DOCSLIB.ORG

E©RIME ®EVOLUTION

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
E©RIME ®EVOLUTION e©RIME ®EVOLUTION Dani Creus | @them0ux Marc Rivero | @seifreed Security Researcher Senior eCrime Global Research & Analysis Team IT Ers Kaspersky Lab Deloitte | CyberSOC CONTEXTO ‣ MOTIVACIONES ‣ OFF-LINE/ONLINE ‣ ACTORES Y VÍCTIMAS ‣ TÉCNICAS, TÁCTICAS y PROCEDIMIENTOS ‣ MALWARE !! ‣ COMUNIDADES Epoca Romántica (198X-2000) ‣ CONOCIMIENTO, SUPERACIÓN ‣ INDIVIDUALISTAS, GRUPOS REDUCIDOS ‣ OBJETIVOS (EXCEPCIONES) ‣ COMUNIDADES 1.0 (BBS, IRC) ‣ OFF-LINE / ONLINE NUMB3RS ‣ ;1234567891234567=152024041234567891234? The only limit is your imagination! Originals designs can be designed from any country worldwide, and in any language of your choice... from Scuba instructor, Warranty, Security, Massage Therapist, Auto Mechanic Instructor, Business License, Award, Real Estate, Degree and Diploma Certificates. Various Degrees, Ordained Minister, Royalty Titles, Kung Fu Master, Club Member, Library, Scuba Diver, International Driver, Frequent Flyer, Novelty Id Cards, Fake Driver License, Driver Permits, Security Social Card, New Identity, Membership cards, CIA, DEA, FBI, Private Detective, Bondsman, Bounty Hunter, Casino, Press, Access Cards and much more...or virtually any kind of product you desire. MALWARE (198X - 2000) CARACTER “EXPERIMENTAL” AUTO-REPRODUCCIÓN 1995 : CONCEPT (M) POLIMORFISMO 1998 : CIH, NETBUS (R) MACRO VIRUSES 1999 : HAPPY99, MELISSA, RATS SUB7,BACKORIFFICE (R) 2000 : ILOVEYOU (VBS) FIRMAS ESTÁTICAS AVP: (GUI / SOFTWARE + DB) NUEVOS FORMATOS/SISTEMAS ANTIVIRUS DIALERS ‣ MODIFICAN CONEXIÓN TELEFÓNICA 806 ‣ TARIFICACIÓN PREMIUM/INTERNACIONAL ‣ INGENIERÍA SOCIAL ‣ DISTRIBUCIÓN “”SOFISTICADA”” 906 ‣ ESQUEMA “COMPLEJO” ‣ TIEMPO DE REACCIÓN : 30 DÍAS 903 LA EDAD MEDIA (2000 – 2004) ‣ DINERO,CONOCIMIENTO, INFORMACIÓN… SUPERACIÓN… ‣ GRUPOS + NÚMEROSOS ‣ DIVERSIFICACIÓN de TAREAS ‣ VICTIMAS -> USUARIOS ‣ PHISHING ‣ COMUNIDADES 2.0 “THE PLANET” Malware (2000 – 2004) *MORFISMO, 2001 : SADMIN, CODE RED I - II, KEYLOGGERS NIMDA.. RATS 2002 : SIMILE , MYLIFE (OUTLOOK) MOBILE OPTIX PRO, BEAST 2003 : SLAMMER (SQL), BLASTER VELOCIDAD DE ACTUALIZACIÓN 2004 : BAGLE, NETSKY, CABIR, HEURÍSTICA NUCLEUS , ADWARE ANTI-EVASIÓN ANTIVIRUS -> ANTIMALWARE Revolución industrial (2005 – 2014) ‣ GRUPOS ORGANIZADOS / “””NUEVOS””” ACTORES ‣ ESPECIALIZACIÓN/DIVERSIFICACIÓN : PROFESIONALIZACIÓN ‣ NUEVOS MODELOS DE NEGOCIO (FaaS) ‣ INFRAESTRUCTURAS DE SOPORTE ‣ OBJETIVOS (SISTEMAS DE CONTROL INDUSTRIAL) ‣ ESQUEMAS: SOFISTICACIÓN Y AGRESIVIDAD Phishing Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication Phishing Pharming Spear phishing ¿Phishing 2.0? SERVICIOS SAM RDP Socks VPN BULLETPROOF HOSTING Malware (2005-2014) ‣ 2007 : ZEUS ‣ 2008 : TORPIG, GPCode , CONFICKER ‣ 2009 : CLAMPI ‣ 2010 : TDSS,ALUREON, STUXNET ‣ 2011 : SPYEYE + ZEUS, LEAKS, DUQU, CARBERP, ROGUEWARE (FAKEAV´S) ‣ 2012 : FLAME/SKYWIPER, SHAMOON, BITCOIN MINERS ‣ 2013/2014 : ATM MALWARE, POS, RANSOMWARE ROGUEWARE Ransomware Cryptolockers !! Denegación de servicio DOS AS A SERVICE TROYANOS BANCARIOS CAPTURAS DE PANTALLA Virtual keyboard PHARMING PHISHING KEYLOGGING Code