Why Protection against Viruses, Bots, and Worms is so hard Malware - - PowerPoint PPT Presentation

▶
why protection against viruses bots and worms is so hard
SMART_READER_LITE
LIVE PREVIEW

Why Protection against Viruses, Bots, and Worms is so hard Malware - - PowerPoint PPT Presentation

Mar 17, 2023 162 likes •743 views

Foundations Security in MAS Conclusion Why Protection against Viruses, Bots, and Worms is so hard Malware seen as Mobile Agents Till Drges td@pre-secure.de PRESECURE Consulting GmbH June 20, 2007 Till Drges Protection Malware seen

slide-1
SLIDE 1

Foundations Security in MAS Conclusion

Why Protection against Viruses, Bots, and Worms is so hard

Malware seen as Mobile Agents Till Dörges td@pre-secure.de

PRESECURE Consulting GmbH

June 20, 2007

Till Dörges Protection – Malware seen as Mobile Agents 1/39

slide-2
SLIDE 2

Foundations Security in MAS Conclusion

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 2/39

slide-3
SLIDE 3

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 3/39

slide-4
SLIDE 4

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 4/39

slide-5
SLIDE 5

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents

What is an Agent?

Till Dörges Protection – Malware seen as Mobile Agents 5/39

slide-6
SLIDE 6

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents

What is an Agent?

  • Modeling Paradigm
  • Software Engineering (unlike e.g. objects, . . . )
  • Artificial Intelligence

Till Dörges Protection – Malware seen as Mobile Agents 5/39

slide-7
SLIDE 7

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents

What is an Agent?

  • Modeling Paradigm
  • Software Engineering (unlike e.g. objects, . . . )
  • Artificial Intelligence

Important Properties

  • Encapsulation and Modularization
  • Reactivity
  • Proactivity
  • Autonomy
  • Mobility (not generally required)

Till Dörges Protection – Malware seen as Mobile Agents 5/39

slide-8
SLIDE 8

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents (cont’d)

Definition

  • Subject to quite a bit of debate
  • Social Behavior
  • Ability to Adapt
  • Goal Orientation
  • . . .
  • Key properties are safe to assume

Particularly Suited for

  • Distributed and Concurrent Systems
  • Systems across Multiple Administrative Domains

Till Dörges Protection – Malware seen as Mobile Agents 6/39

slide-9
SLIDE 9

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Agents (cont’d)

Colloquially Speaking

  • Program/Code and Data
  • Travel between Platforms
  • Run on different Platforms

Examples

  • “Shopping Agent”
  • “Find (buy) a blue Bicycle for not more than EUR 500.”
  • Inquires at several platforms
  • Finds best solution
  • Possibly purchases a bike on behalf of owner/user

Till Dörges Protection – Malware seen as Mobile Agents 7/39

slide-10
SLIDE 10

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Distinction from Mobile Code

Examples for Mobile Code

  • JAVA applets
  • ActiveX controls
  • . . .

Mobile Code lacks

  • Autonomy
  • Proactivity
  • Goal Orientation

Till Dörges Protection – Malware seen as Mobile Agents 8/39

slide-11
SLIDE 11

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Platforms

What is a Platform?

  • Runtime Environment for Agents
  • Responsible Protection of Agents
  • Services for Interaction (communication, directory services, . . . )
  • Transportation of Agents between Platforms

Colloquially Speaking

  • Application on a Computer

Till Dörges Protection – Malware seen as Mobile Agents 9/39

slide-12
SLIDE 12

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Multi Agent Systems – MAS

What is a MAS?

  • Technically
  • n with n > 0 Platforms
  • m with m > 0 Agents
  • Infrastructure/Policies
  • Service Point of View
  • Shopping Platform
  • Database Querying
  • Research
  • . . .
  • Multi Agent Application
  • . . .

Till Dörges Protection – Malware seen as Mobile Agents 10/39

slide-13
SLIDE 13

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Multi Agent Application?

Agent Orientation as Modeling Paradigm

  • Comparable to Object Orientation
  • AO development environments readily available
  • AO application doesn’t have to show agents on the outside

Till Dörges Protection – Malware seen as Mobile Agents 11/39

slide-14
SLIDE 14

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 12/39

slide-15
SLIDE 15

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Malware

Definition (Wikipedia)

Malware is software designed to infiltrate or damage a computer system without the owner’s informed consent. . . . [The term designates] a variety of forms of hostile, intrusive,

  • r annoying software or program code.

