CS Chapter 6: Malicious Software

Mobile code

"programs that can be shipped unchanged to a heterogeneous collection of platforms and executed with identical semantics" • Transmitted from a remote system to a local system and then executed on the local system • Often acts as a mechanism for a virus, worm, or Trojan horse • Takes advantage of vulnerabilities to perform its own exploits

Types of monitoring software (2)

*Ingress monitors*: Located at the border between the enterprise network and the internet; one technique is to look for incoming traffic to unused local IP addresses *Egress monitors*: Located at the egress point of individual LANs as well as at the border between the enterprise network and the Internet; Monitors outgoing traffic for signs of scanning or other suspicious behaviour

Virus classification by target (4)

- *Boot sector infector* - infects a (master) boot record and spreads when a system is booted from the disk containing the virus - *File infector* - infects files that the operating system or shell considers to be executable - *Macro virus* - infects files with macro or scripting code that is interpreted by an application - *Multipartite virus* - infects files in multiple ways

Worm replication (5)

- *Electronic mail or instant messenger facility* - *File sharing* - creates a copy of itself or infects a file as a virus on removable media - *Remote execution capability* - worm executes a copy of itself on another system - *Remote file access of transfer capability* - worm uses a remote file access of transfer service to copy itself from one system to another - *Remote login capability* - worm logs onto a remote system as a user and then uses commands to copy itself from one system to the other

Virus classification by concealment strategy (4)

- *Encrypted virus* - a portion of the virus creates a random encryption key and encrypts the remainder of the virus - *Stealth virus* - a form of virus explicitly designed to hide itself from detection by anti-virus software - *Polymorphic virus* - a virus that mutates with every infection - *Metamorphic virus* - a virus that mutates and reqrites itself completely at each iteration and may change behaviour as well as appearance

Drive-by downloads

- Exploits browser and plugin vulnerabilities so when the user views a webpage controlled by the attacker, it contains code that exploits the bug to download and install malware on the system without the user's knowledge or consent - In most cases the malware does not actively propagate as a worm does - Spreads when users visit the malicious Web page

Malvertising

- Places malware on websites without actually compromising them - The attacker pays for advertisements that are highly likely to be laced on their intended target websites and incorporate malware in them - Using these malicious ads, attackers can infect visitors to sites displaying them - The malware code may be dynamically generated to either reduce the chance of detection or to only infect specific systems - Has grown rapidly in recent years because they are easy to place on desired websites with few questions asked and are hard to track - Attackers can place these ads for as little as a few hours, when they expect their intended victims could be browsing the targeted websites, greatly reducing their visibility

WannaCry Worm attack

- Ransomware attack in May 2017 that spread extremely fast over a period of hours to days, infecting hundreds of thousands of systems belonging to both public and private organizations in more than 150 countries - It spread as a worm by aggressively scanning both local and random remote networks, attempting to exploit a vulnerability in the SMB file sharing service on unpatched Windows systems - Once installed on infected systems, it also encrypted files, demanding a ransom payment to recover them - This rapid spread was only slowed by the accidental activation of a "kill-switch" domain by a UK security researcher

Payload actions once malware reaches target (4)

- corruption of system or data files - theft of service/make the system a zombie agent of attack - theft of information from the system/keylogging - stealthing/hiding its presence on the system

Virus Phases (4)

- dormant - triggering - propagation - execution

Virus: Execution phase

- function is performed - may be harmless of damaging

Attack sources (6)

- individuals motivated to demonstrate their technical competences - politically motivated attackers - criminals - organised crime - organisations that sell services to companies and nations - national government agencies

Propagation mechanisms (3)

- infection of existing content by viruses that is subsequently spread to other systems - exploit of software vulnerabilities by worms or drive-by-downloads to allow malware to replicate - social engineering attacks that convince users to bypass security mechanisms to install Trojans or to respond to phishing attacks

Classification of Malware (4)

- on how it spreads or propagates to reach the desired targets - on actions it performs once a target is reached - need a host program (e.g virus) OR independent, self-contained programs (worms, trojans, bots) - doesn't replicate (trojans, spam) OR does replicate (viruses, worms)

Development of Attack kits

- requires considerable technical skill - toolkits are often known as "crimeware"; - include a variety of propagation mechanisms and payload modules that even novices can deploy - variants that can be generated by attackers using these toolkits creates a significant problem for those defending systems against them

Worms: Target discovery (5)

- scanning - random - hit-list - topological -local subnet

Social Engineering (def + 3)

- tricking users to assist in the compromise of their own systems - Spam: unsolicited bulk email; significant carrier of malware; used for phishing attacks - Trojan horse: program or utility containing harmful hidden code; used to accomplish functions that the attacker could not accomplish directly - Mobile phone Trojans

Virus: Triggering phase

- virus is activated to perform the function for which it was intended - can be caused by a variety of system events

Virus: Dormant phase

- virus is idle - will eventually be activated by some event - not all viruses have this stage

Virus: Propagation phase

- virus places a copy of itself into other programs or into certain system areas on the disk - may not be identical to the propagating version - each infected program will now contain a clone of the virus which will itself enter a propagation phase

Advanced Persistent Threats (APTs)

- well resourced, persistent application of a wide variety of intrusion technologies and malware to selected targets - typically attributed to state-sponsored organisations and criminal enterprises - differ from other types of attack by their careful target selection and stealthy intrusion efforts over extended periods

Trojan horse

A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes the Trojan horse program.

