malicious code malicious code
play

Malicious Code Malicious Code for Fun and Profit for Fun and - PowerPoint PPT Presentation

Mar 14, 2023 •206 likes •1.16k views

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 10 March 2005 What is Malicious Code? What is Malicious Code? Viruses, worms, trojans, Code that breaks your security policy.

  1. Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 10 March 2005

  2. What is Malicious Code? What is Malicious Code? Viruses, worms, trojans, … Code that breaks your security policy. Attack vector Characteristics Payload Spreading algorithm 10 March 2005 Mihai Christodorescu 2

  3. Outline Outline • Attack Vectors • Payloads • Spreading Algorithms • Case Studies 10 March 2005 Mihai Christodorescu 3

  4. Attack Vectors Attack Vectors • Social engineering “Make them want to run it.” • Vulnerability exploitation “Force your way into the system.” • Piggybacking “Make it run when other programs run.” 10 March 2005 Mihai Christodorescu 4

  5. Social Engineering Social Engineering • Suggest to user that the executable is: – A game. – A desirable picture/movie. – An important document. – A security update from Microsoft. – A security update from the IT department. • Spoofing the sender helps. 10 March 2005 Mihai Christodorescu 5

  6. Outline Outline • Attack Vectors: � Social Engineering � Vulnerability Exploitation � Piggybacking • Payloads • Spreading Algorithms • Case Studies 10 March 2005 Mihai Christodorescu 6

  7. Vulnerability Exploitation Vulnerability Exploitation • Make use of flaws in software input handling. • Sample techniques: – Buffer overflow attacks. – Format string attacks. – Return-to-libc attacks. – SQL injection attacks. 10 March 2005 Mihai Christodorescu 7

  8. Buffer Basic Principles Basic Principles Overflows A buffer overflow occurs when data is stored past the boundaries of an array or a string. The additional data now overwrites nearby program variables. Result: Attacker controls or takes over a currently running process. 10 March 2005 Mihai Christodorescu 8

  9. Buffer Example Example Overflows Expected input: \\hostname\path void process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } 10 March 2005 Mihai Christodorescu 9

  10. Buffer Example Example Overflows Expected input: \\hostname\path void process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... process_request( “\\tux12\usr\foo.txt” ); ⇒ � OK return; } 10 March 2005 Mihai Christodorescu 10

  11. Buffer Example Example Overflows Expected input: \\hostname\path void process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... process_request( “\\tux12\usr\foo.txt” ); ⇒ � OK return; process_request( “\\aaabbbcccdddeeefffggghhh\bar” ); ⇒ � BAD } 10 March 2005 Mihai Christodorescu 11

  12. Buffer Program Stack Program Stack Overflows A stack frame per procedure call. void process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } 10 March 2005 Mihai Christodorescu 12

  13. Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() void process_request( char * req ) { process_request() // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } strcpy() 10 March 2005 Mihai Christodorescu 13

  14. Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() void process_request( char * req ) { process_request() // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } strcpy() 10 March 2005 Mihai Christodorescu 14

  15. Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() arg: req eq void process_request( char * req ) { process_request() // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } strcpy() 10 March 2005 Mihai Christodorescu 15

  16. Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } strcpy() 10 March 2005 Mihai Christodorescu 16

  17. Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; } strcpy() 10 March 2005 Mihai Christodorescu 17

  18. Buffer Program Stack Program Stack Overflows A stack frame per procedure call. main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; } local: pos pos strcpy() 10 March 2005 Mihai Christodorescu 18

  19. Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; } local: pos pos 10 March 2005 Mihai Christodorescu 19

  20. Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; } local: pos pos 7 10 March 2005 Mihai Christodorescu 20

  21. Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; t } local: pos pos 7 10 March 2005 Mihai Christodorescu 21

  22. Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; t u } local: pos pos 7 10 March 2005 Mihai Christodorescu 22

  23. Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; t u x } local: pos pos 7 10 March 2005 Mihai Christodorescu 23

  24. Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; t u x 1 } local: pos pos 7 10 March 2005 Mihai Christodorescu 24

  25. Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... 2 return; t u x 1 } local: pos pos 7 10 March 2005 Mihai Christodorescu 25

  26. Buffer Normal Execution Normal Execution Overflows process_request( “\\tux12\usr\foo.txt” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... 2 \0 return; t u x 1 } local: pos pos 7 10 March 2005 Mihai Christodorescu 26

  27. Buffer Overflow Execution Overflow Execution Overflows process_request( “\\aaabbbcccdddeeefffggghhhiiijjj\bar” ); main() arg: req eq void process_request( char * req ) { return address process_request() // Get hostname frame pointer char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); local: host host ... return; } local: pos pos 32 10 March 2005 Mihai Christodorescu 27

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 23 March 2006 What is Malicious Code? What is Malicious Code? Viruses, worms, trojans, Code that breaks your security policy.