Taxonomy

  • Species
  • Virus
  • Bot
  • Worm
  • . . .
  • Distinction blurry

Till Dörges Protection – Malware seen as Mobile Agents 13/39

slide-16
SLIDE 16

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Malware (cont’d)

Properties

  • Provision of “Services”
  • Spying
  • Attacking
  • Back Doors
  • . . .
  • Reactivity
  • Proactivity
  • Autonomy
  • Mobility
  • Self Replication
  • Adaption

Till Dörges Protection – Malware seen as Mobile Agents 14/39

slide-17
SLIDE 17

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Malware (cont’d)

Properties

  • Provision of “Services”
  • Spying
  • Attacking
  • Back Doors
  • . . .
  • Reactivity
  • Proactivity
  • Autonomy
  • Mobility
  • Self Replication
  • Adaption

Till Dörges Protection – Malware seen as Mobile Agents 14/39

slide-18
SLIDE 18

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Comparison

Malware?

  • Comparison Malware ⇔ Agents holds

Platforms?

  • Infected Computers provide for Runtime Environment
  • Other services implemented by Malware directly
  • Comparison for Infected Computers ⇔ Platforms holds

MAS?

  • Less interesting (1 malware is enough to

control 1 computer)

  • Holds, too.

Till Dörges Protection – Malware seen as Mobile Agents 15/39

slide-19
SLIDE 19

Foundations Security in MAS Conclusion Agents and Multi Agent Systems Agents and Malware

Comparison

Malware?

  • Comparison Malware ⇔ Agents holds

Platforms?

  • Infected Computers provide for Runtime Environment
  • Other services implemented by Malware directly
  • Comparison for Infected Computers ⇔ Platforms holds

MAS?

  • Less interesting (1 malware is enough to

control 1 computer)

  • Holds, too.

Till Dörges Protection – Malware seen as Mobile Agents 15/39

slide-20
SLIDE 20

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 16/39

slide-21
SLIDE 21

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 17/39

slide-22
SLIDE 22

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Security

Conventional Aspects / Definition

  • Confidentiality
  • Integrity
  • Availability

Till Dörges Protection – Malware seen as Mobile Agents 18/39

slide-23
SLIDE 23

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Security

Conventional Aspects / Definition

  • Confidentiality
  • Integrity
  • Availability

Till Dörges Protection – Malware seen as Mobile Agents 18/39

slide-24
SLIDE 24

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Security

Conventional Aspects / Definition

  • Confidentiality
  • Integrity
  • Availability

Shortcomings

  • Every System is Special
  • Definition has to be adapted
  • What about (for example)
  • Identity
  • Trust
  • . . .

Till Dörges Protection – Malware seen as Mobile Agents 18/39

slide-25
SLIDE 25

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Desirable Security Properties in MAS

Security for Agents?

  • Communication
  • Integrity
  • Confidentiality
  • Availability
  • Non-Repudiation
  • . . .
  • Mobility
  • Agent Execution

Different Points of View

  • Protection of Platforms
  • Protection of Agents

Till Dörges Protection – Malware seen as Mobile Agents 19/39

slide-26
SLIDE 26

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 20/39

slide-27
SLIDE 27

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Approaches to Protection

Briefly

  • Reference Monitor
  • Security Kernel
  • Sandbox
  • Signed Code
  • Path Histories
  • State Appraisal
  • Proof Carrying Code

Till Dörges Protection – Malware seen as Mobile Agents 21/39

slide-28
SLIDE 28

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Approaches to Protection

Briefly

  • Reference Monitor
  • Security Kernel
  • Sandbox
  • Signed Code
  • Path Histories
  • State Appraisal
  • Proof Carrying Code

⇒ Not the focus of this presentation

Till Dörges Protection – Malware seen as Mobile Agents 21/39

slide-29
SLIDE 29

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

State Appraisal

Description

  • Assurance to Platform that Agent will not reach certain states
  • Appraisal functions become part of Agent’s code
  • State Space Explosion
  • Requires Prediction of all (harmful) States

Till Dörges Protection – Malware seen as Mobile Agents 22/39

slide-30
SLIDE 30

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Proof Carrying Code

Description

  • Executor (e.g. Platform) can check Program/Code (e.g. Agent)
  • Dynamic Approach
  • Code comes with Proof not to violate Policy
  • Generation of Proof difficult
  • Validation of Proof easy
  • Does not solely rely on States

Till Dörges Protection – Malware seen as Mobile Agents 23/39

slide-31
SLIDE 31

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 24/39

slide-32
SLIDE 32

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Approaches to Protection

Overview

  • Trusted Hardware
  • Policies
  • Logging
  • Cooperation
  • Cryptography
  • Code Obfuscation

Till Dörges Protection – Malware seen as Mobile Agents 25/39

slide-33
SLIDE 33

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Trusted Hardware

Description

  • Probably best Protection Possible
  • Hardware can be tampered with, too
  • Power Supply, Voltage
  • Timing
  • Information Leaking
  • . . .

