DOCSLIB.ORG

A Fast, Selective Attack Worm Based on IP Address Information

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

Routing Worm: A Fast, Selective Attack Worm based on IP Address Information Cliff C. Zou†, Don Towsley‡, Weibo Gong†, Songlin Cai† †Department of Electrical & Computer Engineering ‡Department of Computer Science University of Massachusetts, Amherst MA 01003 {czou,gong,scai}@ecs.umass.edu, [email protected] Abstract icy flaws in widely-used services [26]. Most previ- ously wide-spreading worms, such as Code Red, Slam- Most well-known worms, such as Code Red, Slammer, mer, Blaster, and Sasser [7], are scanning worms that Blaster, and Sasser, infected vulnerable computers by scan- find and infect vulnerable machines by probing IP ad- ning the entire IPv4 address space. In this paper, we present dresses in the entire IPv4 Internet address space. How an advanced worm called “routing worm”, which imple- fast a worm can propagate is determined by many fac- ments two advanced attacking techniques. First, a routing tors. Among them, three major factors could be improved worm uses BGP routing tables to only scan the Internet by attackers: routable address space, which allows it propagate three (1). The number of initially infected hosts; times faster than a traditional worm. Second, and more (2). A worm’s scan rate η, defined as the number of scans importantly, the geographic information of BGP routing an infected computer sends out per unit time; prefixes enables a routing worm to conduct pinpoint “se- (3). A worm’s hitting probability p, defined as the proba- lective attacks” by imposing heavy damage to vulnerable bility that a worm’s scan hits any computer that is ei- computers in a specific country, company, Internet Service ther vulnerable or already infected. Provider, or Autonomous System, without collateral dam- age done to others. “Hit-list worm” presented by [23] exploits the first fac- Because of the inherent publicity of BGP routing tables, tor above to improve a worm’s propagation speed by con- attackers can easily deploy routing worms, which distin- taining a large number of IP addresses of vulnerable hosts guishes the routing worm from other “worst-case” worms. in the worm code. The second factor, worm scan rate, is de- Compared to a traditional worm, a routing worm could pos- termined by the efficiency of a worm’s code and also the sibly cause more severe congestion to the Internet back- network bandwidth. If attackers want to improve a worm’s bone since all scans sent out by a routing worm are In- propagation speed, another effort is to increase the worm’s ternet routable (and can only be dropped at the destina- hitting probability p, i.e., to waste fewer scans on obviously tions). In addition, it is harder to quickly detect a routing- empty IP space. worm infected computer since we cannot distinguish illegal In order to defend against Internet worm attacks, we scans from regular connections without waiting for traffic need to anticipate and study how attackers will improve responses. In order to defend against routing worms and all their attacking techniques. In this paper, we present an ad- scanning worms, an effective way is to upgrade the current vanced scanning worm called “routing worm”, which in- Internet from IPv4 to IPv6, although such an upgrade will creases its propagation speed by removing many empty IP require a tremendous effort and is still a controversial is- addresses from its scanning space based on information of sue. BGP routable addresses. We define two types of routing worms — one based on “/8” prefix (x.0.0.0/8) address al- location, another based on BGP routing prefixes. We call them “/8 routing worm” and “BGP routing worm”, respec- 1. Introduction tively. Without missing any potential target in the Internet, a /8 routing worm and a BGP routing worm can reduce their Computer worms are malicious programs that self- scanning space to 45.3% and 28.6% of the entire IPv4 ad- propagate across a network exploiting security or pol- dress space, respectively. In this way, attackers can increase the spreading speed of their worms by a factor of two to several possible fast spreading worms such as “Warhol” more than three without adding much complexity to the worm and “hit-list” worm right after the 2001 Code Red in- worm codes. cident. [23][30][29][8][22][18][14] provided the major re- The IP address information of BGP routing prefixes pro- search work on how to model and analyze a worm’s propa- vides geographic information about which IP addresses be- gation under various situations. long to which country, company, Internet Service Provider Many people have studied how to derive the geographic (ISP), or Autonomous System (AS). With such information, information of ASes, ISPs, IP addresses, or domain names attackers could deploy a routing