Computer Security DD2395 - - PowerPoint PPT Presentation
Computer Security DD2395 http://www.csc.kth.se/utbildning/kth/kurser/DD2395/dasakh10/ Spring 2010 Sonja Buchegger buc@kth.se Lecture 7, Nov. 15, 2010 Malicious Software, Denial of Service Nov. 15, 2010 DD2395 Sonja Buchegger 1 Malicious
1 DD2395 Sonja Buchegger
DD2395 Sonja Buchegger 2
programs exploiting system vulnerabilities known as malicious software or malware
e.g. viruses, logic bombs, and backdoors
e.g. worms, bots
sophisticated threat to computer systems
DD2395 Sonja Buchegger 3
Virus Worm Logic bomb Trojan horse Backdoor (trapdoor) Mobile code Auto-rooter Kit (virus generator) Spammer and Flooder programs Keyloggers Rootkit Zombie, bot
DD2395 Sonja Buchegger 4
piece of software that infects programs
specific to operating system and hardware
a typical virus goes through phases of:
DD2395 Sonja Buchegger 5
components:
prepended / appended / embedded when infected program invoked, executes
can block initial infection (difficult) or propagation (with access controls)
DD2395 Sonja Buchegger 6
DD2395 Sonja Buchegger 7
DD2395 Sonja Buchegger 8
boot sector file infector macro virus encrypted virus stealth virus polymorphic virus metamorphic virus
DD2395 Sonja Buchegger 9
became very common in mid-1990s since
exploit macro capability of office apps
more recent releases include protection recognized by many anti-virus programs
DD2395 Sonja Buchegger 10
more recent development e.g. Melissa
then saw versions triggered reading email hence much faster propagation
DD2395 Sonja Buchegger 11
prevention - ideal solution but difficult realistically need:
if detect but can’t identify or remove, must
DD2395 Sonja Buchegger 12
virus & antivirus tech have both evolved early viruses simple code, easily removed as become more complex, so must the
generations
DD2395 Sonja Buchegger 13
runs executable files through GD scanner:
lets virus decrypt itself in interpreter periodically scan for virus signatures issue is long to interpret and scan
DD2395 Sonja Buchegger 14
DD2395 Sonja Buchegger 15
DD2395 Sonja Buchegger 16
replicating program that propagates over net
has phases like a virus:
may disguise itself as a system process concept seen in Brunner’s “Shockwave Rider” implemented by Xerox Palo Alto labs in 1980’s
DD2395 Sonja Buchegger 17
one of best know worms released by Robert Morris in 1988 various attacks on UNIX systems
if succeed have remote shell access
DD2395 Sonja Buchegger 18
DD2395 Sonja Buchegger 19
Code Red
Code Red II variant includes backdoor SQL Slammer
Mydoom
DD2395 Sonja Buchegger 20
multiplatform multi-exploit ultrafast spreading polymorphic metamorphic transport vehicles zero-day exploit
DD2395 Sonja Buchegger 21
overlaps with anti-virus techniques once worm on system A/V can detect worms also cause significant net activity worm defense approaches include:
DD2395 Sonja Buchegger 22
DD2395 Sonja Buchegger 23
DD2395 Sonja Buchegger 24
program taking over other computers to launch hard to trace attacks if coordinated form a botnet characteristics:
via IRC/HTTP etc
attack software, vulnerability, scanning strategy
various counter-measures applicable
DD2395 Sonja Buchegger 25
set of programs installed for admin access malicious and stealthy changes to host O/S may hide its existence
may be:
installed by user via trojan or intruder on system range of countermeasures needed
DD2395 Sonja Buchegger 26
DD2395 Sonja Buchegger 27
introduced types of malicous software
virus types and countermeasures worm types and countermeasures bots rootkits
DD2395 Sonja Buchegger 28
denial of service (DoS) an action that prevents or
attacks
have been an issue for some time
DD2395 Sonja Buchegger 29
can use simple flooding ping from higher capacity link to lower causing loss of traffic source of flood traffic easily identified
DD2395 Sonja Buchegger 30
DD2395 Sonja Buchegger 31
use forged source addresses
generate large volumes of packets directed at target with different, random, source addresses cause same congestion responses are scattered across Internet real source is much harder to identify
DD2395 Sonja Buchegger 32
other common attack attacks ability of a server to respond to future
overflowing tables used to manage them hence an attack on system resource
DD2395 Sonja Buchegger 33
DD2395 Sonja Buchegger 34
DD2395 Sonja Buchegger 35
attacker often uses either
has much lower traffic volume
DD2395 Sonja Buchegger 36
classified based on network protocol used ICMP Flood
UDP Flood
TCP SYN Flood
DD2395 Sonja Buchegger 37
have limited volume if single source used multiple systems allow much higher traffic
often compromised PC’s / workstations
e.g. Tribe Flood Network (TFN), TFN2K
DD2395 Sonja Buchegger 38
DD2395 Sonja Buchegger 39
use normal behavior of network attacker sends packet with spoofed source
server response is directed at target if send many requests to multiple servers,
various protocols e.g. UDP or TCP/SYN ideally want response larger than request prevent if block source spoofed packets
DD2395 Sonja Buchegger 40
further variation creates a self-contained loop
fairly easy to filter and block
DD2395 Sonja Buchegger 41
DD2395 Sonja Buchegger 42
use DNS requests with spoofed source
exploit DNS behavior to convert a small
attacker sends requests to multiple well
DD2395 Sonja Buchegger 43
high traffic volumes may be legitimate
or legitimate traffic created by an attacker three lines of defense against (D)DoS:
DD2395 Sonja Buchegger 44
block spoofed source addresses
rate controls in upstream distribution nets
use modified TCP connection handling
DD2395 Sonja Buchegger 45
block IP directed broadcasts block suspicious services & combinations manage application attacks with “puzzles” to
good general system security practices use mirrored and replicated servers when
DD2395 Sonja Buchegger 46
need good incident response plan
have standard filters ideally have network monitors and IDS
DD2395 Sonja Buchegger 47
identify type of attack
have ISP trace packet flow back to source
implement contingency plan update incident response plan
DD2395 Sonja Buchegger 48
introduced denial of service (DoS) attacks classic flooding and SYN spoofing attacks ICMP, UDP, TCP SYN floods distributed denial of service (DDoS) attacks reflection and amplification attacks defenses against DoS attacks responding to DoS attacks