Trusted Computing

  • Needs Trusted Hardware
  • Other Issues (e.g. DRM)

Till Dörges Protection – Malware seen as Mobile Agents 26/39

slide-34
SLIDE 34

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Trusted Hardware

Description

  • Probably best Protection Possible
  • Hardware can be tampered with, too
  • Power Supply, Voltage
  • Timing
  • Information Leaking
  • . . .

Trusted Computing

  • Needs Trusted Hardware
  • Other Issues (e.g. DRM)

⇒ Not relevant for this analysis

Till Dörges Protection – Malware seen as Mobile Agents 26/39

slide-35
SLIDE 35

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Policies

Description

  • Recommended for any Setup
  • Regulatory Approach
  • “Prohibit” Malicious Activity
  • Enough for certain Scenarios

Problematic

  • Enforcement of Policies
  • Prevention of Violations
  • Sanctions after Violations
  • Employ together with Logging

Till Dörges Protection – Malware seen as Mobile Agents 27/39

slide-36
SLIDE 36

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Policies

Description

  • Recommended for any Setup
  • Regulatory Approach
  • “Prohibit” Malicious Activity
  • Enough for certain Scenarios

Problematic

  • Enforcement of Policies
  • Prevention of Violations
  • Sanctions after Violations
  • Employ together with Logging

⇒ Not relevant for Malware

Till Dörges Protection – Malware seen as Mobile Agents 27/39

slide-37
SLIDE 37

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Logging

Description

  • Keep a History of Actions
  • Possibly with Signatures
  • Platforms
  • Agents
  • Useful in conjunction with Policies

Problematic

  • Logging alone does not prevent most Incidents
  • Sanctioning is supported

Till Dörges Protection – Malware seen as Mobile Agents 28/39

slide-38
SLIDE 38

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Logging

Description

  • Keep a History of Actions
  • Possibly with Signatures
  • Platforms
  • Agents
  • Useful in conjunction with Policies

Problematic

  • Logging alone does not prevent most Incidents
  • Sanctioning is supported

⇒ Not relevant for Malware

Till Dörges Protection – Malware seen as Mobile Agents 28/39

slide-39
SLIDE 39

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cooperation

Description

  • Distribution of Information or Functionality
  • Simply Redundancy

Till Dörges Protection – Malware seen as Mobile Agents 29/39

slide-40
SLIDE 40

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cooperation

Description

  • Distribution of Information or Functionality
  • Simply Redundancy

⇒ Redundancy often at least implicitly present

Till Dörges Protection – Malware seen as Mobile Agents 29/39

slide-41
SLIDE 41

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography

Main Question

  • Cryptography on Untrusted Platform

Overview

  • Partial Results Encapsulation
  • Computing with Encrypted Functions
  • Undetachable Signatures
  • Environmental Key Generation
  • Secure Communication

Till Dörges Protection – Malware seen as Mobile Agents 30/39

slide-42
SLIDE 42

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Partial Results Encapsulation

  • Secure Data Storage for Agent
  • Several Approaches in Literature
  • Encrypt Data with Public Key (e.g. owner’s)
  • Useful for collecting data from several Platforms
  • Agent cannot use Data
  • Current Platform sees Data
  • Signatures can be problematic

Till Dörges Protection – Malware seen as Mobile Agents 31/39

slide-43
SLIDE 43

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Partial Results Encapsulation

  • Secure Data Storage for Agent
  • Several Approaches in Literature
  • Encrypt Data with Public Key (e.g. owner’s)
  • Useful for collecting data from several Platforms
  • Agent cannot use Data
  • Current Platform sees Data
  • Signatures can be problematic

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 31/39

slide-44
SLIDE 44

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Computing with Encrypted Functions

  • f(): Function to be run by Agent
  • enc(): Function to encrypt (hide) Information from Platform
  • g = f ◦ enc: Function executed on Platform
  • Platform knows: g(), might also know enc()
  • Platform cannot compute f(x), only g(x) = enc(f(x))
  • enc() not easy to find
  • f(x) might be needed by Agent
  • Denial of Service, Replay Attacks

