Malicious Code Malicious Code for Fun and Profit for Fun and - - PowerPoint PPT Presentation

▶
malicious code malicious code
SMART_READER_LITE
LIVE PREVIEW

Malicious Code Malicious Code for Fun and Profit for Fun and - - PowerPoint PPT Presentation

Apr 03, 2024 246 likes •870 views

Malicious Code Malicious Code for Fun and Profit for Fun and Profit Mihai Christodorescu mihai@cs.wisc.edu 29 March 2007 SYN Cookies (contd) SYN Cookies (contd) SYN cookies are particular choices of initial TCP sequence numbers

slide-1
SLIDE 1

Malicious Code Malicious Code

for Fun and Profit for Fun and Profit

Mihai Christodorescu

mihai@cs.wisc.edu 29 March 2007

slide-2
SLIDE 2

29 March 2007 Mihai Christodorescu 2

SYN Cookies (cont’d) SYN Cookies (cont’d)

  • SYN cookies are particular choices of

initial TCP sequence numbers by TCP servers.

  • Server sequence number =

Client sequence number + t mod 32 (top 5 bits) max segment size (next 3 bit) HK( cl. IP, cl. port, srv IP, srv port, t )

slide-3
SLIDE 3

29 March 2007 Mihai Christodorescu 3

What is Malicious Code? What is Malicious Code?

Viruses, worms, trojans, … Code that breaks your security policy. Characteristics Attack vector Payload Spreading algorithm

slide-4
SLIDE 4

29 March 2007 Mihai Christodorescu 4

Outline Outline

  • Attack Vectors
  • Payloads
  • Spreading Algorithms
  • Case Studies
slide-5
SLIDE 5

29 March 2007 Mihai Christodorescu 5

Attack Vectors Attack Vectors

  • Social engineering

“Make them want to run it.”

  • Vulnerability exploitation

“Force your way into the system.”

  • Piggybacking

“Make it run when other programs run.”

slide-6
SLIDE 6

29 March 2007 Mihai Christodorescu 6

Social Engineering Social Engineering

  • Suggest to user that the executable is:

– A game. – A desirable picture/movie. – An important document. – A security update from Microsoft. – A security update from the IT department.

  • Spoofing the sender helps.
slide-7
SLIDE 7

29 March 2007 Mihai Christodorescu 7

Outline Outline

  • Attack Vectors:

Social Engineering Vulnerability Exploitation Piggybacking

  • Payloads
  • Spreading Algorithms
  • Case Studies
slide-8
SLIDE 8

29 March 2007 Mihai Christodorescu 8

Vulnerability Exploitation Vulnerability Exploitation

  • Make use of flaws in software input

handling.

  • Sample techniques:

– Buffer overflow attacks. – Format string attacks. – Return-to-libc attacks. – SQL injection attacks.

slide-9
SLIDE 9

29 March 2007 Mihai Christodorescu 9

Basic Principles Basic Principles

A buffer overflow occurs when data is stored past the boundaries of an array or a string. The additional data now overwrites nearby program variables. Result: Attacker controls or takes over a currently running process.

Buffer Overflows

slide-10
SLIDE 10

29 March 2007 Mihai Christodorescu 10

Example Example

Expected input: \\hostname\path

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; } process_request( “\\tux12\usr\foo.txt” ); ⇒ OK OK process_request( “\\aaabbbcccdddeeefffggghhh\bar” ); ⇒ BAD BAD

slide-11
SLIDE 11

29 March 2007 Mihai Christodorescu 11

A stack frame per procedure call.

Program Stack Program Stack

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request() strcpy()

slide-12
SLIDE 12

29 March 2007 Mihai Christodorescu 12

A stack frame per procedure call.

Program Stack Program Stack

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request() strcpy()

slide-13
SLIDE 13

29 March 2007 Mihai Christodorescu 13

A stack frame per procedure call.

Program Stack Program Stack

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request() strcpy()

arg: req req

slide-14
SLIDE 14

29 March 2007 Mihai Christodorescu 14

A stack frame per procedure call.

Program Stack Program Stack

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request() strcpy()

arg: req req return address frame pointer

slide-15
SLIDE 15

29 March 2007 Mihai Christodorescu 15

A stack frame per procedure call.

Program Stack Program Stack

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request() strcpy()

arg: req req return address frame pointer local: host host

slide-16
SLIDE 16

29 March 2007 Mihai Christodorescu 16

A stack frame per procedure call.

