cse 484 cse m 584 computer security malware and online
play

CSE 484 / CSE M 584 Computer Security: Malware and Online - PowerPoint PPT Presentation

Nov 02, 2022 •236 likes •638 views

CSE 484 / CSE M 584 Computer Security: Malware and Online Ecosystem Studies TA: Thomas Crosley tcrosley@cs With material from Franzi, Adrian Sham, and various sources Reminders Homework #3, due May 23th, 8pm (Tomorrow!) Lab #3 due

  1. CSE 484 / CSE M 584 Computer Security: Malware and Online Ecosystem Studies TA: Thomas Crosley tcrosley@cs With material from Franzi, Adrian Sham, and various sources

  2. Reminders • Homework #3, due May 23th, 8pm (Tomorrow!) • Lab #3 due June 3, 8pm • Preliminary Final Project Due Date #2 – (This!) Monday May 30 th , 8pm 5/26/16 CSE 484 / CSE M 584 – Fall 2015 2

  3. Malware 5/26/16 CSE 484 / CSE M 584 – Fall 2015 3

  4. Malware • Malicious code often masquerades as good software or attaches itself to good software • Some malicious programs need host programs – Trojan horses (malicious code hidden in useful program) • Others can exist and propagate independently – Worms, automated viruses • Many infection vectors and propagation methods • Modern malware often combines techniques 5/26/16 CSE 484 / CSE M 584 - Spring 2015 4

  5. Viruses • Virus propagates by infecting other programs – Automatically creates copies of itself, but to propagate, a human has to run an infected program – Self-propagating viruses are often called worms • Many propagation methods – Insert a copy into every executable (.COM, .EXE) – Insert a copy into boot sectors of disks • PC era: “Stoned” virus infected PCs booted from infected floppies, stayed in memory, infected every inserted floppy – Infect common OS routines, stay in memory 5/26/16 CSE 484 / CSE M 584 - Spring 2015 5

  6. First Virus: Creeper • Written in 1971 at BBN • Infected DEC PDP-10 machines running TENEX OS • Jumped from machine to machine over ARPANET – Copied its state over, tried to delete old copy • Payload: displayed a message “ I’m the creeper, catch me if you can! ” • Later, Reaper was written to delete Creeper http://history-computer.com/Internet/Maturing/Thomas.html 5/26/16 CSE 484 / CSE M 584 - Spring 2015 6

  7. Virus Detec\on • Simple anti-virus scanners – Look for signatures (fragments of known virus code) – Heuristics for recognizing code associated with viruses • Example: polymorphic viruses often use decryption loops – Integrity checking to detect file modifications • Keep track of file sizes, checksums, keyed HMACs of contents 5/26/16 CSE 484 / CSE M 584 - Spring 2015 7

  8. Arms Race: Polymorphic Viruses • Encrypted viruses: constant decryptor followed by the encrypted virus body • Polymorphic viruses: each copy creates a new random encryption of the same virus body – Decryptor code constant and can be detected – Historical note: “Crypto” virus decrypted its body by brute-force key search to avoid explicit decryptor code 5/26/16 CSE 484 / CSE M 584 - Spring 2015 8

  9. Smarter Virus Detec\on? • Generic decryption and emulation – Emulate CPU execution for a few hundred instructions, recognize known virus body after it has been decrypted – Does not work very well against viruses with mutating bodies and viruses not located near beginning of infected executable 5/26/16 CSE 484 / CSE M 584 - Spring 2015 9

  10. Viruses vs. Worms VIRUS WORM • Propagates by infecting • Propagates automatically other programs by copying itself to target systems • Usually inserted into host code (not a standalone • A standalone program program) 5/26/16 CSE 484 / CSE M 584 - Spring 2015 10

