Des petits bugs aux virus Quelques travaux et tudes au Laboratoire - PowerPoint PPT Presentation

Des petits bugs aux virus Quelques travaux et études au Laboratoire de Haute Sécurité du Loria Jean-Yves Marion � � !

Advertising networks Compromised Web applications XSS SQL Injection Data User User browser Java/PHP http protocole Server Many boundaries and possible attacks Untrusted applications Jean-Yves Marion

The ingredients of an attack …. Jean-Yves Marion

Vulnerabilities Buffer/Stack overflow Exploit 0-day A bug may be exploited in order � to take control of a system SQL/Code injection – A bug-free system is a good security � – Need of a trusted formalization � – See CompCert project � – See formalization in COQ of PHP Jean-Yves Marion

Social engineering You can’t patch stupidity Jean-Yves Marion

Figure 2. Timeline of WALEDAC activities Figure 6. WALEDAC rips text off from Obama’s website, Figure 2. Christmas ecard website Botnet Waledac Jean-Yves Marion

Watering hole attack Installation of � cdi.org Exploit Chain (click to enlarge) Remote Administration Tool Jean-Yves Marion

The defenses …. Jean-Yves Marion

Samples and Signatures Malware repository High Security lab 6 millions of malware Today Telescope and Honeypots ➡ 20 000 downloaded binaries � ➡ 125 000 malicious attacks � Network traces � ➡ 8 Go of PCAP data � ➡ 110 Go of netFlow Architecture multi-providers Loria Jean-Yves Marion

Anti-Malware Detection by syntactic signature ➡ Pro : E ffi cient and easy to implement ➡ Cons : Signatures are quasi-manually constructed ➡ Cons : Vulnerable to malware protections Integrity checks ➡ Pro : Too many updates in a modern system Behavior analysis IcmpSendEcho GetDriveType FindFirstFile FindNextFile ➡ Pro : Could detect new attacks GetDriveType GetLogicalDriveStrings FindFirstFile FindFirstFile FindNextFile ➡ Cons : Di ffi cult to implement FindNextFile • what is a bad behavior ? • Require to monitor the system Jean-Yves Marion

Undecidable ! Bad M M False Positive Good M Malware False negative Jean-Yves Marion

The problem … Jean-Yves Marion

Anti Anti-Malware � ���������������������� 1.Obfuscation Malware analysis is very hard 2.Cryptography 3.Self-modification 4.Anti-analysis tricks Goal : Rational approach to help Felix the cat ! Jean-Yves Marion

Obfuscation mis-alignment teLock 01006 e7a f e 04 0b [ ebx + ecx ] inc byte 01006 e7d eb f f jmp +1 01006 e7e f f c9 dec ecx 01006 e80 7 f e6 01006 e68 jg 01006 e82 8b c1 mov eax , ecx because of jmp +1 IDA fails 01006E7A [ ebx + ecx ] inc byte ptr 01006E7D short near ptr loc_1006E7D+1 jmp BB [0x0 -> 0x2] (0x3) BB [0x4 -> 0x5] (0x2) 01006E7D ; − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − − 0x0 inc byte [ebx+ecx] 0x4 dec ecx 01006E7F db 0C9h ; 01006E80 7Fh ; db 01006E81 db 0E6h ; 01006E82 db 8 Bh ; BB [0x3 -> 0x4] (0x2) BB [0x6 -> 0x7] (0x2) 01006E83 db 0C1h ; 0x3 jmp 0x4 0x6 jg 0x ��� ee BB [0x8 -> 0x9] (0x2) 0x8 mov eax, ecx Jean-Yves Marion

A common protection scheme for malware Decrypt Decrypt Decrypt Wave 2 .......... Wave 1 payload A run is a sequence of waves Self-modifying program schema Jean-Yves Marion

The best definition � of a malware ? And a fascinating � challenge … Jean-Yves Marion