Cache, Trigger, Impersonate: Enabling Context-Sensitive Honeyclient - PowerPoint PPT Presentation

Cache, Trigger, Impersonate: Enabling Context-Sensitive Honeyclient Analysis On-the- Wire By Teryl Taylor , Kevin Z. Snow, Nathan Otterness and Fabian Monrose University of North Carolina at Chapel Hill

Motivation PU Internet Get www.somenews.com ev Motivation Cache, Trigger, Impersonate 2 2

Motivation PU Internet ev Motivation Cache, Trigger, Impersonate 3 3

Motivation PU Internet Get www.exploitkit.com ev Motivation Cache, Trigger, Impersonate 4 4

Motivation PU I have CVE-2015-0318 Win7, IE11 Flash Internet Flash 11.8 Exploit ev Motivation Cache, Trigger, Impersonate 5 5

Current Approaches Internet www.owned.com www.evil.com www.mal.com Internet HTTP Analyzer Get http://www.owned.com Get http://www.evil.com Get http://www.mal.com www.mal.com End users www.evil.com www.owned.com Goals and Current Approaches Cache, Trigger, Impersonate 6 6

Current Approaches Internet www.owned.com Internet HTTP Analyzer Get http://www.owned.com www.mal.com End users www.evil.com www.owned.com 7

Operational Challenges and Constraints ❖ Limit interaction with the client or server. ❖ Must handle the fire hose of data. ❖ Attackers spread exploits across multiple web resources. HTML Javascript CSS Flash ❖ Limited to memory storage. Operational Challenges Cache, Trigger, Impersonate 8 8

Framework ❖ CACHE: ❖ A small time window of traffic. ❖ TRIGGER: ❖ On a potentially exploitable file type. ❖ Flash comprises 75% for popular kits. ❖ IMPERSONATE: ❖ The client and server using the semantic cache and a honeyclient. Operational Challenges Cache, Trigger, Impersonate 9 9

Example PU PU PU www.a.com www.b.com www.maliciouspage.com Internet evilflash.com/evil.swf ev Client IP: 192.168.2.30 Motivation Cache, Trigger, Impersonate 10 10

Example Cont’d evilflash.com/evil.swf Network Client IP: 192.168.2.30 11 11

CACHE Semantic Cache ! HTTP Analyzer ev www.maliciouspage.com evilflash.com/ www.a.com/ www.a.com/ evil.swf page1 page2 Two-level Cache 12 12

TRIGGER Semantic Semantic Trigger Trigger Cache Cache ! ! ! ! HTTP Analyzer H(.) H(.) ev H( ⨁ ) H(.) H(.) H(.) 13 13

IMPERSONATE Semantic Semantic Trigger Cache Cache ! ! ! HTTP Analyzer Network Oracle ev Retrieve Client Configuration Impersonate ! evilflash.com/evil.swf Network Client IP: 192.168.2.30 Browser: IE 10 Flash Version: 18.5 OS: Windows 7 14 14

IMPERSONATE Semantic Semantic Trigger Cache Cache ! ! ! HTTP Analyzer Chaining Algorithm: Going Back in Time! evilflash.com/evil.swf ev www.a.com/page1 Impersonate ! www.a.com/page2 www.maliciouspage.com 15 15

IMPERSONATE Semantic Semantic Trigger Cache Cache ! ! ! HTTP Analyzer Cache PU ev evilflash.com/ evil.swf Internet www.maliciouspage.com Impersonate ! Browser: IE 10 Get www.maliciouspage.com Flash Version: 18.5 OS: Windows 7 ev Alerts 16 16 www.maliciouspa Security Analyst

Evaluation - Campus Metasploit Server Internet Serves: 11 Flash exploits Affects: 3 Flash Versions Dell R410 ShellOS: 5 VMs 128 GBs RAM Chrome, IE, Firefox 8 Core Xeon 2100 CPU Headless Browser: HTMLUnit EndaceDAG Card 25,000 Students Avg 1,000 Concurrent Users Windows 7 14,000 HTTP flows/min Firefox/IE Peak: 35,000 flows/min 3 Flash Versions UNC Campus Clients Evaluation Cache, Trigger, Impersonate 17 17

Evaluation – Results Total: 576,000 Filtered: 99% of Flash Files. 5% Fully Analyzed 11% Interactive 8% Low and Slow 76% Errors * Found on avg 2 malicious sites per day Evaluation Cache, Trigger, Impersonate 18 18

Conclusion: Honeyclient to the Wire ❖ Current network-based approaches are too slow to react. ❖ We propose a framework that: ❖ Caches minutes worth of web objects. ❖ Triggers an analysis on exploitable file types. ❖ Impersonates both the client and the server. ❖ Demonstrated utility on a large campus network. Conclusion Cache, Trigger, Impersonate 19 19

Questions? Teryl Taylor Cache, Trigger, Impersonate 20 20

Evaluation – Performance Evaluation Cache, Trigger, Impersonate 21 21

Evaluation – Cache Evaluation Cache, Trigger, Impersonate 22 22

Evaluation – VirusTotal over Time Evaluation Cache, Trigger, Impersonate 23 23

Evaluation – Minutes between Flash-in-Flash Evaluation Cache, Trigger, Impersonate 24 24

Evaluation – Length of Client Cache Evaluation Cache, Trigger, Impersonate 25 25

➍ Honeyclients ❖ Honeyclient H1 (ShellOS): ❖ Process contains code injection/code reuse payload. ❖ Process memory exceeds tunable threshold – heap spray. ❖ Process terminates or crashes. (Snow et. al, ShellOS: Enabling Fast Detection and Forensic Analysis of Code Injection Attacks, USENIX Security, 2011.) Honeyclients Cache, Trigger, Impersonate 26 26

➍ Honeyclients ❖ Honeyclient H2 (Cuckoo Sandbox): ❖ Process uses known anti-detection technique. ❖ Process spawns another process. ❖ Process downloads exe or dll file. ❖ Process accesses registry or system files. (https://cuckoosandbox.org/) Honeyclients Cache, Trigger, Impersonate 27 27

Exploit Kits – Corporate Ownage as a Service Targeted Victims/day: 90,000 Successful Infections: 40% Exploits Served Per Day: 9,000 Ransomware Delivered: 62% • Cisco Talos Group: http://www.talosintel.com/angler-exposed/ • October 2015 Exploit Kits Cache, Trigger, Impersonate 28 28

Impact of File Hashing Semantic Semantic Trigger Trigger Cache Cache ! ! ! ! HTTP Analyzer 29 29

Impact of Piecewise Hashing Semantic Semantic Trigger Trigger Cache Cache ! ! ! ! HTTP Analyzer 30 30

Evaluation – Detection Performance Prototype: Monitors 10,000 lines of Code H1: ShellOS Code Injection/ Reuse. Configuration: Windows 7 IE 8 and 10 Four Core 177 Exploit Kit 8 Flash Versions i7-2600 CPU Traces* 3.40 GHz Monitors 16 GB RAM OS Changes. H2: Cuckoo *www.malware-traffic-analysis.net Evaluation Cache, Trigger, Impersonate 31 31

Evaluation – H1 Results 92% True Positive Rate Evaluation Cache, Trigger, Impersonate 32 32

Evaluation – H2 Results 56% True Positive Rate H1 & H2 Combined: 100% True Positive Rate Evaluation Cache, Trigger, Impersonate 33 33

Evaluation – Comparison – VirusTotal 61 % True Positive Rate Evaluation Cache, Trigger, Impersonate 34 34