Why Protection against Viruses, Bots, and Worms is so hard Malware - - PowerPoint PPT Presentation

why protection against viruses bots and worms is so hard
SMART_READER_LITE
LIVE PREVIEW

Why Protection against Viruses, Bots, and Worms is so hard Malware - - PowerPoint PPT Presentation

Foundations Security in MAS Conclusion Why Protection against Viruses, Bots, and Worms is so hard Malware seen as Mobile Agents Till Drges td@pre-secure.de PRESECURE Consulting GmbH June 20, 2007 Till Drges Protection Malware seen


slide-1
SLIDE 1

Foundations Security in MAS Conclusion

Why Protection against Viruses, Bots, and Worms is so hard

Malware seen as Mobile Agents Till Dörges td@pre-secure.de

PRESECURE Consulting GmbH

June 20, 2007

Till Dörges Protection – Malware seen as Mobile Agents 1/39

slide-2
SLIDE 2

Foundations Security in MAS Conclusion

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 2/39

slide-3
SLIDE 3

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 3/39

slide-4
SLIDE 4

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 4/39

slide-5
SLIDE 5

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents

What is an Agent?

Till Dörges Protection – Malware seen as Mobile Agents 5/39

slide-6
SLIDE 6

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents

What is an Agent?

  • Modeling Paradigm
  • Software Engineering (unlike e.g. objects, . . . )
  • Artificial Intelligence

Till Dörges Protection – Malware seen as Mobile Agents 5/39

slide-7
SLIDE 7

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents

What is an Agent?

  • Modeling Paradigm
  • Software Engineering (unlike e.g. objects, . . . )
  • Artificial Intelligence

Important Properties

  • Encapsulation and Modularization
  • Reactivity
  • Proactivity
  • Autonomy
  • Mobility (not generally required)

Till Dörges Protection – Malware seen as Mobile Agents 5/39

slide-8
SLIDE 8

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents (cont’d)

Definition

  • Subject to quite a bit of debate
  • Social Behavior
  • Ability to Adapt
  • Goal Orientation
  • . . .
  • Key properties are safe to assume

Particularly Suited for

  • Distributed and Concurrent Systems
  • Systems across Multiple Administrative Domains

Till Dörges Protection – Malware seen as Mobile Agents 6/39

slide-9
SLIDE 9

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents (cont’d)

Colloquially Speaking

  • Program/Code and Data
  • Travel between Platforms
  • Run on different Platforms

Examples

  • “Shopping Agent”
  • “Find (buy) a blue Bicycle for not more than EUR 500.”
  • Inquires at several platforms
  • Finds best solution
  • Possibly purchases a bike on behalf of owner/user

Till Dörges Protection – Malware seen as Mobile Agents 7/39

slide-10
SLIDE 10

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Distinction from Mobile Code

Examples for Mobile Code

  • JAVA applets
  • ActiveX controls
  • . . .

Mobile Code lacks

  • Autonomy
  • Proactivity
  • Goal Orientation

Till Dörges Protection – Malware seen as Mobile Agents 8/39

slide-11
SLIDE 11

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Platforms

What is a Platform?

  • Runtime Environment for Agents
  • Responsible Protection of Agents
  • Services for Interaction (communication, directory services, . . . )
  • Transportation of Agents between Platforms

Colloquially Speaking

  • Application on a Computer

Till Dörges Protection – Malware seen as Mobile Agents 9/39

slide-12
SLIDE 12

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Multi Agent Systems – MAS

What is a MAS?

  • Technically
  • n with n > 0 Platforms
  • m with m > 0 Agents
  • Infrastructure/Policies
  • Service Point of View
  • Shopping Platform
  • Database Querying
  • Research
  • . . .
  • Multi Agent Application
  • . . .

Till Dörges Protection – Malware seen as Mobile Agents 10/39

slide-13
SLIDE 13

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Multi Agent Application?

Agent Orientation as Modeling Paradigm

  • Comparable to Object Orientation
  • AO development environments readily available
  • AO application doesn’t have to show agents on the outside

Till Dörges Protection – Malware seen as Mobile Agents 11/39

slide-14
SLIDE 14

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 12/39

slide-15
SLIDE 15

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Malware

Definition (Wikipedia)

Malware is software designed to infiltrate or damage a computer system without the owner’s informed consent. . . . [The term designates] a variety of forms of hostile, intrusive,

  • r annoying software or program code.

