20111204 intro malware_livshits_lecture02
2 likes434 views
This document discusses viruses, worms, malware, and techniques for detecting and preventing them. It covers the basics of viruses and how they spread. It then describes the coevolution between viruses and antivirus programs, with viruses constantly evolving new techniques to evade detection while antivirus programs work to improve detection methods. The document outlines several proactive detection techniques used to identify both known and unknown malware threats, such as heuristic analysis, policy-based security, and intrusion detection systems.
![Case Study: Slammer
Buffer overflow vulnerability in Microsoft SQL Server
(MS02-039).
Vulnerability of the following kind:
ProcessUDPPacket() {
char SmallBuffer[ 100 ];
UDPRecv( LargeBuff );
strcpy( SmallBuf, LargeBuf );
…
}](https://image.slidesharecdn.com/20111204intromalwarelivshitslecture02-111204125942-phpapp01/85/20111204-intro-malware_livshits_lecture02-44-320.jpg)
![How to Set Up Heap Spraying?
<SCRIPT language="text/javascript">
shellcode = unescape("%u4343%u4343%...'');
oneblock = unescape("%u0C0C%u0C0C");
var fullblock = oneblock;
while (fullblock.length<0x40000) {
fullblock += fullblock;
}
sprayContainer = new Array();
for (i=0; i<1000; i++) {
sprayContainer[i] = fullblock + shellcode;
}
</SCRIPT>
51](https://image.slidesharecdn.com/20111204intromalwarelivshitslecture02-111204125942-phpapp01/85/20111204-intro-malware_livshits_lecture02-51-320.jpg)
20111204 intro malware_livshits_lecture02
- 1. VIRUSES, WORMS, AND MALWARE Ben Livshits, Microsoft Research
- 2. Overview of Today’s Lecture 2 Viruses Intrusion detection Behavioral detection Firewalls Virus/antivirus Application firewalls coevolution paper discussed Worms
- 3. What is a Virus? a program that can infect other programs by modifying them to include a, possibly evolved, version of itself Fred Cohen, 1983
- 5. Virus/Antivirus Coevolution 5 Basic idea Attacks and defenses follow hand in hand Attackers are usually one step ahead of the game
- 6. Coevolution: Basic Setup 6 Virus Antivirus Wait for user to Identify a sequence of execute an infected file instructions or data Formulate a signature Scan all files Infect other (binary) Look for signature files found verbatim Bottleneck: scanning Spread that way speed
- 7. Basic Virus Signature Matching 7
- 9. Coevolution: Entry Point Scanning 9 Virus Antivirus Place virus at the Entry point scanning entry point or make it directly reachable Do exploration of from the entry point reachable instruction starting with the entry point of the program Make virus small to avoid being easily Continue until no more noticed by user instructions are found
- 10. Coevolution: Virus Encryption 10 Virus Antivirus Decryption routine Decryption (and encryption) routines (packers) used by Virus body viruses are easy to fingerprint Decrypt into memory, not do disk Develop signatures to match Set PC to the beginning of these routines the decryption buffer Attempt to decrypt the virus Encrypt with a different body to perform a secondary key before adding virus to verification (x-raying) new executable
- 11. Coevolution: Polymorphic 11 Virus Antivirus Use a mutation engine to generate Custom detection program a (decryption routine, encryption designed to recognize specific routine) pair detection engines Functionally similar or the same, Generic decryption (GD) but syntactically very different Emulator Signature matching engine Use the encryption routine to Scan memory/disk at regular encode the body of the virus intervals in hopes of finding decoded virus body No fixed part of the virus preserved (decryption, encryption, body)
- 12. GD Challenges 12 How long to emulate the execution? Viruses use padding instructions to delay execution. Can also use sleep for a while to slow down the scanner. What is the quality of the emulator? How many CPUs to support? What if decryption starts upon user interactions? How do we trigger it? What about anti-emulation tricks?