707 views • 69 slides
Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 29 March 2007 SYN Cookies (contd) SYN Cookies (contd) SYN cookies are particular choices of initial TCP sequence numbers

868 views • 62 slides
Malicious Code and Access Control in SDN SPRING14 , 31.7. 1.8.2014 Hans Christian Rpke

Malicious Code and Access Control in SDN SPRING14 , 31.7. 1.8.2014 Hans Christian Rpke

Malicious Code and Access Control in SDN SPRING14 , 31.7. 1.8.2014 Hans Christian Rpke Chair for System Security 1 Introduction 2 Malicious Code in SDN 3 Access Control in SDN 4 Conclusions Software-Defined Networks|Horst Grtz

418 views • 19 slides
Lines of Malicious Code: Insights Into the Malicious Software Industry Martina Lindorfer

Lines of Malicious Code: Insights Into the Malicious Software Industry Martina Lindorfer

Lines of Malicious Code: Insights Into the Malicious Software Industry Martina Lindorfer Vienna University of Technology Alessandro Di Federico Politecnico di Milano Federico Maggi Politecnico di Milano Paolo Milani Comparetti Vienna

566 views • 27 slides
MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs on a victims system How does it get to run? Attacks a user- or network-facing vulnerable service Backdoor: Added by a malicious

1.02k views • 81 slides
Malicious Code Karlstads universitet mCrowds: Anonymity for the mobile Internet Karlstads

Malicious Code Karlstads universitet mCrowds: Anonymity for the mobile Internet Karlstads

2005-10-12 Malicious Code an Increasing Problem Malicious Code Karlstads universitet mCrowds: Anonymity for the mobile Internet Karlstads universitet DAV C19 Applied Security 2 Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Media

442 views • 7 slides
Untangling the code An overview of techniques to reverse engineer malicious software Prashant

Untangling the code An overview of techniques to reverse engineer malicious software Prashant

Untangling the code An overview of techniques to reverse engineer malicious software Prashant Gupta Security Architect, McAfee Inc. June 3, 2013 McAfee Confidential Internal Use Only Abstract Reverse engineering and analysis of binary code

381 views • 20 slides
Viruses based on slides by Vitaly Shmatikov and Ninghui Li Malware Malicious code often

Viruses based on slides by Vitaly Shmatikov and Ninghui Li Malware Malicious code often

Viruses based on slides by Vitaly Shmatikov and Ninghui Li Malware Malicious code often masquerades as good software or attaches itself to good software Some malicious programs need host programs Trojan horses, logic bombs, viruses

624 views • 40 slides
Vulnerabilities: Malicious Code Class 10 P&P: Ch 3.3, 3.4 1 CIS-5372: 9.Nov.2011

Vulnerabilities: Malicious Code Class 10 P&P: Ch 3.3, 3.4 1 CIS-5372: 9.Nov.2011

Vulnerabilities: Malicious Code Class 10 P&P: Ch 3.3, 3.4 1 CIS-5372: 9.Nov.2011 Announcement Presence sheet Solution to Homework 2 is out Grades will follow 2 CIS-5372: 9.Nov.2011 What Did We Cover Before ?

1.02k views • 71 slides
CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and

CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and

CS 356 Lecture 9 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and Terminology Integrity, Confidentiality, Availability, Authentication, and Accountability Types of threats: active vs. passive, insider/outsider

347 views • 33 slides
CS 356 Lecture 8 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and

CS 356 Lecture 8 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and

CS 356 Lecture 8 Malicious Code Spring 2013 Review Chapter 1: Basic Concepts and Terminology Integrity, Confidentiality, Availability, Authentication, and Accountability Types of threats: active vs. passive, insider/outsider

638 views • 16 slides
Engineering Challenges in Immunizing Systems Against Malicious Code Craig Chamberlain Principal

Engineering Challenges in Immunizing Systems Against Malicious Code Craig Chamberlain Principal

Engineering Challenges in Immunizing Systems Against Malicious Code Craig Chamberlain Principal Technical Consultant Verdasys, Inc. Background Organizations are confronted with troubling developments the malware problem phenomenon

581 views • 27 slides
Pinkslipbot: A deep look at how malicious code adapts and evolves Guilherme Venere Malware

Pinkslipbot: A deep look at how malicious code adapts and evolves Guilherme Venere Malware

Pinkslipbot: A deep look at how malicious code adapts and evolves Guilherme Venere Malware Researcher Anti Malware Operation Team Know Your Enemy Server-side polymorphic worm. EXE and DLL modules First seen around 2007 Features

662 views • 19 slides
Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory

Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory

Adi Hayon Tomer Teller Why are we here? (one of many reasons) A malicious program: Allocates memory in a remote process (and write to it) Executes the code in that memory region Frees the code Memory dump taken at the end of