  11. Slammer (Sapphire) Worm • January 24/25, 2003: UDP worm exploiting buffer overflow in Microsoft’s SQL Server (port 1434) – Overflow was already known and patched by Microsoft… but not everybody installed the patch • Entire code fits into a single 404-byte UDP packet – Worm binary followed by overflow pointer back to itself • Classic stack smash combined with random scanning – Once control is passed to worm code, it randomly generates IP addresses and sends a copy of itself to port 1434 5/26/16 CSE 484 / CSE M 584 - Spring 2015 11

  12. Slammer Propaga\on • Scan rate of 55,000,000 addresses per second – Scan rate = the rate at which worm generates IP addresses of potential targets – Up to 30,000 single-packet worm copies per second • Initial infection was doubling in 8.5 seconds (!!) – Doubling time of Code Red (2001) was 37 minutes • Worm-generated packets saturated carrying capacity of the Internet in 10 minutes – 75,000 SQL servers compromised – … in spite of the broken pseudo-random number generator used for IP address generation 5/26/16 CSE 484 / CSE M 584 - Spring 2015 12

  13. 05:29:00 UTC, January 25, 2003 [from Moore et al. “ The Spread of the Sapphire/Slammer Worm ” ] 5/26/16 CSE 484 / CSE M 584 - Spring 2015 13

  14. 30 Minutes Later [from Moore et al. “ The Spread of the Sapphire/Slammer Worm ” ] Size of circles is logarithmic in the number of infected machines 5/26/16 CSE 484 / CSE M 584 - Spring 2015 14

  15. Impact of Slammer • $1.25 Billion of damage • Temporarily knocked out many elements of critical infrastructure – Bank of America ATM network – Entire cell phone network in South Korea – Five root DNS servers – Continental Airlines ’ ticket processing software • The worm did not even have malicious payload… simply bandwidth exhaustion on the network and CPU exhaustion on infected machines 5/26/16 CSE 484 / CSE M 584 - Spring 2015 15

  16. [Cross and Valacek] Slammer Acermath • Slammer packets were ubiquitous in the Internet for many years after 2003 – Could be used as a test for Internet connectivity J – Packets provided a map of vulnerable machines • Vanished on March 10-11, 2011 Evidence of a clock-based shutoff trigger 5/26/16 CSE 484 / CSE M 584 - Spring 2015 16

  17. Botnets • Botnet is a network of autonomous programs capable of acting on instructions – Typically a large (up to several hundred thousand) group of remotely controlled “ zombie ” systems • Machine owners are not aware they have been compromised – Controlled and upgraded from command-and-control (C&C) servers • Used as a platform for various attacks – Distributed denial of service, Spam and click fraud – Launching pad for new exploits/worms 5/26/16 CSE 484 / CSE M 584 - Spring 2015 17

  18. What to Do With a Botnet? • Denial of service (including cyber-warfare) • Spam • Fake an\virus sales, Ransomware • Adver\sing clickfraud • Bitcoin mining – According to Symantec, one compromised machine yields 41 US cents a year… 5/26/16 CSE 484 / CSE M 584 - Spring 2015 18

  19. Distributed Denial of Service (DDoS) The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and then open Attacker the file again. If the red x still appears, you may have to delete the image and then insert it again. Master machines Zombie machines The image cannot be displayed. Your computer may not have or the Victim enough memory to open the image, 5/26/16 CSE 484 / CSE M 584 - Spring 2015 19

  20. How to Protect Yourself? • Nothing is perfect but… – Keep your socware updated – Be vigilant for phishing aiacks – An\-virus – Firewalls – Intrusion detec\on systems 5/26/16 CSE 484 / CSE M 584 - Spring 2015 20

  21. Online Ecosystem Studies 5/26/16 CSE 484 / CSE M 584 – Fall 2015 21

  22. CAPTCHA • CAPTCHA ( C ompletely A utomated P ublic T uring test to tell C omputers and H umans A part) • Ar\ficial Intelligence technology can solve 99.8% hip://googleonlinesecurity.blogspot.com/2014/12/are-you-robot-introducing-no-captcha.html 5/26/16 CSE 484 / CSE M 584 – Fall 2015 22