worm to selectively impose from public available information. The Skitter project pro- heavy damage to compromised hosts if they belong to a spe- vides detailed information of the AS number, name, longi- cific entity (country, company, ISP, or AS) and leave the tude and latitude for every AS in the Internet [6]. In [5], compromised hosts belonging to others intact. Such a “se- CAIDA provides the mapping between AS number and the lective attack” property makes a routing worm tremendous country it belongs to. Furthermore, there are location map- dangerous considering the potential attacks initiated by ter- ping commercial services, such as EdgeScape from Akamai rorists, revengers, or business rivals. [9] and the free IP-to-location service from Geobytes [17]. Because of the inherent publicity of BGP routing tables, The Route Views project [20] and the Routing Informa- attackers can easily deploy a routing worm without much tion Service from RIPE NCC [19] provide detailed BGP extra effort — this distinguishes the routing worm from routing information of the Internet. In 1997, Braun [3] first other theoretical “worst-case” worms. In addition, com- used BGP routing tables to determine the fraction of IP pared to a traditional worm that scans the entire IPv4 space, space that has been allocated. CAIDA also studied this is- a routing worm could possibly cause more congestion trou- sue in 1998 [4]. ble to the Internet backbone, and also makes it harder to Some people have proposed upgrading IPv4 to IPv6 as a quickly detect infected computers. We will explain these defense against scanning worms [25][24][29], but have not challenges in detail later in this paper. explained this issue in detail. Thus most people have not To defend against the threat of routing worms and all paid attention to the inherent capability of IPv6 in prevent- scanning worms, we show that upgrading the current IPv4 ing attacks from scanning worms. Internet to IPv6 is an effective way, although such an up- grade will require a tremendous effort and is still a contro- versial issue. 3. Routing Worm: A Fast Spreading Worm The rest of this paper is organized as follows. Section 2 surveys related work. In Section 3, we discuss how rout- The central idea of the spreading speed improvement of a ing worms can use various types of IPv4 address informa- routing worm is to make the worm’s target-finding more ef- tion to improve their spreading speed. In Section 4, we point ficient without ignoring any potential vulnerable computer out that attackers can use routing worms to conduct selec- in the Internet. tive attack based on geographic information of IP addresses or BGP prefixes. Then in Section 5, we point out two ad- 3.1. BGP routing worm ditional challenges brought up by routing worms. In Sec- tion 6, we present modeling and analysis of routing worms One simple way to reduce the scanning space is to based on uniform-scan worm model [31]. Then we propose use the information provided by Border Gateway Protocol to upgrade IPv4 to IPv6 to defend against scanning worms (BGP) routing tables. Both the Route Views project [20] and in Section 7. In the end, Section 8 concludes this paper. RIPE NCC [19] provide complete snapshots of BGP rout- ing tables several times per day. BGP routing tables contain 2. Related work all Internet routable IP addresses. A “BGP routing worm” is an advanced worm that contains BGP routing prefix in- At the same time when we proposed the “routing worm” formation to only scans BGP routable IP addresses. In this in this paper, Wu et al. [28] independently presented a way, the worm effectively reduces its scanning space with- “routable scan” strategy that is similar to the reducing out missing any target. scanning space idea of the routing worm. However, the A BGP routing prefix is a chunk of IP addresses that have routing worm presented in this paper is not only a sim- the same n most-significant bits in their addresses where ple “routable scan” worm, but also a worm that could be n is called prefix length for this prefix. Because of multi- used by attackers to conduct selective attack to a specific homing, many prefixes in a BGP routing table overlap with country or company (ISP, AS, etc), which is more dan- each other — one prefix of shorter length contains all of the gerous and important to attackers than simply improving a IP addresses in another prefix of longer length. To deter- worm’s propagation speed. Staniford et al. [23] presented mine the percentage of IPv4 space that is BGP routable, we download BGP routing tables from Route Views [20], ex- point of view, a worm does not need to waste its scans on IP tract routing prefixes, and remove all overlapping prefixes addresses belonging to the other 140 “/8” prefixes.
Recommended publications
  • Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress

    Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress

    Order Code RL32114 Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress Updated January 29, 2008 Clay Wilson Specialist in Technology and National Security Foreign Affairs, Defense, and Trade Division Botnets, Cybercrime, and Cyberterrorism: Vulnerabilities and Policy Issues for Congress Summary Cybercrime is becoming more organized and established as a transnational business. High technology online skills are now available for rent to a variety of customers, possibly including nation states, or individuals and groups that could secretly represent terrorist groups. The increased use of automated attack tools by cybercriminals has overwhelmed some current methodologies used for tracking Internet cyberattacks, and vulnerabilities of the U.S. critical infrastructure, which are acknowledged openly in publications, could possibly attract cyberattacks to extort money, or damage the U.S. economy to affect national security. In April and May 2007, NATO and the United States sent computer security experts to Estonia to help that nation recover from cyberattacks directed against government computer systems, and to analyze the methods used and determine the source of the attacks.1 Some security experts suspect that political protestors may have rented the services of cybercriminals, possibly a large network of infected PCs, called a “botnet,” to help disrupt the computer systems of the Estonian government. DOD officials have also indicated that similar cyberattacks from individuals and countries targeting economic,
  • Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G

    Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G

    Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G. van Eeten, Delft University of Technology https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/asghari This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere and Michel J.G. van Eeten Delft University of Technology Abstract more sophisticated C&C mechanisms that are increas- ingly resilient against takeover attempts [30]. Research on botnet mitigation has focused predomi- In pale contrast to this wealth of work stands the lim- nantly on methods to technically disrupt the command- ited research into the other side of botnet mitigation: and-control infrastructure. Much less is known about the cleanup of the infected machines of end users. Af- effectiveness of large-scale efforts to clean up infected ter a botnet is successfully sinkholed, the bots or zom- machines. We analyze longitudinal data from the sink- bies basically remain waiting for the attackers to find hole of Conficker, one the largest botnets ever seen, to as- a way to reconnect to them, update their binaries and sess the impact of what has been emerging as a best prac- move the machines out of the sinkhole. This happens tice: national anti-botnet initiatives that support large- with some regularity. The recent sinkholing attempt of scale cleanup of end user machines.
  • Undergraduate Report

    Undergraduate Report

    UNDERGRADUATE REPORT Attack Evolution: Identifying Attack Evolution Characteristics to Predict Future Attacks by MaryTheresa Monahan-Pendergast Advisor: UG 2006-6 IINSTITUTE FOR SYSTEMSR RESEARCH ISR develops, applies and teaches advanced methodologies of design and analysis to solve complex, hierarchical, heterogeneous and dynamic problems of engineering technology and systems for industry and government. ISR is a permanent institute of the University of Maryland, within the Glenn L. Martin Institute of Technol- ogy/A. James Clark School of Engineering. It is a National Science Foundation Engineering Research Center. Web site http://www.isr.umd.edu Attack Evolution 1 Attack Evolution: Identifying Attack Evolution Characteristics To Predict Future Attacks MaryTheresa Monahan-Pendergast Dr. Michel Cukier Dr. Linda C. Schmidt Dr. Paige Smith Institute of Systems Research University of Maryland Attack Evolution 2 ABSTRACT Several approaches can be considered to predict the evolution of computer security attacks, such as statistical approaches and “Red Teams.” This research proposes a third and completely novel approach for predicting the evolution of an attack threat. Our goal is to move from the destructive nature and malicious intent associated with an attack to the root of what an attack creation is: having successfully solved a complex problem. By approaching attacks from the perspective of the creator, we will chart the way in which attacks are developed over time and attempt to extract evolutionary patterns. These patterns will eventually
  • Lexisnexis® Congressional Copyright 2003 Fdchemedia, Inc. All Rights

    Lexisnexis® Congressional Copyright 2003 Fdchemedia, Inc. All Rights

    LexisNexis® Congressional Copyright 2003 FDCHeMedia, Inc. All Rights Reserved. Federal Document Clearing House Congressional Testimony September 10, 2003 Wednesday SECTION: CAPITOL HILL HEARING TESTIMONY LENGTH: 4090 words COMMITTEE: HOUSE GOVERNMENT REFORM SUBCOMMITTEE: TECHNOLOGY, INFORMATION POLICY, INTERGOVERNMENTAL RELATIONS, AND CENSUS HEADLINE: COMPUTER VIRUS PROTECTION TESTIMONY-BY: RICHARD PETHIA, DIRECTOR AFFILIATION: CERT COORDINATION CENTER BODY: Statement of Richard Pethia Director, CERT Coordination Center Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census Committee on House Government Reform September 10, 2003 Introduction Mr. Chairman and Members of the Subcommittee: My name is Rich Pethia. I am the director of the CERTO Coordination Center (CERT/CC). Thank you for the opportunity to testify on the important issue of cyber security. Today I will discuss viruses and worms and the steps we must take to protect our systems from them. The CERT/CC was formed in 1988 as a direct result of the first Internet worm. It was the first computer security incident to make headline news, serving as a wake-up call for network security. In response, the CERT/CC was established by the Defense Advanced Research Projects Agency at Carnegie Mellon University's Software Engineering Institute, in Pittsburgh. Our mission is to serve as a focal point to help resolve computer security incidents and vulnerabilities, to help others establish incident response capabilities, and to raise awareness of computer security issues and help people understand the steps they need to take to better protect their systems. We activated the center in just two weeks, and we have worked hard to maintain our ability to react quickly.
  • Flow-Level Traffic Analysis of the Blaster and Sobig Worm Outbreaks in an Internet Backbone