Program Stack Program Stack

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request() strcpy()

arg: req req return address frame pointer local: pos pos local: host host

slide-17
SLIDE 17

29 March 2007 Mihai Christodorescu 17

Normal Execution Normal Execution

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request()

arg: req req return address frame pointer local: host host local: pos pos process_request( “\\tux12\usr\foo.txt” );

slide-18
SLIDE 18

29 March 2007 Mihai Christodorescu 18

Normal Execution Normal Execution

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request()

arg: req req return address frame pointer 7 local: host host process_request( “\\tux12\usr\foo.txt” ); local: pos pos t u x 1 2 \0

slide-19
SLIDE 19

29 March 2007 Mihai Christodorescu 19

Overflow Execution Overflow Execution

Buffer Overflows

void process_request process_request( char * req ) { // Get hostname char host[ 20 ]; int pos = find_char( req, ‘\\’, 2 ); strcpy( host, substr( req, 2, pos – 1 ) ); ... return; }

main() process_request()

arg: req req return address frame pointer 32 32 local: host host process_request( “\\aaabbbcccdddeeefffggghhhiiijjj\bar” ); local: pos pos a a a b b b c c c d d d e e e f f f g g g i i i j h h h j j \0 Characters that overwrite the return address.

slide-20
SLIDE 20

29 March 2007 Mihai Christodorescu 20

The attacker gets one chance to gain control. Craft an input string such that:

  • The return address is overwritten with a pointer

to malicious code.

  • The malicious code is placed inside the input

string.

Smashing the Stack Smashing the Stack

Buffer Overflows Malicious code can create a root shell by executing “/bin/sh”.

slide-21
SLIDE 21

29 March 2007 Mihai Christodorescu 21

Shell Code Shell Code

EB 17 5E 89 76 08 31 C0 88 46 07 89 46 0C B0 0B 89 F3 8D 4E 08 31 D2 CD 80 E8 E4 FF FF FF / b i n / s h \0 arg 2 to code arg 2 arg 1 pointer

Buffer Overflows

Code for exec(“/bin/sh”): mov edx, arg2 mov ecx, arg1 mov ebx, “/bin/sh” mov eax, 0Bh int 80h Pointer value for

  • verwriting the return

address.

slide-22
SLIDE 22

29 March 2007 Mihai Christodorescu 22

  • Defense against stack-smashing attacks:

– Bounds-checking. – Protection libraries. – Non-executable stack. – setuid()/chroot(). – Avoid running programs as root! – Address randomization. – Behavioral monitoring.

Thicker Armor Thicker Armor

Buffer Overflows

slide-23
SLIDE 23

29 March 2007 Mihai Christodorescu 23

More Info More Info

“Smashing the Stack for Fun and Profit” by Aleph One StackGuard, RAD, PAX, ASLR CERT

slide-24
SLIDE 24

29 March 2007 Mihai Christodorescu 24

Format String Attacks Format String Attacks

  • Another way to illegally control program

values.

  • Uses flaws in the design of printf()

printf(): printf( “%s: %d” , s, x ); printf( “%s: %d” , s, x ); Format Strings

slide-25
SLIDE 25

29 March 2007 Mihai Christodorescu 25

printf printf printf printf() () () () Operation

Operation

printf( “%s: %d, %x”, printf( “%s: %d, %x”, s, x, y ); s, x, y ); Format Strings

foo() printf()

y x s format string ptr

slide-26
SLIDE 26

29 March 2007 Mihai Christodorescu 26

Attack 1: Read Any Value Attack 1: Read Any Value

What the code says: printf( str printf( str ); What the programmer meant: printf( “%s”, str printf( “%s”, str );

If str = “%x%x%x%x%s %x%x%x%x%s”

Format Strings

secret key ptr format string ptr

slide-27
SLIDE 27

29 March 2007 Mihai Christodorescu 27

Attack 2: Write to Address Attack 2: Write to Address

What the code says: printf( str printf( str );

If str = “%x%x%x%x%n %x%x%x%x%n”

Format Strings

return address format string ptr 4

slide-28
SLIDE 28

29 March 2007 Mihai Christodorescu 28

Defenses Defenses

Never use printf()

printf() without a format string!

FormatGuard.

Format Strings

slide-29
SLIDE 29

29 March 2007 Mihai Christodorescu 29

Outline Outline

  • Attack Vectors:

Social Engineering Vulnerability Exploitation Piggybacking

  • Payloads
  • Spreading Algorithms
  • Case Studies
slide-30
SLIDE 30

29 March 2007 Mihai Christodorescu 30

Piggybacking Piggybacking

Malicious code injected into a benign program or data file.

  • Host file can be:

– An executable. – A document with some executable content (Word documents with macros, etc.).

slide-31
SLIDE 31

29 March 2007 Mihai Christodorescu 31

Piggybacking Executables Piggybacking Executables

  • Modify program on disk:

jmp evil_code

Variations:

  • Jump to malicious code
  • nly on certain actions.
  • Spread malicious code

throughout program.

slide-32
SLIDE 32

29 March 2007 Mihai Christodorescu 32

Piggybacking Documents Piggybacking Documents

  • Documents with macros:

Microsoft Office supports documents with macros scripted in Visual Basic (VBA).