- 13. False Positives in Virus Detection 13 • A "false positive" is when antivirus software identifies a non-malicious file as a virus. When this happens, it can cause serious problems. • For example, if an antivirus program is configured to immediately delete or quarantine infected files, a false positive in an essential file can render the operating system or some applications unusable. In May 2007, a faulty virus signature issued by In April 2010, McAfee VirusScan detected svchost.exe, Symantec mistakenly removed essential operating a normal Windows binary, as a virus on machines system files, leaving thousands of PCs unable to boot running Windows XP with Service Pack 3, causing a reboot loop and loss of all network access Also in May 2007, the executable file required by Pegasus Mail was falsely detected by Norton AntiVirus In December 2010, a faulty update on the AVG anti- as being a Trojan and it was automatically removed, virus suite damaged 64-bit versions of Windows 7, preventing Pegasus Mail from running. Norton anti- rendering it unable to boot, due to an endless boot virus had falsely identified three releases of Pegasus loop created Mail as malware, and would delete the Pegasus Mail installer file when that happened n response to this Pegasus Mail stated: In October 2011, Microsoft Security Essentials removed the Google Chrome browser, rival to Microsoft's own Internet Explorer. MSE flagged On the basis that Norton/Symantec has done this for Chrome as a Zbot banking trojan every one of the last three releases of Pegasus Mail, we can only condemn this product as too flawed to use, and recommend in the strongest terms that our users cease using it in favor of alternative, less buggy anti-virus packages
- 14. Top 20 Malware on Internet/user Computer 14 http://www.securelist.com/en/analysis/204792170/Monthly_Malware_Statistics_March_2011
- 15. Vulnerability Gap 15 As long as user has the right virus signatures and computer has recently been scanner, detection will likely work But the virus landscape changes fast This calls for monitoring techniques for unknown viruses http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf
- 16. CVE-2009-4324: December 2009 16 http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf
- 17. Exploit in the PDF Unfolding… 17 http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf
- 18. Automatic Zero-Day Blocking 18 Scanning engine recognizes the newPlayer() vulnerability (checked in red) Because this is a zero-day vulnerability, the newPlayer() vulnerability would be considered unknown Subsequently, the M86 Secure Web Gateway falls back to its behavioral analysis capability Below, the behavior of the JavaScript is suspicious; therefore it is blocked by this default rule, requiring no update http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf
- 19. Proactive Detection Techniques 19 heuristic analyzer policy-based security intrusion detection/prevention systems etc. http://www.securelist.com/en/downloads/vlpdfs/wp_nikishin_proactive_en.pdf
- 20. Heuristic Analyzers 20 A heuristic analyzer looks at code of executable files Macros Scripts memory or boot sectors to detect malicious programs that cannot be identified using the usual (signature-based) methods Heuristic analyzers search for unknown malicious software Detection rates are usually low: 20-30% at most http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf
- 21. Policy-based Security 21 Use an overall security policy The Cisco-Microsoft approach to restrict certain types of Scan computers of users actions on the machine connecting to the network For instance Limit network access from Don’t open email machines that are not found attachments to be fully compliant (i.e. virus definitions are out of Don’t open files from the date) internet whose reputation is unknown Only allow access to a Force access to an update whitelist of web sites server Disallow software installation “Shepherd” the user into compliance
- 23. IDS: Intrusion Detection Systems 23 What it is Components Securityguards and Collect signals “beware of dog” signs are forms of IDS Process and create alerts Serve two purposes: Notify system Detect something bad operators was happening deter the perpetrator
- 24. Host-Based vs. Network-Based IDS 24 Log analyzers Scan incoming and Signature-based outgoing traffic sensors Primarily signature- System call analyzers based Application behavior Combined into analyzers firewalls File integrity checkers Can be located on a different machine
- 25. Host-Based Intrusion Detection f(int x) { open() x ? getuid() : geteuid(); Entry(g) Entry(f) x++ } g() { close() getuid() geteuid() fd = open("foo", O_RDONLY); f(0); close(fd); f(1); exit(0); exit() } Exit(g) Exit(f) If the observed code behavior is inconsistent with the statically inferred model, something is wrong
- 26. Firewalls: Network and App-level Elizabeth D. Zwicky Simon Cooper Michael Becher D. Brent Chapman
- 27. Basic Firewall Concept Separate local area net from internet Firewall Local network Internet Router All packets between LAN and internet routed through firewall
- 28. Firewall Goals Prevent malicious attacks Provide defense in depth on hosts Programs contain bugs and Port sweeps, ICMP echo to are vulnerable to attack broadcast addr, syn flooding, Network protocols may … contain; Worm propagation Design weaknesses (SSH CRC) Implementation flaws (SSL, NTP, FTP, SMTP...) Prevent general disruption of internal network Control traffic between “zones of trusts” Monitor and control Can control traffic between quality of service (QoS) separate local networks, etc.