Taxonomy

  • Species
  • Virus
  • Bot
  • Worm
  • . . .
  • Distinction blurry

Till Dörges Protection – Malware seen as Mobile Agents 13/39

slide-16
SLIDE 16

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Malware (cont’d)

Properties

  • Provision of “Services”
  • Spying
  • Attacking
  • Back Doors
  • . . .
  • Reactivity
  • Proactivity
  • Autonomy
  • Mobility
  • Self Replication
  • Adaption

Till Dörges Protection – Malware seen as Mobile Agents 14/39

slide-17
SLIDE 17

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Malware (cont’d)

Properties

  • Provision of “Services”
  • Spying
  • Attacking
  • Back Doors
  • . . .
  • Reactivity
  • Proactivity
  • Autonomy
  • Mobility
  • Self Replication
  • Adaption

Till Dörges Protection – Malware seen as Mobile Agents 14/39

slide-18
SLIDE 18

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Comparison

Malware?

  • Comparison Malware ⇔ Agents holds

Platforms?

  • Infected Computers provide for Runtime Environment
  • Other services implemented by Malware directly
  • Comparison for Infected Computers ⇔ Platforms holds

MAS?

  • Less interesting (1 malware is enough to

control 1 computer)

  • Holds, too.

Till Dörges Protection – Malware seen as Mobile Agents 15/39

slide-19
SLIDE 19

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Comparison

Malware?

  • Comparison Malware ⇔ Agents holds

Platforms?

  • Infected Computers provide for Runtime Environment
  • Other services implemented by Malware directly
  • Comparison for Infected Computers ⇔ Platforms holds

MAS?

  • Less interesting (1 malware is enough to

control 1 computer)

  • Holds, too.

Till Dörges Protection – Malware seen as Mobile Agents 15/39

slide-20
SLIDE 20

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 16/39

slide-21
SLIDE 21

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 17/39

slide-22
SLIDE 22

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Security

Conventional Aspects / Definition

  • Confidentiality
  • Integrity
  • Availability

Till Dörges Protection – Malware seen as Mobile Agents 18/39

slide-23
SLIDE 23

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Security

Conventional Aspects / Definition

  • Confidentiality
  • Integrity
  • Availability

Till Dörges Protection – Malware seen as Mobile Agents 18/39

slide-24
SLIDE 24

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Security

Conventional Aspects / Definition

  • Confidentiality
  • Integrity
  • Availability

Shortcomings

  • Every System is Special
  • Definition has to be adapted
  • What about (for example)
  • Identity
  • Trust
  • . . .

Till Dörges Protection – Malware seen as Mobile Agents 18/39

slide-25
SLIDE 25

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Desirable Security Properties in MAS

Security for Agents?

  • Communication
  • Integrity
  • Confidentiality
  • Availability
  • Non-Repudiation
  • . . .
  • Mobility
  • Agent Execution

Different Points of View

  • Protection of Platforms
  • Protection of Agents

Till Dörges Protection – Malware seen as Mobile Agents 19/39

slide-26
SLIDE 26

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 20/39

slide-27
SLIDE 27

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Approaches to Protection

Briefly

  • Reference Monitor
  • Security Kernel
  • Sandbox
  • Signed Code
  • Path Histories
  • State Appraisal
  • Proof Carrying Code

Till Dörges Protection – Malware seen as Mobile Agents 21/39

slide-28
SLIDE 28

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Approaches to Protection

Briefly

  • Reference Monitor
  • Security Kernel
  • Sandbox
  • Signed Code
  • Path Histories
  • State Appraisal
  • Proof Carrying Code

⇒ Not the focus of this presentation

Till Dörges Protection – Malware seen as Mobile Agents 21/39

slide-29
SLIDE 29

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

State Appraisal

Description

  • Assurance to Platform that Agent will not reach certain states
  • Appraisal functions become part of Agent’s code
  • State Space Explosion
  • Requires Prediction of all (harmful) States

Till Dörges Protection – Malware seen as Mobile Agents 22/39

slide-30
SLIDE 30

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Proof Carrying Code

Description

  • Executor (e.g. Platform) can check Program/Code (e.g. Agent)
  • Dynamic Approach
  • Code comes with Proof not to violate Policy
  • Generation of Proof difficult
  • Validation of Proof easy
  • Does not solely rely on States

