlled from some central facility (master) Typical means of implementing the remote control facility is on an IRC server (Internet Relay Chat, an old and obsolete application layer chat protocol) Bots join a specific channel on this server and treat incoming messages as commands More recent botnets use covert communication channels via protocols such as HTTP Distributed control mechanisms use peer-to-peer protocols to avoid a single point of failure Theft

Keyloggers and Spyware Keylogg er Captures keystrokes to allow attacker to monitor sensitive information Typically uses some form of filtering mechanism that only returns information close to keywords (login, password) Spyware Subverts the compromised machine to allow monitoring of a wide range of activity on the system Monitoring history and content of browsing activity Redirecting certain Web page requests to fake sites Dynamically modifying data exchanged between the browser and certain Web sites of interest Theft Phishing Exploits social engineering to Spear-phishing leverage the users trust by o Recipients are carefully masquerading as communication researched by the attacker from a trusted source o Include a URL in a spam e-mail that links to a fake Web site that mimics the login page of a banking, gaming, or similar site

o Suggests that urgent action is required by the user to authenticate their account o Attacker exploits the account using the captured credentials o E-mail is crafted to specifically suit its recipient, o often quoting a range of information to convince them of its authenticity Worm Countermeasures Considerable overlap in techniques for dealing with viruses and worms o Once a worm is resident on a machine anti-virus software can be used to detect and possibly remove it o Perimeter network activity and usage monitoring can form the basis of a worm defense Worm defense approaches include: o A. Signature-based worm scan filtering (prevent worm scans from entering/leaving network/host) a signature is an algorithm or hash (a number derived from a string of text) that uniquely identifies a specific virus/worm. o B. Filter-based worm containment (content rather than a scan signature.) o C. Payload-classification-based worm containment (examine network packets) o D. Threshold random walk (TRW) scan detection (effective against common worm behaviors) o E. Rate limiting (i.e. limiting the number of new machines a host can connect to in a window of time )

o F. Rate halting (blocks outgoing traffic when a threshold is exceeded either in outgoing connection rate ) Payload Stealthing Backdoor Also known as a trapdoor Secret entry point into a program allowing the attacker to gain access and bypass the security access procedures Maintenance hook is a backdoor used by Programmers to debug and test programs Difficult to implement operating system controls for backdoors in applications E.g. New Stealth Falcon Backdoor Discovered (September 10, 2019) Payload Stealthing Rootkit A rootkit is a set of hidden programs installed on a system to maintain covert/hidden access to that system with administrator (or root) privileges o The rootkit alters the hosts standard functionality in a malicious and stealthy way

Hides by subverting/corrupting the mechanisms that monitor and report on the processes, files, and registries on a computer Gives administrator (or root) privileges to attacker Can add or change programs and files, monitor processes, send and receive network traffic, and get backdoor access on demand E.g. Rootkit -- An Intruder Living in your Kernel Rootkit Classification Characteristics Persistent Memory based User mode Kernel mode Virtual machine based External mode

Malware Countermeasure Approaches Ideal solution to the threat of malware is prevention Four main elements of prevention: Policy Awareness Vulnerability mitigation Threat mitigation If prevention fails, technical mechanisms can be used to support the following threat mitigation options: Detection Identification Removal Generations of Anti-Virus Software First generation: simple scanners Requires a malware signature to identify the malware Limited to the detection of known malware Second generation: heuristic scanners Uses heuristic rules to search for probable malware instances i.e. fragments of code that are often associated with a malware Another approach is integrity checking Third generation: activity traps Memory-resident programs that identify malware by its actions rather than its structure in an infected program

Fourth generation: full-featured protection Packages consisting of a variety of anti-virus techniques used in conjunction (all of the above) Include scanning and activity trap components and access control capability Generic Decryption (GD) Enables the anti-virus program to easily detect complex polymorphic viruses and other malware while maintaining fast scanning speeds Executable files are run through a GD scanner which contains the following elements: CPU emulator Virus signature scanner Emulation control module The most difficult design issue with a GD scanner is to determine how long to run each interpretation Host-Based Behavior-Blocking Software Integrates with the operating system of a host computer and monitors program behavior in real time for malicious action

