Analyzing and Defending from Modern Internet Threats
1 like187 views
The document presents research by Andrea Continella on analyzing and defending against modern internet threats, focusing on malware detection, ransomware, and mobile privacy leaks. It discusses system security research conducted by a group at UC Berkeley, highlighting various detection methods and the development of a self-healing virtual file system to combat ransomware. The research emphasizes the importance of transitioning malware detection from software to hardware for improved security and resilience against evolving threats.
Analyzing and Defending from Modern Internet Threats
- 1. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Analyzing and Defending from Modern Internet Threats Andrea Continella andrea.continella@polimi.it 23-May-2018 @ UC Berkeley
- 2. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Who we are? ● System Security Research Group ○ 1 Associate Professor ○ 3 Postdoctoral Researchers ○ 3 (almost 4) PhD Students ○ 15+ Master Students ● Research Lines: ○ Malware and Threat Analysis ○ Frauds Analysis and Detection ○ Mobile Security ○ Security of Cyber-physical systems ● Hacking Activities (aka CTF) ○ Tower of Hanoi ~> http://toh.necst.it/ ○ mHACKeroni
- 3. Ransomware
- 4. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella FS Activity Monitor ● Windows Kernel module to monitor and log the file system activity ○ Windows Minifilter Driver ○ Log IRPs (I/O Request Packets) Process Hardware Storage Driver File System Filter Manager I/O Manager Kernel mode User mode
- 5. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Ransomware vs. Benign Apps Storage Driver File System IRPLogger I/O Manager Kernel mode User mode Benign Ransomware? ? ? Disk drive
- 6. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Ransomware vs Benign Apps Feature Values Frequency (1) # Folder listing Feature Values Frequency Feature Values Frequency Feature Values Frequency Feature Values Frequency Feature Values Frequency Benign Ransomware (2) # Files Read (3) # Files Written (4) # Files Renamed (5) File Type Coverage (6) Write Entropy
- 7. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ShieldFS: Healing Approach
- 8. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ShieldFS: Healing Approach
- 9. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella File Recovery Workflow Unknown Start
- 10. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella File Recovery Workflow Monitor & COW on first write Unknown Start
- 11. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella File Recovery Workflow Monitor & COW on first write Unknown ShieldFS Detector Start
- 12. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella File Recovery Workflow Monitor & COW on first write Unknown ShieldFS DetectorMalicious Restore original copies Start
- 13. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella File Recovery Workflow Monitor & COW on first write Unknown ShieldFS DetectorMalicious Restore original copies Benign Clean old copies Start
- 14. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Detection & Recovery Capabilities ● 1483 unseen samples ○ Locky, TeslaCrypt, CryptoLocker, Critroni, TorrentLocker, CryptoWall, Troldesh, CryptoDefense, PayCrypt, DirtyDecrypt, ZeroLocker, Cerber, WannaCry ● Files protected: always 100% ○ Even in case of missed detection ● Detection rate: 1436/1483, 96.9%
- 15. Are we safe now?
- 16. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Limitations of Software-based Detectors Kernel Hardware Detector OS App
- 17. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Limitations of Software-based Detectors Kernel Hardware Detector OS App
- 18. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Limitations of Software-based Detectors Kernel Hardware Detector OS App
- 19. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Limitations of Software-based Detectors
- 20. Can we move malware detectors toward the hardware level?
- 21. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● Access physical memory with an external device through PCIe Monitoring Physical Memory CPU Root Complex Memory PCIe endpoint PCIe endpoint
- 22. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● Access physical memory with an external device through PCIe Monitoring Physical Memory 4cf8eafbfa631312 10e669b3e98b67f6 82097ae3fe87145c 8c2fd30bf67781d7 b7bade6b459548f0 2828d603887a888a Semantic Reconstruction Raw memory Data Structures ● Live memory forensics - Filling the semantic gap CPU Root Complex Memory PCIe endpoint PCIe endpoint
- 23. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Memory Detection Features
- 24. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Memory Detection Features ● Code injection: execute malicious code within benign process
- 25. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Memory Detection Features ● Code injection: execute malicious code within benign process
- 26. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Memory Detection Features ● Code injection: execute malicious code within benign process
- 27. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Memory Detection Features ● Code injection: execute malicious code within benign process ● Self-modifying Code: uncompress or decrypt code
- 28. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Memory Detection Features ● Code injection: execute malicious code within benign process ● Self-modifying Code: uncompress or decrypt code
- 29. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Memory Detection Features ● Code injection: execute malicious code within benign process ● Self-modifying Code: uncompress or decrypt code
- 30. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Memory Detection Features ● Code injection: execute malicious code within benign process ● Persistence: rerun across reboots ● Self-modifying Code: uncompress or decrypt code
- 31. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Experimental Setup PCIe USB Target/Protected Machine (Win 8.1) Physical Memory Reader Malware Detector USB3380
- 32. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Results Overview Dataset: 2050 samples: ● Arancino dataset ~> 500 samples ● Quincy dataset ~> 73 samples ● VirusTotal ~> 1477 samples