Till Dörges Protection – Malware seen as Mobile Agents 23/39

slide-31
SLIDE 31

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 24/39

slide-32
SLIDE 32

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Approaches to Protection

Overview

  • Trusted Hardware
  • Policies
  • Logging
  • Cooperation
  • Cryptography
  • Code Obfuscation

Till Dörges Protection – Malware seen as Mobile Agents 25/39

slide-33
SLIDE 33

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Trusted Hardware

Description

  • Probably best Protection Possible
  • Hardware can be tampered with, too
  • Power Supply, Voltage
  • Timing
  • Information Leaking
  • . . .

Trusted Computing

  • Needs Trusted Hardware
  • Other Issues (e.g. DRM)

Till Dörges Protection – Malware seen as Mobile Agents 26/39

slide-34
SLIDE 34

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Trusted Hardware

Description

  • Probably best Protection Possible
  • Hardware can be tampered with, too
  • Power Supply, Voltage
  • Timing
  • Information Leaking
  • . . .

Trusted Computing

  • Needs Trusted Hardware
  • Other Issues (e.g. DRM)

⇒ Not relevant for this analysis

Till Dörges Protection – Malware seen as Mobile Agents 26/39

slide-35
SLIDE 35

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Policies

Description

  • Recommended for any Setup
  • Regulatory Approach
  • “Prohibit” Malicious Activity
  • Enough for certain Scenarios

Problematic

  • Enforcement of Policies
  • Prevention of Violations
  • Sanctions after Violations
  • Employ together with Logging

Till Dörges Protection – Malware seen as Mobile Agents 27/39

slide-36
SLIDE 36

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Policies

Description

  • Recommended for any Setup
  • Regulatory Approach
  • “Prohibit” Malicious Activity
  • Enough for certain Scenarios

Problematic

  • Enforcement of Policies
  • Prevention of Violations
  • Sanctions after Violations
  • Employ together with Logging

⇒ Not relevant for Malware

Till Dörges Protection – Malware seen as Mobile Agents 27/39

slide-37
SLIDE 37

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Logging

Description

  • Keep a History of Actions
  • Possibly with Signatures
  • Platforms
  • Agents
  • Useful in conjunction with Policies

Problematic

  • Logging alone does not prevent most Incidents
  • Sanctioning is supported

Till Dörges Protection – Malware seen as Mobile Agents 28/39

slide-38
SLIDE 38

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Logging

Description

  • Keep a History of Actions
  • Possibly with Signatures
  • Platforms
  • Agents
  • Useful in conjunction with Policies

Problematic

  • Logging alone does not prevent most Incidents
  • Sanctioning is supported

⇒ Not relevant for Malware

Till Dörges Protection – Malware seen as Mobile Agents 28/39

slide-39
SLIDE 39

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cooperation

Description

  • Distribution of Information or Functionality
  • Simply Redundancy

Till Dörges Protection – Malware seen as Mobile Agents 29/39

slide-40
SLIDE 40

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cooperation

Description

  • Distribution of Information or Functionality
  • Simply Redundancy

⇒ Redundancy often at least implicitly present

Till Dörges Protection – Malware seen as Mobile Agents 29/39

slide-41
SLIDE 41

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography

Main Question

  • Cryptography on Untrusted Platform

Overview

  • Partial Results Encapsulation
  • Computing with Encrypted Functions
  • Undetachable Signatures
  • Environmental Key Generation
  • Secure Communication

Till Dörges Protection – Malware seen as Mobile Agents 30/39

slide-42
SLIDE 42

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Partial Results Encapsulation

  • Secure Data Storage for Agent
  • Several Approaches in Literature
  • Encrypt Data with Public Key (e.g. owner’s)
  • Useful for collecting data from several Platforms
  • Agent cannot use Data
  • Current Platform sees Data
  • Signatures can be problematic

Till Dörges Protection – Malware seen as Mobile Agents 31/39

slide-43
SLIDE 43

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Partial Results Encapsulation

  • Secure Data Storage for Agent
  • Several Approaches in Literature
  • Encrypt Data with Public Key (e.g. owner’s)
  • Useful for collecting data from several Platforms
  • Agent cannot use Data
  • Current Platform sees Data
  • Signatures can be problematic