  23. reCAPTCHA • Use risk analysis, provide beier user experience 5/26/16 CSE 484 / CSE M 584 – Fall 2015 23

  24. [Motoyama et al.] Dirty Jobs – The Role of Freelance Labor in Web Service Abuse Following slides by : Mar\ Motoyama, Damon McCoy, Kirill Levchenko, Stefan Savage, and Geoffrey M. Voelker UC San Diego hips://www.usenix.org/legacy/events/sec11/tech/slides/motoyama.pdf

  25. [Motoyama et al.] Vulnerability of Web Services • Many web services today are free/open access – Supported by adver\sing revenue – Reaching cri\cal mass requires low barrier to entry – Page views driven by user-generated content • Videos, social networking updates, blogs, etc • However, openness leaves sites vulnerable to abuse – Exploita\on of free resources • Sending spam from web based email accounts – Unsanc\oned adver\sing channels • Spamming links on blog comments 5/26/16 CSE 484 / CSE M 584 – Fall 2015 25

  26. [Motoyama et al.] Abuse Labor Markets • Abuse is profitable – Kanich et al. es\mated $7k/day email spam revenue • Labor markets have evolved to supply workers – Online freelancing sites • Why outsource abuse jobs? – Cost effec\ve: Low wage regions – Agile: Workers are adept and technically capable – Scale: ~one million workers on Freelancer.com 5/26/16 CSE 484 / CSE M 584 – Fall 2015 26

  27. [Motoyama et al.] Outsourcing jobs • Freelancer.com: one of the largest outsourcing and oldest freelancing sites – Claims over 2 million employers and workers – User popula\on covers 234 countries / regions • How it works: – Buyer/employers post jobs – Workers bid on jobs – Buyers select workers 5/26/16 CSE 484 / CSE M 584 – Fall 2015 27

  28. [Motoyama et al.] 5/26/16 CSE 484 / CSE M 584 – Fall 2015 28

  29. [Motoyama et al.] 5/26/16 CSE 484 / CSE M 584 – Fall 2015 29

  30. [Motoyama et al.] 5/26/16 CSE 484 / CSE M 584 – Fall 2015 30

  31. [Motoyama et al.] CAPTCHA Solving 5/26/16 CSE 484 / CSE M 584 – Fall 2015 31

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu February 22, 2018 Exploring the Online Ecosystem One nice aspect of malware analysis is that, since much of it originates online and

119 views • 10 slides
Malware, cont CS 161: Computer Security Prof. Vern Paxson TAs: Jethro Beekman, Mobin Javed,

Malware, cont CS 161: Computer Security Prof. Vern Paxson TAs: Jethro Beekman, Mobin Javed,

Malware, cont CS 161: Computer Security Prof. Vern Paxson TAs: Jethro Beekman, Mobin Javed, Antonio Lupher, Paul Pearce & Matthias Vallentin http://inst.eecs.berkeley.edu/~cs161/ April 18, 2013 Large-Scale Malware Worm = code

734 views • 39 slides
CSCI 4250/6250 Fall 2011 Computer and Networks Security Malware Goodrich, Chapter 4

CSCI 4250/6250 Fall 2011 Computer and Networks Security Malware Goodrich, Chapter 4

CSCI 4250/6250 Fall 2011 Computer and Networks Security Malware Goodrich, Chapter 4 Viruses, Worms, Trojans, Rootkits Malware = Malicious Software can be classified into several categories, depending on propagation and concealment

472 views • 46 slides
ECE560 Computer and Information Security Fall 2020 Malware Tyler Bletsch Duke University

ECE560 Computer and Information Security Fall 2020 Malware Tyler Bletsch Duke University

ECE560 Computer and Information Security Fall 2020 Malware Tyler Bletsch Duke University [SOUP13] defines malware as: a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality,