373 views • 22 slides
Outline Malicious Code Introduction CS 239 Viruses Trojan horses Security for

Outline Malicious Code Introduction CS 239 Viruses Trojan horses Security for

Outline Malicious Code Introduction CS 239 Viruses Trojan horses Security for Networks and Trap doors System Software Logic bombs May 12, 2002 Worms Examples Lecture 11 Lecture 11 Page 1 Page 2 CS 239,

234 views • 12 slides
Undermining the Linux Kernel: Malicious Code Injec:on via /dev/mem Anthony Lineberry

Undermining the Linux Kernel: Malicious Code Injec:on via /dev/mem Anthony Lineberry

Undermining the Linux Kernel: Malicious Code Injec:on via /dev/mem Anthony Lineberry anthony.lineberry@gmail.com Black Hat Europe 2009 Overview What is a rootkit? Why is protec:on difficult? Current protec:on mechanisms/bypasses

638 views • 52 slides
An Examination of Security in Web Applications Brian Booth Luis Sanchez Jeremy Hancock Simon

An Examination of Security in Web Applications Brian Booth Luis Sanchez Jeremy Hancock Simon

An Examination of Security in Web Applications Brian Booth Luis Sanchez Jeremy Hancock Simon Timms Dr. Osmar Zaiane Cmput 410 Introduction As we enter full force into the information age more and more of our lives involves utilizing the

303 views • 14 slides
www.ren-isac.net soc@ren-isac.net 317.274.7228 What is an ISAC? Information

www.ren-isac.net soc@ren-isac.net 317.274.7228 What is an ISAC? Information

www.ren-isac.net soc@ren-isac.net 317.274.7228 What is an ISAC? Information Sharing and Analysis Centers Presidential Decision Directive-63 (PDD-63), signed May 22, 1998 The federal government asked each critical

537 views • 20 slides
Barriers to CSIRTs cooperation. Challenge in practice the CLOSER Project Krzysztof Silicki

Barriers to CSIRTs cooperation. Challenge in practice the CLOSER Project Krzysztof Silicki

Barriers to CSIRTs cooperation. Challenge in practice the CLOSER Project Barriers to CSIRTs cooperation. Challenge in practice the CLOSER Project Krzysztof Silicki Mirosaw Maj NASK / CERT Polska 20th FIRST Annual Conference,

770 views • 37 slides
Security Innovation The Israeli Eco System National Risk Management & Innovation REFAEL

Security Innovation The Israeli Eco System National Risk Management & Innovation REFAEL

Second Annual Event Encouraging Digital Security Innovation The Israeli Eco System National Risk Management & Innovation REFAEL FRANCO Deputy Director General Head of Robustness Division CERT IL 3 Israel cyber eco system Israeli CERT

1.01k views • 52 slides
Secure application development with AOP Nils Durner <ndurner@web.de> 1 Outline of the

Secure application development with AOP Nils Durner <ndurner@web.de> 1 Outline of the

Secure application development with AOP Nils Durner <ndurner@web.de> 1 Outline of the talk Introduction to Aspect Oriented Programming Examples for uses of AOP for security AOP & Memory safety Future work 2 What is

870 views • 59 slides
Cyber Risk Research at CCRS Jennifer Copic Research Assistant Cambridge Centre for Risk Studies

Cyber Risk Research at CCRS Jennifer Copic Research Assistant Cambridge Centre for Risk Studies

Cambridge Centre for Risk Studies Advisory Board Research Showcase 24 January 2017 Cyber Risk Research at CCRS Jennifer Copic Research Assistant Cambridge Centre for Risk Studies Largest Cyber Data Exfiltration Event: Yahoo August 2013

296 views • 18 slides
CYBER SECURITY By Sachin Dedhia CISA, CEH, ISO 27001 L.A., Ethical Hacker & Digital

CYBER SECURITY By Sachin Dedhia CISA, CEH, ISO 27001 L.A., Ethical Hacker & Digital

CYBER SECURITY By Sachin Dedhia CISA, CEH, ISO 27001 L.A., Ethical Hacker & Digital Forensics Expert Founder Skynet Secure Solutions , skynetsecure.com Email : Sachin@skynetsecure.com Phone : 91- 9867700095 Web Conference Security

828 views • 11 slides
Analysis of the HTTPS Certificate Ecosystem Zakir Durumeric, James Kasten, Michael Bailey, J.

Analysis of the HTTPS Certificate Ecosystem Zakir Durumeric, James Kasten, Michael Bailey, J.

Analysis of the HTTPS Certificate Ecosystem Zakir Durumeric, James Kasten, Michael Bailey, J. Alex Halderman University of Michigan Analysis of the HTTPS Certificate Ecosystem Zakir Durumeric HTTPS and TLS How does HTTPS and the CA ecosystem

449 views • 24 slides

More recommend