    Flow-Level Traffic Analysis of the Blaster and Sobig Worm Outbreaks in an Internet Backbone

    Flow-Level Traffic Analysis of the Blaster and Sobig Worm Outbreaks in an Internet Backbone Thomas Dübendorfer, Arno Wagner, Theus Hossmann, Bernhard Plattner ETH Zurich, Switzerland [email protected] DIMVA 2005, Wien, Austria Agenda 1) Introduction 2) Flow-Level Backbone Traffic 3) Network Worm Blaster.A 4) E-Mail Worm Sobig.F 5) Conclusions and Outlook © T. Dübendorfer (2005), TIK/CSG, ETH Zurich -2- 1) Introduction Authors Prof. Dr. Bernhard Plattner Professor, ETH Zurich (since 1988) Head of the Communication Systems Group at the Computer Engineering and Networks Laboratory TIK Prorector of education at ETH Zurich (since 2005) Thomas Dübendorfer Dipl. Informatik-Ing., ETH Zurich, Switzerland (2001) ISC2 CISSP (Certified Information System Security Professional) (2003) PhD student at TIK, ETH Zurich (since 2001) Network security research in the context of the DDoSVax project at ETH Further authors: Arno Wagner, Theus Hossmann © T. Dübendorfer (2005), TIK/CSG, ETH Zurich -3- 1) Introduction Worm Analysis Why analyse Internet worms? • basis for research and development of: • worm detection methods • effective countermeasures • understand network impact of worms Wasn‘t this already done by anti-virus software vendors? • Anti-virus software works with host-centric signatures Research method used 1. Execute worm code in an Internet-like testbed and observe infections 2. Measure packet-level traffic and determine network-centric worm signatures on flow-level 3. Extensive analysis of flow-level traffic of the actual worm outbreaks captured in a Swiss backbone © T. Dübendorfer (2005), TIK/CSG, ETH Zurich -4- 1) Introduction Related Work Internet backbone worm analyses: • Many theoretical worm spreading models and simulations exist (e.g.
  • Computer Security CS 426 Lecture 15

    Computer Security CS 426 Lecture 15

    Computer Security CS 426 Lecture 15 Malwares CS426 Fall 2010/Lecture 15 1 Trapdoor • SttitittSecret entry point into a system – Specific user identifier or password that circumvents normal security procedures. • Commonlyyy used by developers – Could be included in a compiler. CS426 Fall 2010/Lecture 15 2 Logic Bomb • Embedded in legitimate programs • Activated when specified conditions met – E.g., presence/absence of some file; Particular date/time or particular user • When triggered, typically damages system – Modify/delete files/disks CS426 Fall 2010/Lecture 15 3 Examppgle of Logic Bomb • In 1982 , the Trans-Siber ian Pipe line inc iden t occurred. A KGB operative was to steal the plans fhititdtltditfor a sophisticated control system and its software from a Canadian firm, for use on their Siberi an pi peli ne. The CIA was tippe d o ff by documents in the Farewell Dossier and had the company itlibbithinsert a logic bomb in the program for sabotage purposes. This eventually resulted in "the most monu mental non-nu clear ex plosion and fire ever seen from space“. CS426 Fall 2010/Lecture 15 4 Trojan Horse • Program with an overt Example: Attacker: (expected) and covert effect Place the following file cp /bin/sh /tmp/.xxsh – Appears normal/expected chmod u+s,o+x /tmp/.xxsh – Covert effect violates security policy rm ./ls • User tricked into executing ls $* Trojan horse as /homes/victim/ls – Expects (and sees) overt behavior – Covert effect performed with • Victim user’s authorization ls CS426 Fall 2010/Lecture 15 5 Virus • Self-replicating
  • MODELING the PROPAGATION of WORMS in NETWORKS: a SURVEY 943 in Section 2, Which Set the Stage for Later Sections

    MODELING the PROPAGATION of WORMS in NETWORKS: a SURVEY 943 in Section 2, Which Set the Stage for Later Sections