  • Macro triggered on:

– Document open – Document close – Document save – Send document by email

slide-33
SLIDE 33

29 March 2007 Mihai Christodorescu 33

Outline Outline

  • Attack Vectors:

Social Engineering Vulnerability Exploitation Piggybacking

  • Payloads
  • Spreading Algorithms
  • Case Studies
  • Defenses
slide-34
SLIDE 34

29 March 2007 Mihai Christodorescu 34

  • Payload

Payload

Target the interesting data:

  • Passwords
  • Financial data
  • User behavior
  • User attention

Keylogger Screen scraper Spyware Adware

slide-35
SLIDE 35

29 March 2007 Mihai Christodorescu 35

Keylogger Keylogger Use Use

slide-36
SLIDE 36

29 March 2007 Mihai Christodorescu 36

Screen Scraper Use Screen Scraper Use

slide-37
SLIDE 37

29 March 2007 Mihai Christodorescu 37

More Payload Ideas More Payload Ideas

Victim machines are pawns in larger attack:

– Botnets. – Distributed denial of service (DDoS). – Spam proxies. – Anonymous FTP sites. – IRC servers.

slide-38
SLIDE 38

29 March 2007 Mihai Christodorescu 38

Outline Outline

  • Attack Vectors:

Social Engineering Vulnerability Exploitation Piggybacking

  • Payloads
  • Spreading Algorithms
  • Case Studies
  • Defenses
slide-39
SLIDE 39

29 March 2007 Mihai Christodorescu 39

  • Spreading Methods

Spreading Methods

Depends on the attack vector:

Email-based ⇒ need email addresses Vulnerability-based ⇒ need IP addresses of hosts running the vulnerable service Piggybacking ⇒ need more files to infect

slide-40
SLIDE 40

29 March 2007 Mihai Christodorescu 40

Spreading through Email Spreading through Email

Malware Internet

HTML files (from cache) Windows Address Book Outlook Express folders Outlook folders

slide-41
SLIDE 41

29 March 2007 Mihai Christodorescu 41

Vulnerable Target Discovery Vulnerable Target Discovery

Need to find Internet (IP) addresses.

  • Scanning:
  • Target list:
  • Passive: Contagion worms

Random Sequential Bandwidth-limited Pre-generated Externally-generated ⇒ Metaserver worms Internal target list ⇒ Topological worms

slide-42
SLIDE 42

29 March 2007 Mihai Christodorescu 42

Outline Outline

  • Attack Vectors:

Social Engineering Vulnerability Exploitation Piggybacking

  • Payloads
  • Spreading Algorithms
  • Case Studies
slide-43
SLIDE 43

29 March 2007 Mihai Christodorescu 43

Types of Malicious Code Types of Malicious Code

  • Virus

Self-replicating, infects programs and documents.

e.g.: Chernobyl/CIH, Melissa, Elkern

  • Worm

Self-replicating, spreads across a network.

e.g.: ILoveYou, Code Red, B(e)agle, Witty

McGraw and Morrisett “Attacking malicious code: A report to the Infosec Research Council” Sept./Oct. 2000.

slide-44
SLIDE 44

29 March 2007 Mihai Christodorescu 44

Types of Malicious Code Types of Malicious Code

  • Trojan

– Malware hidden inside useful programs

e.g.: NoUpdate, KillAV, Bookmarker

  • Backdoor

– Tool allowing unauthorized remote access

e.g.: BackOrifice, SdBot, Subseven

slide-45
SLIDE 45

29 March 2007 Mihai Christodorescu 45

Types of Malicious Code Types of Malicious Code

  • Spyware

– Secretly monitors system activity

e.g.: ISpynow, KeyLoggerPro, Look2me

  • Adware

– Monitors user activity for advertising purposes

e.g.: WildTangent, Gator, BargainBuddy

slide-46
SLIDE 46

29 March 2007 Mihai Christodorescu 46

Outline Outline

  • Attack Vectors:

Social Engineering Vulnerability Exploitation Piggybacking

  • Payloads
  • Spreading Algorithms
  • Case Studies: Sobig
slide-47
SLIDE 47

29 March 2007 Mihai Christodorescu 47

The The Sobig Sobig Worm Worm

  • Mass-mailing, network-aware worm
  • Multi-stage update capabilities

Launch Deactivation

Sobig.A 9 Jan. 2003

  • Sobig.B

18 May 2003 31 May 2003 Sobig.C 31 May 2003 8 June 2003 Sobig.D 18 June 2003 2 July 2003 Sobig.E 25 June 2003 14 July 2003 Sobig.F 18 Aug 2003 10 Sept 2003

slide-48
SLIDE 48

29 March 2007 Mihai Christodorescu 48

  • E-mail
  • Network shares

Sobig Sobig: Attack Vector : Attack Vector

big@boss.com From: Subject: support@microsoft.com bill@microsoft.com admin@support.com support@yahoo.com

  • Compressed executable

attachment with renamed extension.