- 29. Review: TCP Protocol Stack Application protocol Application Application TCP, UDP protocol Transport Transport IP protocol IP protocol Network IP Network Data Network Data Link Link Link Access Link Transport layer provides ports, logical channels identified by number
- 30. Review: Data Formats TCP Header Application message - data Application message Transport (TCP, UDP) segment TCP data TCP data TCP data Network (IP) packet IP TCP data Link Layer frame ETH IP TCP data ETF IP Header Link (Ethernet) Link (Ethernet) Header Trailer
- 31. Packet Filtering Uses transport-layer Examples information only DNS uses port 53 IP Source Address, Block incoming port 53 Destination Address packets except known trusted servers Protocol (TCP, UDP, ICMP, etc.) Issues TCP or UDP source & Stateful filtering destination ports Encapsulation: address TCP Flags (SYN, ACK, FIN, RST, translation, other PSH, etc.) complications ICMP message type Fragmentation
- 33. Web Application Firewalls 33 When it comes to HTTP traffic, regular firewalls are not very helpful Yet we know that most web attacks use regular HTTP channels: XSS, SQL injection
- 34. Worms
- 35. Worms: A Working Definition 35 A worm is a program that can run by itself and can propagate a fully working version of itself to other machines It is derived from the word tapeworm, a parasitic organism that lives inside a host and saps its resources to maintain itself
- 36. The Morris Worm (1988) 36 Robert T. Morris Boston Museum of Science
- 37. Morris Worm Account by Spafford (1989) 37
- 38. Worms: A Brief History 38 Native JavaScript Samy/MySpace (2005) Morris Worm (1988) xanga.com (2005) Melissa (1999) SpaceFlash/MySpace Yamanner/Yahoo! Mail Code Red (2001) QSpace/MySpace Nimda (2001) adultspace.com Blaster (2003) gaiaonline.com u-dominion.com (2007) SQL Slammer (2003) Blaster/Slammer Code red/Nimda /Yahoo! Mail Morris Worm Yamanner Melissa Samy 1998 1999 2001 2003 2005 2006 …
- 39. Morris Worm (1988) Damage: 6,000 computers in just a few hours What: just copied itself; didn’t touch data Exploited: buffer overflow in fingerd (UNIX) sendmail debug mode (exec arbitrary cmds) dictionary of 432 frequently used passwords
- 40. Melissa (1999) What: just copied itself; did not touch data When date=time, “Twenty-two points, plus triple word score, plus fifty points for using all my letters. Game’s over. I’m outta here.” Exploited: MS Word Macros (VB) MS Outlook Address Book (Fanout = 50) “Important message from <user name> …”
- 41. Code Red (2001) Runs on WinNT 4.0 or Windows Two flavors: 2000 Code Red I: high traffic, web defacements, DDOS on Scans port 80 on up to 100 whitehouse.gov, crash systems random IP addresses Code Red II: high traffic, backdoor install, crash systems Resides only in RAM; no files Three phases: propagation Exploits buffer overflow in (1-19), flood (20-27), Microsoft IIS 4.0/5.0 termination (28-31) (Virus appeared one month after advisory went out) Other victims: Cisco 600 Routers, HP JetDirect Printers
- 42. Nimda (2001) Multiple methods of spreading (email, client-to-server, server-to-client, network sharing) Server-to-client: IE auto-executes readme.eml (that is attached to all HTML files the server sends back to the client) Client-to-server: “burrows”: scanning is local 75% of time Email: readme.exe is auto executed upon viewing HTML email on IE 5.1 or earlier