    942 IEEE COMMUNICATIONS SURVEYS & TUTORIALS, VOL. 16, NO. 2, SECOND QUARTER 2014 Modeling the Propagation of Worms in Networks: ASurvey Yini Wang, Sheng Wen, Yang Xiang, Senior Member, IEEE, and Wanlei Zhou, Senior Member, IEEE, Abstract—There are the two common means for propagating attacks account for 1/4 of the total threats in 2009 and nearly worms: scanning vulnerable computers in the network and 1/5 of the total threats in 2010. In order to prevent worms from spreading through topological neighbors. Modeling the propa- spreading into a large scale, researchers focus on modeling gation of worms can help us understand how worms spread and devise effective defense strategies. However, most previous their propagation and then, on the basis of it, investigate the researches either focus on their proposed work or pay attention optimized countermeasures. Similar to the research of some to exploring detection and defense system. Few of them gives a nature disasters, like earthquake and tsunami, the modeling comprehensive analysis in modeling the propagation of worms can help us understand and characterize the key properties of which is helpful for developing defense mechanism against their spreading. In this field, it is mandatory to guarantee the worms’ spreading. This paper presents a survey and comparison of worms’ propagation models according to two different spread- accuracy of the modeling before the derived countermeasures ing methods of worms. We first identify worms characteristics can be considered credible. In recent years, although a variety through their spreading behavior, and then classify various of models and algorithms have been proposed for modeling target discover techniques employed by them.
  • The Blaster Worm: Then and Now

    The Blaster Worm: Then and Now

    Worms The Blaster Worm: Then and Now The Blaster worm of 2003 infected at least 100,000 Microsoft Windows systems and cost millions in damage. In spite of cleanup efforts, an antiworm, and a removal tool from Microsoft, the worm persists. Observing the worm’s activity can provide insight into the evolution of Internet worms. MICHAEL n Wednesday, 16 July 2003, Microsoft and continued to BAILEY, EVAN Security Bulletin MS03-026 (www. infect new hosts COOKE, microsoft.com/security/incident/blast.mspx) more than a year later. By using a wide area network- FARNAM O announced a buffer overrun in the Windows monitoring technique that observes worm infection at- JAHANIAN, AND Remote Procedure Call (RPC) interface that could let tempts, we collected observations of the Blaster worm DAVID WATSON attackers execute arbitrary code. The flaw, which the during its onset in August 2003 and again in August 2004. University of Last Stage of Delirium (LSD) security group initially This let us study worm evolution and provides an excel- Michigan uncovered (http://lsd-pl.net/special.html), affected lent illustration of a worm’s four-phase life cycle, lending many Windows operating system versions, including insight into its latency, growth, decay, and persistence. JOSE NAZARIO NT 4.0, 2000, and XP. Arbor When the vulnerability was disclosed, no known How the Blaster worm attacks Networks public exploit existed, and Microsoft made a patch avail- The initial Blaster variant’s decompiled source code re- able through their Web site. The CERT Coordination veals its unique behavior (http://robertgraham.com/ Center and other security organizations issued advisories journal/030815-blaster.c).
  • Effective Malicious Features Extraction and Classification for Incident Handling Systems

    Effective Malicious Features Extraction and Classification for Incident Handling Systems

    EFFECTIVE MALICIOUS FEATURES EXTRACTION AND CLASSIFICATION FOR INCIDENT HANDLING SYSTEMS CHO CHO SAN UNIVERSITY OF COMPUTER STUDIES, YANGON OCTOBER, 2019 Effective Malicious Features Extraction and Classification for Incident Handling Systems Cho Cho San University of Computer Studies, Yangon A thesis submitted to the University of Computer Studies, Yangon in partial fulfillment of the requirements for the degree of Doctor of Philosophy October, 2019 Statement of Originality I hereby certify that the work embodied in this thesis is the result of original research and has not been submitted for a higher degree to any other University or Institution. …..…………………………… .…………........………………………… Date Cho Cho San ACKNOWLEDGEMENTS First of all, I would like to thank Hist Excellency, the Minister for the Ministry of Education, for providing full facilities support during the Ph.D. course at the University of Computer Studies, Yangon. Secondly, my profound gratitude goes to Dr. Mie Mie Thet Thwin, Rector of the University of Computer Studies, Yangon, for allowing me to develop this research and giving me general guidance during the period of my study. I would like to express my greatest pleasure and the deepest appreciation to my supervisor, Dr. Mie Mie Su Thwin, Professor, the University of Computer Studies, Yangon, for her excellent guidance, caring, patient supervision, and providing me with excellent ideas throughout the study of this thesis. I would also like to extend my special appreciation to Dr. Khine Moe Nwe, Professor and Course-coordinator of the Ph.D. 9th Batch, the University of Computer Studies, Yangon, for her useful comments, advice, and insight which are invaluable through the process of researching and writing this dissertation.
  • Code Red Worm Propagation Modeling and Analysis ∗