909 views • 53 slides
Computer and Information Security Fall 2019 Malware Tyler Bletsch Duke University [SOUP13]

Computer and Information Security Fall 2019 Malware Tyler Bletsch Duke University [SOUP13]

ECE590 Computer and Information Security Fall 2019 Malware Tyler Bletsch Duke University [SOUP13] defines malware as: a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality,

1k views • 52 slides
ECE590 Computer and Information Security Fall 2018 Malware Tyler Bletsch Duke University

ECE590 Computer and Information Security Fall 2018 Malware Tyler Bletsch Duke University

ECE590 Computer and Information Security Fall 2018 Malware Tyler Bletsch Duke University [SOUP13] defines malware as: a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality,

766 views • 53 slides
Malware Defense II TDDD17 Information Security, Second Course Alireza Mohammadinodooshan

Malware Defense II TDDD17 Information Security, Second Course Alireza Mohammadinodooshan

Malware Defense II TDDD17 Information Security, Second Course Alireza Mohammadinodooshan Department of Computer and Information Science Linkping University TDDD17 - Malware Defense II 1/31/2020 2 What Has Been Covered Malware

760 views • 50 slides
Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements

Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements

Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements intermission Malware and Denial of Service Stephen McCamant Denial of service and the network University of Minnesota, Computer Science &

526 views • 5 slides
Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements

Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements

Outline Malware and the network CSci 5271 Introduction to Computer Security Announcements intermission Malware and Denial of Service Stephen McCamant Denial of service and the network University of Minnesota, Computer Science &

168 views • 6 slides
Miscellaneous: tracking on the web (& start on malware) CS 161: Computer Security Prof.

Miscellaneous: tracking on the web (& start on malware) CS 161: Computer Security Prof.

Miscellaneous: tracking on the web (& start on malware) CS 161: Computer Security Prof. Raluca Ada Popa April 17, 2018 Credit: some slides are adapted from previous offerings of this course or from CS 241 of Prof. Dan Boneh Miscellaneous

1.14k views • 83 slides
Miscellaneous: Malware contd & start on Bitcoin CS 161: Computer Security Prof. Raluca

Miscellaneous: Malware contd & start on Bitcoin CS 161: Computer Security Prof. Raluca

Miscellaneous: Malware contd & start on Bitcoin CS 161: Computer Security Prof. Raluca Ada Popa April 19, 2018 Credit: some slides are adapted from previous offerings of this course Viruses vs. Worms VIRUS WORM Propagates by

757 views • 56 slides
More on Malware CS 136 Computer Security Peter Reiher March 4, 2008 Lecture 14 Page 1 CS

More on Malware CS 136 Computer Security Peter Reiher March 4, 2008 Lecture 14 Page 1 CS

More on Malware CS 136 Computer Security Peter Reiher March 4, 2008 Lecture 14 Page 1 CS 136, Winter 2008 Outline Introduction Viruses Trojan horses Trap doors Logic bombs Worms Botnets Spyware Some

701 views • 53 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
Malware: Worms CS 161 - Computer Security Profs. Vern Paxson & David Wagner TAs: John

Malware: Worms CS 161 - Computer Security Profs. Vern Paxson & David Wagner TAs: John

Malware: Worms CS 161 - Computer Security Profs. Vern Paxson & David Wagner TAs: John Bethencourt, Erika Chin, Matthew Finifter, Cynthia Sturton, Joel Weinberger http://inst.eecs.berkeley.edu/~cs161/ April 14, 2010 The Problem of Worms

582 views • 22 slides
Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Describe types of malware See certain malware behaviors Scan and analyze malware

883 views • 25 slides
Marketplace Ads for Goods Marketplace Ads for Services Spam conversion experiment

Marketplace Ads for Goods Marketplace Ads for Services Spam conversion experiment