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 31/39

slide-44
SLIDE 44

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Computing with Encrypted Functions

  • f(): Function to be run by Agent
  • enc(): Function to encrypt (hide) Information from Platform
  • g = f ◦ enc: Function executed on Platform
  • Platform knows: g(), might also know enc()
  • Platform cannot compute f(x), only g(x) = enc(f(x))
  • enc() not easy to find
  • f(x) might be needed by Agent
  • Denial of Service, Replay Attacks

Till Dörges Protection – Malware seen as Mobile Agents 32/39

slide-45
SLIDE 45

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Computing with Encrypted Functions

  • f(): Function to be run by Agent
  • enc(): Function to encrypt (hide) Information from Platform
  • g = f ◦ enc: Function executed on Platform
  • Platform knows: g(), might also know enc()
  • Platform cannot compute f(x), only g(x) = enc(f(x))
  • enc() not easy to find
  • f(x) might be needed by Agent
  • Denial of Service, Replay Attacks

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 32/39

slide-46
SLIDE 46

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Undetachable Signatures

  • Application of Computing with Encrypted Functions
  • f(): Agent’s Signature Function
  • enc(): Also includes Agent’s Constraints
  • x: Contract to be signed
  • g(x) = enc(f(x)): Agent’s Signature of Contract
  • enc() restricts what can be signed

Till Dörges Protection – Malware seen as Mobile Agents 33/39

slide-47
SLIDE 47

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Undetachable Signatures

  • Application of Computing with Encrypted Functions
  • f(): Agent’s Signature Function
  • enc(): Also includes Agent’s Constraints
  • x: Contract to be signed
  • g(x) = enc(f(x)): Agent’s Signature of Contract
  • enc() restricts what can be signed

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 33/39

slide-48
SLIDE 48

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Environmental Key Generation

  • Unlock Code (or Data) based on Condition in the Environment
  • Condition Encoded Using Hash Functions
  • Code available in clear just before Execution

Till Dörges Protection – Malware seen as Mobile Agents 34/39

slide-49
SLIDE 49

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Environmental Key Generation

  • Unlock Code (or Data) based on Condition in the Environment
  • Condition Encoded Using Hash Functions
  • Code available in clear just before Execution

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 34/39

slide-50
SLIDE 50

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Secure Communication

  • Securing Command and Control Channels inside Network
  • Hiding Contents from Platform not possible
  • Undetachable Signatures applicable

Till Dörges Protection – Malware seen as Mobile Agents 35/39

slide-51
SLIDE 51

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Secure Communication

  • Securing Command and Control Channels inside Network
  • Hiding Contents from Platform not possible
  • Undetachable Signatures applicable

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 35/39

slide-52
SLIDE 52

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Code Obfuscation

Description

  • Perfect Obfuscation = Perfect Information Hiding
  • Obfuscation = Encryption
  • Perfect Obfuscation impossible
  • Current Quality of Obfuscation
  • leaking of “negligibly small” amount of information
  • polynomial time

Till Dörges Protection – Malware seen as Mobile Agents 36/39

slide-53
SLIDE 53

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Code Obfuscation

Description

  • Perfect Obfuscation = Perfect Information Hiding
  • Obfuscation = Encryption
  • Perfect Obfuscation impossible
  • Current Quality of Obfuscation
  • leaking of “negligibly small” amount of information
  • polynomial time

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 36/39

slide-54
SLIDE 54

Foundations Security in MAS Conclusion

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 37/39

slide-55
SLIDE 55

Foundations Security in MAS Conclusion

Conclusion

Summing up

  • Advanced Protection Possible for Malware
  • Perfect Protection Impossible
  • Some Measures Used already

Not to forget

  • Turing and the Entscheidungsproblem
  • Current Malware already “successful”
  • Complexity of Current Setups makes for

good Hiding Spots

Till Dörges Protection – Malware seen as Mobile Agents 38/39

slide-56
SLIDE 56

Foundations Security in MAS Conclusion

Remains ...

  • Thanks for your Attention!

Till Dörges Protection – Malware seen as Mobile Agents 39/39

slide-57
SLIDE 57

Foundations Security in MAS Conclusion

Remains ...

  • Thanks for your Attention!
  • Questions?

Till Dörges Protection – Malware seen as Mobile Agents 39/39