Blocks potentially malicious actions before they have a chance to affect the system Blocks software in real time so it has an advantage over anti-virus detection techniques such as fingerprinting or heuristics Limitations Because malicious code must run on the target machine before all its behaviors can be identified, it can cause harm before it has been detected and blocked Perimeter Scanning Approaches Anti-virus software typically included in e-mail and Web proxy services running on an organizations firewall and IDS May also be included in the traffic analysis component of an IDS May include intrusion prevention measures, blocking the flow of any

suspicious traffic Approach is limited to scanning malware Ingress monitors Located at the border between the enterprise network and the Internet One technique is to look for incoming traffic to unused local IP addresses Egress monitors Located at the egress point of individual LANs as well as at the border between the enterprise network and the Internet

Monitors outgoing traffic for signs of scanning or other suspicious behavior Two types of monitoring software Summary Types of malicious software (malware) Advanced persistent threat Propagation o Infected content viruses o Vulnerability exploit worms o Social engineering spam e-mail Trojans Payload o System corruption o Attack agent Zombie Bots o Information theft Keyloggers

Phishing Spyware o Stealthing Countermeasures

Recently Viewed Presentations

  • Push and Pull Production - Dokuz Eylül University

    Push and Pull Production - Dokuz Eylül University

    Push and Pull Production Systems You say yes. I say no. You say stop. and I say go, go, go! - The Beatles The Key Difference Between Push and Pull Push Systems: schedule work releases based on demand. inherently due-date...


    Urea diubah menjadi anemia oleh bakteri mulut Perubahan aktifitas platelet Serum uremit toxin akibat bakteri usus Mukosa usus lembab Halitosis / fetor uremicum Perdarahan gusi, stomatitis Mual, muntah, anoreksia, gastritis, ulcreation Gastro inestestinal Oral Lambung 2.
  • Control Structures in VB

    Control Structures in VB

    Chapter 4: Control Statements in Visual Basic (Part 1A) ... all programs can be written by only 3 control structures With "GoTo elimination" * Categories of Control Structures Control Structures Sequence structure Selection structure Repetition structure * Sequence Structure Visual...
  • Evolution Evidence and Theory

    Evolution Evidence and Theory

    Darwin's name became more associated with evolution The Origin of Species published. Darwin's Voyage on the Beagle. Sailed in 1831 for . five years. ... Based on 4 postulates. 1. Individual members of a population differ. Variations.
  • LOS SERES VIVOS Y EL ADN - IHMC Public Cmaps (3)

    LOS SERES VIVOS Y EL ADN - IHMC Public Cmaps (3)

    La totalidad del ADN de una especie, constituye el genoma de un organismo. La invención de técnicas para la secuenciación del ADN, es decir, para el conocimiento del orden que tienen los nucleótidos A, T, C y G que forman...
  • National Association of Community Legal Centres

    National Association of Community Legal Centres

    National Association of Community Legal Centres. 28 February 2019. Polly Porteous - [email protected] Phone: 02 9264 9595. Data Consistency Project 2018-19. Main Findings
  • Science Literacy - Chapter 1

    Science Literacy - Chapter 1

    Uses causal reasoning. Result is . reproducible . Solution can be validated by reproducing the proof and is verified by other/new experiments or demonstrations . Uses inference, analogy, metaphor. Result is . unique, irreproducible.
  • Visual Basic - New Jersey Institute of Technology

    Visual Basic - New Jersey Institute of Technology

    4/18/2010 * *Italics - Taken from Starting out with Visual Basic 2008 page 7 LOL it's a It is A GUI - Graphic User Interface Can create graphics for interaction Between User and application Interaction: Text boxes, radio buttons, and...