    Code Red Worm Propagation Modeling and Analysis ∗

    Code Red Worm Propagation Modeling and Analysis ∗ Cliff Changchun Zou Weibo Gong Don Towsley Dept. Electrical & Dept. Electrical & Dept. Computer Science Computer Engineering Computer Engineering Univ. Massachusetts Univ. Massachusetts Univ. Massachusetts Amherst, MA Amherst, MA Amherst, MA [email protected] [email protected] [email protected] ABSTRACT the Internet has become a powerful mechanism for propa- The Code Red worm incident of July 2001 has stimulated gating malicious software programs. Worms, defined as au- activities to model and analyze Internet worm propagation. tonomous programs that spread through computer networks In this paper we provide a careful analysis of Code Red prop- by searching, attacking, and infecting remote computers au- agation by accounting for two factors: one is the dynamic tomatically, have been developed for more than 10 years countermeasures taken by ISPs and users; the other is the since the first Morris worm [30]. Today, our computing in- slowed down worm infection rate because Code Red rampant frastructure is more vulnerable than ever before [28]. The propagation caused congestion and troubles to some routers. Code Red worm and Nimda worm incidents of 2001 have Based on the classical epidemic Kermack-Mckendrick model, shown us how vulnerable our networks are and how fast we derive a general Internet worm model called the two- a virulent worm can spread; furthermore, Weaver presented factor worm model. Simulations and numerical solutions some design principles for worms such that they could spread of the two-factor worm model match the observed data of even faster [34]. In order to defend against future worms, we Code Red worm better than previous models do.
  • Chapter 3: Viruses, Worms, and Blended Threats

    Chapter 3: Viruses, Worms, and Blended Threats

    Chapter 3 Chapter 3: Viruses, Worms, and Blended Threats.........................................................................46 Evolution of Viruses and Countermeasures...................................................................................46 The Early Days of Viruses.................................................................................................47 Beyond Annoyance: The Proliferation of Destructive Viruses .........................................48 Wiping Out Hard Drives—CIH Virus ...................................................................48 Virus Programming for the Masses 1: Macro Viruses...........................................48 Virus Programming for the Masses 2: Virus Generators.......................................50 Evolving Threats, Evolving Countermeasures ..................................................................51 Detecting Viruses...................................................................................................51 Radical Evolution—Polymorphic and Metamorphic Viruses ...............................53 Detecting Complex Viruses ...................................................................................55 State of Virus Detection.........................................................................................55 Trends in Virus Evolution..................................................................................................56 Worms and Vulnerabilities ............................................................................................................57
  • A Highly Immersive Approach to Teaching Reverse Engineering Golden G

    A Highly Immersive Approach to Teaching Reverse Engineering Golden G

    A Highly Immersive Approach to Teaching Reverse Engineering Golden G. Richard III Department of Computer Science University of New Orleans New Orleans, LA 70148 Email: [email protected] Abstract most operating systems courses, but for reverse engi- neering, the devil really is in the details. For example, While short training courses in reverse engineering are to understand an offensive technique like Shadow frequently offered at meetings like Blackhat and Walker [13], which relies on de-synchronization of the through training organizations such as SANS, there are data and instruction TLBs in Intel’s split-TLB design virtually no reverse engineering courses offered in aca- to hide code and data, it’s not enough to have seen a demia. This paper discusses possible reasons for this Powerpoint slide depicting the abstract functionality of situation, emphasizes the importance of teaching re- a TLB—that’s a good start, but both more details and verse engineering (and applied computer security edu- hands-on experience are needed. Furthermore, assem- cation in general), and presents the overall design of a bler language courses, if they exist at all as independ- semester-long course in reverse engineering malware, ent courses in a modern computing curriculum, tend to recently offered by the author at the University of New be much weaker than in the past, often emphasizing the Orleans. use of High Level Assembler (HLA) [4] and develop- 1 Introduction ment of toy applications. In many curricula, the as- sembler language course of old has been folded into the Reverse engineering of software involves detailed undergraduate architecture class.