  • Later: attachment in ZIP file.
slide-49
SLIDE 49

29 March 2007 Mihai Christodorescu 49

Sobig Sobig: Payload : Payload

Geocities web page Trojan web server

  • 1st stage:

Backdoor (Lala) & keylogger

  • 2nd stage:

Proxy (WinGate)

slide-50
SLIDE 50

29 March 2007 Mihai Christodorescu 50

Sobig Sobig: Payload : Payload

...

Hacked DSL/cable hosts Trojan web server

1 22

slide-51
SLIDE 51

29 March 2007 Mihai Christodorescu 51

Sobig Sobig: Spreading Algorithm : Spreading Algorithm

  • E-mail addresses extracted from files on

disk.

  • Network shares automatically discovered.
slide-52
SLIDE 52

29 March 2007 Mihai Christodorescu 52

Sobig.F Sobig.F in Numbers in Numbers

August: 19 20 21 22 23

Courtesy of MessageLabs.com

slide-53
SLIDE 53

29 March 2007 Mihai Christodorescu 53

Outline Outline

  • Attack Vectors:

Social Engineering Vulnerability Exploitation Piggybacking

  • Payloads
  • Spreading Algorithms
  • Case Studies: Sobig, Blaster
slide-54
SLIDE 54

29 March 2007 Mihai Christodorescu 54

The The Blaster Blaster Worm Worm

  • Multi-stage worm exploiting Windows

vulnerability

2003: July August 17 16 25 31 11 13 15 17 19

Microsoft releases patch LSD Research exploit released CERT advisory Blaster appears 1.2 million hosts infected Metasploit refined exploit FRB Atlanta, MD DMV, BMW Scandinavian bank closes all 70 branches

slide-55
SLIDE 55

29 March 2007 Mihai Christodorescu 55

Blaster: Attack Vector Blaster: Attack Vector

  • Uses a Microsoft Windows RPC DCOM

vulnerability.

  • Coding flaw:
  • 1. The RPC service passes part of the

request to function GetMachineName().

  • 2. GetMachineName() copies machine name

to a fixed 32-byte buffer.

slide-56
SLIDE 56

29 March 2007 Mihai Christodorescu 56

Blaster: Attack Vector Blaster: Attack Vector

Exploit 1

“tftp GET msblast.exe” 2

TFTP Server

“GET msblast.exe” 3 4 “start msblast.exe” 5

slide-57
SLIDE 57

29 March 2007 Mihai Christodorescu 57

Blaster: Payload Blaster: Payload

  • Worm installs itself to start automatically.
  • All infected hosts perform DDoS against

windowsupdate.com .

– SYN flood attack with spoofed source IP, Aug 15 → Dec 31 and after the 15th of all other months.

slide-58
SLIDE 58

29 March 2007 Mihai Christodorescu 58

Blaster: Effect on Local Host Blaster: Effect on Local Host

  • RPC/DCOM disabled:

– Inability to cut/paste. – Inability to move icons. – Add/Remove Programs list empty. – DLL errors in most Microsoft Office programs. – Generally slow, or unresponsive system performance.

slide-59
SLIDE 59

29 March 2007 Mihai Christodorescu 59

Blaster: Spreading Algorithm Blaster: Spreading Algorithm

  • Build IP address list:

40% chance to start with local IP address. 60% chance to generate random IP address.

  • Probe 20 IPs at a time.
  • Exploit type:

80% Windows XP. 20% Windows 2000.

slide-60
SLIDE 60

29 March 2007 Mihai Christodorescu 60

Blaster: Infection Rate Blaster: Infection Rate

slide-61
SLIDE 61

29 March 2007 Mihai Christodorescu 61

Future Threat: Future Threat: Superworm Superworm

“Curious Yellow: the First Coordinated Worm Design” – Brandon Wiley

  • Fast replication & adaptability:

– Pre-scan the network for targets. – Worm instances communicate to coordinate infection process. – Attack vectors can be updated. – Worm code mutates.

slide-62
SLIDE 62

29 March 2007 Mihai Christodorescu 62

Conclusions Conclusions

  • Vulnerabilities left unpatched can and will

be used against you.

  • Attackers are more sophisticated.
  • Need to understand the attackers’

perspective.