Macro Virus

A type of virus that uses macro or scripting code, typically embedded in a document, and triggered when the document is viewed or edited, to run and replicate itself into other such documents.

Adware

Advertising that is integrated into software. It can result in pop-up ads or redirection of a browser to a commercial site.

Backdoor (trapdoor)

Any mechanisms that bypasses a normal security check; it may allow unauthorized access to functionality in a program, or onto a compromised system.

Keyloggers

Captures keystrokes on a compromised system.

Logic bomb

Code inserted into malware by an intruder. A logic bomb lies dormant until a predefined condition is met; the code then triggers an unauthorized act.

Exploits

Code specific to a single vulnerability or set of vulnerabilities.

Downloaders

Code that installs other items on a machine that is under attack. It is normally included in the malware code first inserted on to a compromised system to then import a larger malware package.

Advanced persistent threat

Cybercrime directed at business and political targets, using a wide variety of intrusion technologies and malware, applied persistently and effectively to specific targets over an extended period, often attributed to state-sponsored organizations.

Payload system corruption: Chernobyl virus

Infects executable files when they are opened and when a trigger date is reached, the virus deletes data on the infected system by overwriting the first megabyte of the hard drive with zeroes, resulting in massive corruption of the entire file system

Payload - Information theft pshishing

Exploits social engineering to leverage the user's trust by masquerading as communication from a trusted source • Include a URL in a spam e-mail that links to a fake Web site that mimics the login page of a banking, gaming, or similar site • Suggests that urgent action is required by the user to authenticate their account • Attacker exploits the account using the captured credentials

Virus components (3)

Infection mechanism Trigger Payload

Auto-rooter

Malicious hacker tools used to break into new machines remotely.

Malware countermeasure approaches (4)

Policy Awareness Vulnerability mitigation Threat mitigation

Zombie, bot

Program activated on an infected machine that is activated to launch attacks on other machines.

Roofkit

Set of hacker tools used after attacker has broken into a computer system and gained root-level access.

Attack Kit

Set of tools for generating new malware automatically using a variety of supplied propagation and payload mechanisms.

Spyware

Software that collects information from a computer and transmits it to another system by monitoring keystrokes, screen data and/or network traffic; or by scanning files on the system for sensitive information.

Flooders (DoS client)

Used to generate a large volume of data to attack networked computer systems, by carrying out some form of denial-of-service (DoS) attack.

Spammer programs

Used to send large volumes of unwanted e-mail.

Aim of APT atacks

Varies from theft of intellectual property or security and infrastructure related data to the physical disruption of infrastructure

Malware

a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system or otherwise annoying or disrupting the victim.

Watering-Hole Attacks

• A variant of drive-by-download used in highly targeted attacks • The attacker researches their intended victims to identify websites they are likely to visit, then scans these sites to identify those with vulnerabilities that allow their compromise • They then wait for one of their intended victims to visit one of the compromised sites • Attack code may even be written so that it will only infect systems belonging to the target organization and take no action for other visitors to the site • This greatly increases the likelihood of the site compromise remaining undetected

Perimeter scanning approaches

• Anti-virus software typically included in e-mail and Web proxy services running on an organization's firewall and IDS • May also be included in the traffic analysis component of an IDS • May include intrusion prevention measures, blocking the flow of any suspicious traffic • Approach is limited to scanning malware

APT: Persistent

• Determined application of the attacks over an extended period against the chosen target in order to maximize the chance of success • A variety of attacks may be progressively applied until the target is compromised

Worms: Random target discovery

• Each compromised host probes random addresses in the IP address space using a different seed • This produces a high volume of Internet traffic which may cause generalised disruption even before the actual attack is launched

Morris Worm

• Earliest significant worm infection • Released by Robert Morris in 1988 • Designed to spread on UNIX systems • Attempted to crack local password file to use login/password to logon to other systems • Exploited a bug in the finger protocol which reports the whereabouts of a remote user • Exploited a trapdoor in the debug option of the remote process that receives and sends mail • Successful attacks achieved communication with the operating system command interpreter • Sent interpreter a bootstrap program to copy worm over

Virus: Trigger

• Event or condition that determines when the payload is activated or delivered • Sometimes known as a logic bomb

Mobile phone worms

• First discovery was Cabir worm in 2004 • Then Lasco and CommWarrior in 2005 • Communicate through Bluetooth wireless connections or MMS • Target is the smartphone • Can completely disable the phone, delete data on the phone, or force the device to send costly messages • CommWarrior replicates by means of Bluetooth to other phones, sends itself as an MMS file to contacts and as an auto reply to incoming text messages