- 33. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Next? PCIe Target/Protected Machine FPGA-based Detector
- 35. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Mobile Privacy Leak Detection ● Mobile apps are known to leak private information over the network (e.g., IMEI, Location, Contacts) ● Researchers developed approaches to detect them ○ Static taint analysis ○ Dynamic taint analysis
- 36. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Mobile Privacy Leak Detection ● Mobile apps are known to leak private information over the network (e.g., IMEI, Location, Contacts) ● Researchers developed approaches to detect them ○ Static taint analysis ○ Dynamic taint analysis ● Recently, network-based detection ○ Leaked values need to flow through the network
- 38. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● Identify privacy leaks in a way that is resilient to obfuscation | encoding | encryption ● Perform black-box differential analysis 1. Establish a baseline of the network behavior 2. Modify sources of private information 3. Detect leaks observing differences in network traffic Our Approach
- 39. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● Identify privacy leaks in a way that is resilient to obfuscation | encoding | encryption ● Perform black-box differential analysis 1. Establish a baseline of the network behavior 2. Modify sources of private information 3. Detect leaks observing differences in network traffic Our Approach APPIMEI: 12345678
- 40. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● Identify privacy leaks in a way that is resilient to obfuscation | encoding | encryption ● Perform black-box differential analysis 1. Establish a baseline of the network behavior 2. Modify sources of private information 3. Detect leaks observing differences in network traffic Our Approach APPIMEI: 12345678 http://host.com/?id=39979edb58
- 41. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● Identify privacy leaks in a way that is resilient to obfuscation | encoding | encryption ● Perform black-box differential analysis 1. Establish a baseline of the network behavior 2. Modify sources of private information 3. Detect leaks observing differences in network traffic Our Approach APPIMEI: 12345678 http://host.com/?id=39979edb58 APPIMEI: 98765432
- 42. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● Identify privacy leaks in a way that is resilient to obfuscation | encoding | encryption ● Perform black-box differential analysis 1. Establish a baseline of the network behavior 2. Modify sources of private information 3. Detect leaks observing differences in network traffic Our Approach APPIMEI: 12345678 http://host.com/?id=39979edb58 APPIMEI: 98765432 http://host.com/?id=bae6a29c9b
- 43. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● Network traffic is non-deterministic ● The output changes even if you don't change the source ● Cannot pin a change in the output to a specific change in the input Not so easy...
- 44. We found that non-determinism can be often explained and removed, making differential analysis possible.
- 45. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Sources of Non-Determinism
- 46. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Sources of Non-Determinism Random values
- 47. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Sources of Non-Determinism Random values Timing values
- 48. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Sources of Non-Determinism Random values Timing values Network values
- 49. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Sources of Non-Determinism Random values Timing values Network values System values
- 50. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Sources of Non-Determinism Random values Timing values Network values System values Encryption
- 51. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Sources of Non-Determinism Random values Timing values Network values System values Encryption Executions
- 52. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Comparison with Existing Tools Our approach (Agrigento) detected many more apps && we manually verified most of them were true positives!
- 53. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Case Study: ThreatMetrix https://h.online-metrix.net/fp/clear.png?ja=33303426773f3a39 30643667663b33383831303d343526613f2d363830247a3f363026663d33 3539347a31323838266c603d687c7672253163253066253066616f6e7465 6e762f6a732c746370626f7926636f652466723f6a747670253161273266 253266616d6d2e65616f656b69726b7573267270697867636e617730266a 683d65616437613732316431353c65613a31386e67606563303736363936 34343363266d64643f6561633336303b64336a3935316663303666636137 3261363a61616335636761266d66733f353b32306d383230613230643b65 34643934383a31663636623b32323767616126616d65613d313933333133 3331333131333133312661743d6365656e765f6f6f6a696c6d26617e3f76 72777174666566676e6665722b6d6f606b6c652733632b392e3226342d3b ...
- 54. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella Case Study: ThreatMetrix 1. IMEI, Location, MAC address ~> HashMap 2. XOR HashMap with a randomly generated key 3. Hex-encode HashMap 4. Send obfuscated HashMap & random key https://h.online-metrix.net/fp/clear.png?ja=33303426773f3a3930643667663b3338 3831303d343526613f2d363830247a3f363026663d333539347a31323838266c603d687c7672 253163253066253066616f6e74656e762f6a732c746370626f7926636f652466723f6a747670 253161273266253266616d6d2e65616f656b69726b7573267270697867636e617730266a683d 65616437613732316431353c65613a31386e6760656330373636393634343363266d64643f65 61633336303b64336a39353166633036666361373261363a61616335636761266d66733f353b 32306d383230613230643b6534643934383a31663636623b32323767616126616d65613d3139 333331333331333131333133312661743d6365656e765f6f6f6a696c6d26617e3f7672777174 666566676e6665722b6d6f606b6c652733632b392e3226342d3b...
- 55. NGC 2018Analyzing and Defending from Modern Internet Threats Andrea Continella ● We need generic and automated solutions to fight evolving threats ● Ransomware Generic models to identify ransomware Pure detection is not enough ~> Self-healing virtual FS ● OS might be untrusted ~> move detectors toward the hardware level ● Mobile Privacy Leak ○ Non-Determinism in network traffic can be removed ○ Black-box, obfuscation-resilient approach Conclusions