Computer Security DD2395 - - PowerPoint PPT Presentation
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/DD2395/dasakh11/ Fall 2011 Sonja Buchegger buc@kth.se Lecture 7 Malicious Software DD2395 Sonja Buchegger 1 Course Admin l Lab 2: - prepare before lab session - signup!
1 DD2395 Sonja Buchegger
DD2395 Sonja Buchegger 2
l Lab 2:
l Lab 3:
l Lab 4:
DD2395 Sonja Buchegger 3
l programs exploiting system vulnerabilities l known as malicious software or malware
l e.g. viruses, logic bombs, and backdoors
l e.g. worms, bots
l sophisticated threat to computer systems
DD2395 Sonja Buchegger 4
l Virus l Worm l Logic bomb l Trojan horse l Backdoor (trapdoor) l Mobile code l Auto-rooter Kit (virus generator) l Spammer and Flooder programs l Keyloggers, Spyware l Rootkit l Zombie, bot l Adware
DD2395 Sonja Buchegger 5
l First identified at NSA in 1972 by Daniel
l It's a program with two purposes, one obvious
l Today it's often used to install other software or
l Trojan horses can be built from existing
l Or designed from the start to be one. DD2395 Sonja Buchegger 6
l How to get someone to run a trojan? l How to not run a trojan? DD2395 Sonja Buchegger 7
l Software that gives access to a system l Bypassing OS restrictions l Can be part of a trojan l Often installed for legitimate reasons l Only to later be abused l Typically very very hard to find DD2395 Sonja Buchegger 8
l What would be a legitimate reason to install a
DD2395 Sonja Buchegger 9
l In the gray zone between harmless and
l Popup windows l For teh lulz l Can include adware, spyware DD2395 Sonja Buchegger 10
l A small bit of code that triggers on a specific
l Typically with malicious results l No vector for spreading l Installed directly DD2395 Sonja Buchegger 11
DD2395 Sonja Buchegger 12
l piece of software that infects programs
l specific to operating system and hardware
l a typical virus goes through phases of:
DD2395 Sonja Buchegger 13
l components:
l prepended / appended / embedded l when infected program invoked, executes
l can block initial infection (difficult) l or propagation (with access controls)
DD2395 Sonja Buchegger 14
DD2395 Sonja Buchegger 15
l boot sector l file infector l macro virus l encrypted virus: different keys l stealth virus: evade detection, e.g.
l polymorphic virus l metamorphic virus
DD2395 Sonja Buchegger 16
l A virus can take things one step further:
l There are many ways to do nothing on a
l Instructions can be reordered in many ways l To detect these the AV engine often has to
DD2395 Sonja Buchegger 17
l Complete rewrite l Can also change behavior DD2395 Sonja Buchegger 18
DD2395 Sonja Buchegger 19
l became very common in mid-1990s since
l exploit macro capability of office apps
l more recent releases include protection l recognized by many anti-virus programs
DD2395 Sonja Buchegger 20
l more recent development l e.g. Melissa
l then saw versions triggered reading email l hence much faster propagation
DD2395 Sonja Buchegger 21
l prevention - ideal solution but difficult l realistically need:
l if detected but can’t identify or remove, must
DD2395 Sonja Buchegger 22
l virus & antivirus tech have both evolved l early viruses simple code, easily removed l as become more complex, so must the
l generations
DD2395 Sonja Buchegger 23
l runs executable files through GD scanner:
l lets virus decrypt itself in interpreter l periodically scan for virus signatures l issue is long to interpret and scan
DD2395 Sonja Buchegger 24
DD2395 Sonja Buchegger 25
DD2395 Sonja Buchegger 26
l replicating program that propagates over net
l has phases like a virus:
l may disguise itself as a system process l implemented by Xerox Palo Alto labs in 1980’s
DD2395 Sonja Buchegger 27
l one of best known early worms l released by Robert Morris in 1988 l various attacks on UNIX systems
l if succeed have remote shell access
DD2395 Sonja Buchegger 28
DD2395 Sonja Buchegger 29
DD2395 Sonja Buchegger 30
l Code Red
l Code Red II variant includes backdoor l SQL Slammer
l Mydoom
DD2395 Sonja Buchegger 31
l Conficker 2009 l Stuxnet 2010 l Duqu 2011
DD2395 Sonja Buchegger 32
l multiplatform l multi-exploit l ultrafast spreading l polymorphic l metamorphic l transport vehicles l zero-day exploit
DD2395 Sonja Buchegger 33
l overlaps with anti-virus techniques l once worm on system A/V can detect l worms also cause significant net activity l worm defense approaches include:
DD2395 Sonja Buchegger 34
DD2395 Sonja Buchegger 35
DD2395 Sonja Buchegger 36
l program taking over other computers l to launch hard to trace attacks l if coordinated form a botnet l characteristics:
l via IRC/HTTP etc
l attack software, vulnerability, scanning strategy
l various counter-measures applicable
DD2395 Sonja Buchegger 37
l set of programs installed for admin access l malicious and stealthy changes to host O/S l may hide its existence
l may be:
l installed by user via trojan or intruder on system l range of countermeasures needed
DD2395 Sonja Buchegger 38
DD2395 Sonja Buchegger 39
l introduced types of malicous software
l worm types and countermeasures l bots l rootkits