- 43. More on Slammer 43 When Feature Jan 25 2003 Fast propagation speed >55million scans per second How two orders of magnitude Exploit Buffer-overflow faster than Code Red worm MS SQL/MS SQL Server Desktop Engine No harmful payload known vulnerability, publicized in July 2002 Countermeasure Patch Scale Firewall (port blocking) At least 74,000 hosts
- 44. Case Study: Slammer Buffer overflow vulnerability in Microsoft SQL Server (MS02-039). Vulnerability of the following kind: ProcessUDPPacket() { char SmallBuffer[ 100 ]; UDPRecv( LargeBuff ); strcpy( SmallBuf, LargeBuf ); … }
- 46. Heap-Based Exploitation: 3-Step Process 46 1. Force the right x86 All parts are code to be challenging allocated on the Firstcan be done program heap with JavaScript Second part is tough 2. Exploit Third is unreliable 3. Force a jump to the heap
- 47. Advanced Malware Techniques 47 Heap spraying Heap feng shui JIT spraying
- 48. Stack Overflow Exploit Stack return address NOP sled shellcode 48
- 49. Heap Corruption Exploit Heap vtable 2 jump pointer NOP sled shellcode <IFRAME SRC=file://BBBBBBBBBBBBBBBBBBBBBBBBBBBBB BBBBB … NAME="CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC CCCCCC … ഍഍"></IFRAME> 1 exploit 49
- 50. Heap Spraying Exploit Heap sled sled sled sled sled shellcode shellcode shellcode shellcode shellcode sled sled vtable pointer shellcode shellcode sled sled sled sled shellcode shellcode shellcode shellcode 1 spray 2 exploit 3 jump 50
- 51. How to Set Up Heap Spraying? <SCRIPT language="text/javascript"> shellcode = unescape("%u4343%u4343%...''); oneblock = unescape("%u0C0C%u0C0C"); var fullblock = oneblock; while (fullblock.length<0x40000) { fullblock += fullblock; } sprayContainer = new Array(); for (i=0; i<1000; i++) { sprayContainer[i] = fullblock + shellcode; } </SCRIPT> 51
- 52. Advanced Malware Techniques 52 Heap Feng Shui is a new technique Heap spraying for precise manipulation of the browser heap layout using specific sequences of JavaScript allocations This is implemented as a JavaScript library with functions for setting up Heap feng shui the heap in a controlled state before triggering a heap corruption bug Using this technique makes it JIT spraying possible to exploit very difficult heap corruption vulnerabilities with great reliability and precision
- 53. Heap Massaging 53 <script type="text/javascript" src="heapLib.js"></script> This program allocates a 16 <script type="text/javascript"> byte block of memory and copies the string "AAAAA" // Create a heapLib object for Internet Explorer var heap = new heapLib.ie(); into it heap.gc(); // Run the garbage collector The block is tagged with before doing any allocations the tag foo, which is later // Allocate 512 bytes of memory and fill it with used as an argument to padding heap.alloc(512); free() // Allocate a new block of memory for the string The free() function frees "AAAAA" and tag the block with "foo" heap.alloc("AAAAA", "foo"); all memory blocks marked with this tag // Free all blocks tagged with "foo" heap.free("foo"); </script>
- 54. Advanced Malware Techniques 54 Heap spraying Heap feng shui JIT spraying
- 55. JIT Spraying: JavaScript to x86 55 var y = addr op imm assembly 0 B8 D9D0543C MOV EAX,3C54D0D9 ( 5 35 5890903C XOR EAX,3C909058 0x3c54d0d9 ^ 10 35 6AF4593C XOR EAX,3C59F46A 0x3c909058 ^ 15 35 01C8903C XOR EAX,3C90C801 0x3c59f46a ^ 20 35 D930903C XOR EAX,3C9030D9 0x3c90c801 ^ 25 35 5B53533C XOR EAX,3C53535B 0x3c9030d9 ^ 0x3c53535b ^ ... )
- 56. 56 Conclusions Viruses Intrusion detection Behavioral detection Firewalls Virus/antivirus Application firewalls coevolution Worms