Marketplace Ads for Goods Marketplace Ads for Services Spam conversion experiment Experimented with Storm March 21 April 15, 2008 Instrumented roughly 1.5% of Storm s total output Pharmacy E-card Campaigns Campaign Postcard

938 views • 49 slides
Integrated Threat Management Appliance 1 http://www.youtube.com/watch?v=F 7pYHN9iC9I 2 3

Integrated Threat Management Appliance 1 http://www.youtube.com/watch?v=F 7pYHN9iC9I 2 3

Integrated Threat Management Appliance 1 http://www.youtube.com/watch?v=F 7pYHN9iC9I 2 3 Denial of Service Attack (DoS) 4 THREAT CATEGORY THREAT ACTION TYPE Malware/Badware Send data to the external entity/site, Trapdoor/Backdoor Entry,

719 views • 23 slides
Peer-to-peer Sender Authentication for Email Vivek Pathak and Liviu Iftode Rutgers University

Peer-to-peer Sender Authentication for Email Vivek Pathak and Liviu Iftode Rutgers University

Peer-to-peer Sender Authentication for Email Vivek Pathak and Liviu Iftode Rutgers University Email Trustworthiness Sender can be spoofed Need for Sender Authentication Importance depends on sender Update on Spam Filters

1.02k views • 55 slides
SpamResist: Making Peer-to-Peer Tagging SpamResist: Making Peer-to-Peer Tagging Systems Robust to

SpamResist: Making Peer-to-Peer Tagging SpamResist: Making Peer-to-Peer Tagging Systems Robust to

SpamResist: Making Peer-to-Peer Tagging SpamResist: Making Peer-to-Peer Tagging Systems Robust to Spam Systems Robust to Spam Ennan Ennan Zhai, Zhai, Ruichuan Ruichuan Chen, Eng Keong hen, Eng Keong Lua* Lua* Long Zhang, Long Zhang,

648 views • 64 slides
Yahoo! Communities Architectures Ian Flint November 9, 2007 1 Agenda What makes Yahoo!

Yahoo! Communities Architectures Ian Flint November 9, 2007 1 Agenda What makes Yahoo!

Yahoo! Communities Architectures Ian Flint November 9, 2007 1 Agenda What makes Yahoo! Yahoo!? Hardware Infrastructure Software Infrastructure Operational Infrastructure Process Examples 2 What makes Yahoo!

478 views • 26 slides
Exploring the Insecurity of Google Account Registration Protocol via Model Checking Tian Xie,

Exploring the Insecurity of Google Account Registration Protocol via Model Checking Tian Xie,

Exploring the Insecurity of Google Account Registration Protocol via Model Checking Tian Xie, Sihan Wang, Guan-Hua Tu, Chi-Yu Li and Xinyu Lei IEEE Symposium Series on Computational Intelligence (SSCI) 2019 Presentation Outline Background

452 views • 29 slides
CS 528 Mobile and Ubiquitous Computing Lecture 9a: Mobile Security and Mobile Software

CS 528 Mobile and Ubiquitous Computing Lecture 9a: Mobile Security and Mobile Software

CS 528 Mobile and Ubiquitous Computing Lecture 9a: Mobile Security and Mobile Software Vulnerabilities Emmanuel Agu Announcement Course Evaluations Now online Will be available from Friday, Dec 7 Will also allow students to do

864 views • 50 slides
Privacy (Section 7.2.5 on Privacy Attacks) sws2 1 [Peter Steiner,1993] 2 myth

Privacy (Section 7.2.5 on Privacy Attacks) sws2 1 [Peter Steiner,1993] 2 myth

Software and Web Security 2 More attacks on Clients: Privacy (Section 7.2.5 on Privacy Attacks) sws2 1 [Peter Steiner,1993] 2 myth reality Welcome user29. (IP address: 131.174.16.131) RU Nijmegen, NL; male german

1.11k views • 58 slides

More recommend