Till Dörges Protection – Malware seen as Mobile Agents 32/39

slide-45
SLIDE 45

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Computing with Encrypted Functions

  • f(): Function to be run by Agent
  • enc(): Function to encrypt (hide) Information from Platform
  • g = f ◦ enc: Function executed on Platform
  • Platform knows: g(), might also know enc()
  • Platform cannot compute f(x), only g(x) = enc(f(x))
  • enc() not easy to find
  • f(x) might be needed by Agent
  • Denial of Service, Replay Attacks

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 32/39

slide-46
SLIDE 46

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Undetachable Signatures

  • Application of Computing with Encrypted Functions
  • f(): Agent’s Signature Function
  • enc(): Also includes Agent’s Constraints
  • x: Contract to be signed
  • g(x) = enc(f(x)): Agent’s Signature of Contract
  • enc() restricts what can be signed

Till Dörges Protection – Malware seen as Mobile Agents 33/39

slide-47
SLIDE 47

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Undetachable Signatures

  • Application of Computing with Encrypted Functions
  • f(): Agent’s Signature Function
  • enc(): Also includes Agent’s Constraints
  • x: Contract to be signed
  • g(x) = enc(f(x)): Agent’s Signature of Contract
  • enc() restricts what can be signed

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 33/39

slide-48
SLIDE 48

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Environmental Key Generation

  • Unlock Code (or Data) based on Condition in the Environment
  • Condition Encoded Using Hash Functions
  • Code available in clear just before Execution

Till Dörges Protection – Malware seen as Mobile Agents 34/39

slide-49
SLIDE 49

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Environmental Key Generation

  • Unlock Code (or Data) based on Condition in the Environment
  • Condition Encoded Using Hash Functions
  • Code available in clear just before Execution

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 34/39

slide-50
SLIDE 50

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Secure Communication

  • Securing Command and Control Channels inside Network
  • Hiding Contents from Platform not possible
  • Undetachable Signatures applicable

Till Dörges Protection – Malware seen as Mobile Agents 35/39

slide-51
SLIDE 51

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Cryptography (cont’d)

Secure Communication

  • Securing Command and Control Channels inside Network
  • Hiding Contents from Platform not possible
  • Undetachable Signatures applicable

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 35/39

slide-52
SLIDE 52

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Code Obfuscation

Description

  • Perfect Obfuscation = Perfect Information Hiding
  • Obfuscation = Encryption
  • Perfect Obfuscation impossible
  • Current Quality of Obfuscation
  • leaking of “negligibly small” amount of information
  • polynomial time

Till Dörges Protection – Malware seen as Mobile Agents 36/39

slide-53
SLIDE 53

Foundations Security in MAS Conclusion Desirable Properties Protecting the Platform Protecting the Agent

Code Obfuscation

Description

  • Perfect Obfuscation = Perfect Information Hiding
  • Obfuscation = Encryption
  • Perfect Obfuscation impossible
  • Current Quality of Obfuscation
  • leaking of “negligibly small” amount of information
  • polynomial time

⇒ Applicable to Malware

Till Dörges Protection – Malware seen as Mobile Agents 36/39

slide-54
SLIDE 54

Foundations Security in MAS Conclusion

Table of Contents

1

Foundations Agents and Multi Agent Systems Agents and Malware

2

Security in MAS Desirable Properties Protecting the Platform Protecting the Agent

3

Conclusion

Till Dörges Protection – Malware seen as Mobile Agents 37/39

slide-55
SLIDE 55

Foundations Security in MAS Conclusion

Conclusion

Summing up

  • Advanced Protection Possible for Malware
  • Perfect Protection Impossible
  • Some Measures Used already

Not to forget

  • Turing and the Entscheidungsproblem
  • Current Malware already “successful”
  • Complexity of Current Setups makes for

good Hiding Spots

Till Dörges Protection – Malware seen as Mobile Agents 38/39

slide-56
SLIDE 56

Foundations Security in MAS Conclusion

Remains ...

  • Thanks for your Attention!

Till Dörges Protection – Malware seen as Mobile Agents 39/39

slide-57
SLIDE 57

Foundations Security in MAS Conclusion

Remains ...

  • Thanks for your Attention!
  • Questions?

Till Dörges Protection – Malware seen as Mobile Agents 39/39