Worms: Scanning target discovery

• First function in the propagation phase for a network worm • Searches for other systems to infect

Worms: Local subnet target discovery

• If a host can be infected behind a firewall that host then looks for targets in its own local network • The host uses the subnet address structure to find other hosts that would otherwise be protected by the firewall

Host-based behaviour-blocking software

• Integrates with the operating system of a host computer and monitors program behavior in real time for malicious action • Blocks potentially malicious actions before they have a chance to affect the system • Blocks software in real time so it has an advantage over anti-virus detection techniques such as fingerprinting or heuristics Limitations: Because malicious code must run on the target machine before all its behaviors can be identified, it can cause harm before it has been detected and blocked

Virus: Infection mechanism

• Means by which a virus spreads or propagates • Also referred to as the infection vector

Virus (detail)

• Piece of software that infects programs • Modifies them to include a copy of the virus • Replicates and goes on to infect other content • Easily spread through network environments • When attached to an executable program a virus can do anything that the program is permitted to do • Executes secretly when the host program is run • Specific to operating system and hardware • Takes advantage of their details and weaknesses

Worms (details)

• Program that actively seeks out more machines to infect and each infected machine serves as an automated launching pad for attacks on other machines • Exploits software vulnerabilities in client or server programs • Can use network connections to spread from system to system • Spreads through shared media (USB drives, CD, DVD data disks) • E-mail worms spread in macro or script code included in attachments and instant messenger file transfers • Upon activation the worm may replicate and propagate again • Usually carries some form of payload • First known implementation was done in Xerox Palo Alto Labs in the early 1980s

Spear-phishing

• Recipients are carefully researched by the attacker • E-mail is crafted to specifically suit its recipient, often quoting a range of information to convince them of its authenticity

Sandbox analysis

• Running potentially malicious code in an emulated sandbox or on a virtual machine • Allows the code to execute in a controlled environment where its behavior can be closely monitored without threatening the security of a real system • Running potentially malicious software in such environments enables the detection of complex encrypted, polymorphic, or metamorphic malware • The most difficult design issue with sandbox analysis is to determine how long to run each interpretation

Techniques used for APT attacks

• Social engineering • Spear-phishing email • Drive-by-downloads from selected compromised websites likely to be visited by personnel in the target organisation

Worms: Hit-list target discovery

• The attacker first compiles a long list of potential vulnerable machines • Once the list is compiled the attacker begins infecting machines on the list • Each infected machine is provided with a portion of the list to scan • This results in a very short scanning period which may make it difficult to detect that infection is taking place

Worms: Topological target discovery

• This method uses information contained on an infected victim machine to find more hosts to scan

APT: Threats

• Threats to the selected targets as a result of the organized, capable, and well-funded attackers intent to compromise the specifically chosen targets • The active involvement of people in the process greatly raises the threat level from that due to automated attacks tools, and also the likelihood of successful attacks

Intent of APT attacks

• To infect the target with sophisticated malware with multiple propagation mechanisms and payloads • Once they have gained initial access to systems in the target organisation a further range of attack tools are used to maintain and extend their access

APT: Advanced

• Used by the attackers of a wide variety of intrusion technologies and malware including the development of custom malware if required • The individual components may not necessarily be technically advanced but are carefully selected to suit the chosen target

Clickjacking

• Vulnerability used by an attacker to collect an infected user's clicks • The attacker can force the user to do a variety of things from adjusting the user's computer settings to unwittingly sending the user to Web sites that might have malicious code • By taking advantage of Adobe Flash or JavaScript an attacker could even place a button under or over a legitimate button making it difficult for users to detect • A typical attack uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page • The attacker is hijacking clicks meant for one page and routing them to another page

Payload system corruption: Ransomware

•Encrypts the user's data and demands payment in order to access the key needed to recover the information •PC Cyborg Trojan (1989) •Mid-2006 a number of worms and Trojans appeared that used public-key cryptography with incresasingly larger key sizes to encrypt data •The user needed to pay a ransom, or to make a purchase from certain sites, in order to receive the key to decrypt this data

Payload system corruption: Klez

•Mass mailing worm infecting Windows 95 to XP systems •First seen in October 2001 •Spreads by e-mailing copies of itself to addresses found in the address book and in files on the system •It can stop and delete some anti-virus programs running on the system •On trigger date causes files on the hard drive to become empty

Third generation anti-virus software: activity traps

•Memory-resident programs that identify malware by its actions rather than its structure in an infected program

Fourth generation anti-virus software: full-featured protection

•Packages consisting of a variety of anti-virus techniques used in conjunction •Include scanning and activity trap components and access control capability

First generation anti-virus software: simple scanners

•Requires a malware signature to identify the malware •Limited to the detection of known malware

Second generation anti-virus software: heuristic scanners

•Uses heuristic rules to search for probable malware instances •Another approach is integrity checking

Virus: Payload

•What the virus does (besides spreading) • May involve damage or benign but noticeable activity