card ID + Password MITB FORM GRABBING OTP Token INYECCIÓN DE CÓDIGO SMS : mTAN Source Code leaks “Single” Infraestructure DGA – Zeus P2P DGA – Zeus P2P C&C Tracking 2 cases Analyzing Sinowal and Tatanga Sinowal injection Man in the Browser Intelligence in money extraction Tatanga behaviour Compromised machine Social engineering E LUUUK INVESTIGATION TRANSACTION LOGS +500,000 € MULEROS 13test 14smallings The limit that the mules included in this group The limit that the drops in this group can accept can accept is between 40,000 and 50,000 Euros, is between 1,750 and 2,000 Euros. although there are drops in this group that shows different limits, between 20,000 and 30,000. 14test 16smallings The limit that the drops included in this group can The limit that the drops in this group can accept is accept is between 15,000 and 20,000 Euros, between 1,750 and 2,000 Euros, although there are although there are drops in this group that shows drops in this group that can accept a quantity different limits, between 45,000 and 50,000. between 2,500 and 3,000 Euros (as the group 14smallings). MULEROS MONEY MULES PIRÁMIDE DE AMENAZAS — 2015 0.1% Armas cibernéticas 9.9% Amenazas dirigidas Delitos tradicionales 90% Amenazas Dirigidas Threat Duqu Flame Gauss miniFlame Red October NetTraveler Careto / The Mask Classification Cyber-espionage Cyber-espionage Cyber-espionage Cyber-espionage Cyber-espionage Series of cyber- Extremely sophisticated malware malware malware malware campaign espionage cyber-espionage campaign campaigns Detection September 2011 May 2012 July 2012 October 2012 January 2013 May 2013 February 2014 Active Since 2010 Since 2007 Since 2011 Since 2012 Since 2007 Since 2004 Since 2007 Facts • Sophisticated • More than 600 • Sophisticated • Miniature yet • One of the first • 350 high • 1000+ victims in Trojan specific targets toolkit with fully-fledged massive espionage profile victims 31 countries modules spyware module campaigns in 40 countries • Acts as a • Can spread over perform a conducted on • Complex toolset backdoor a local network variety • Used for highly a global scale • Exploits known with malware, into a system or of functions targeted attacks vulnerabilities rootkit, bootkit via a USB stick • Targeted • Facilitates the • The vast • Works as stand- diplomatic and • Directed at private • Versions for theft of private • Records majority of alone malware governmental companies, Windows, Mac OS X, information screenshots, victims were or as a plug-in agencies industry and Linux audio, keyboard for Flame research facilities, located in • Considered one activity and Lebanon • Russian language governmental network traffic text in the code agencies of the most notes advanced APTs ever GAUSS - 2012 LOADER AND LOADER AND COMMUNICATION COMMUNICATI MODULE ON MODULE LOADER AND LOADER AND COMMUNICATI COMMUNICATION ON MODULE MODULE LOADER AND COMMUNICATION MODULE RELACIONES RED OCTOBER - 2013 CVE-2009-3129 CVE-2010-3333 CVE-2012-0158 CVE-2011-3544 REGIN DESSERT FALCONS EQUATIONAPT - 2015 ‣ EQUATIONDRUG ‣ DOUBLEFANTASY ‣ EQUESTRE ‣ TRIPLEFANTASY ‣ GRAYFISH ‣ FANNY ‣ EQUATIONLASER PIRÁMIDA DE AMENAZAS 0.1% Armas cibernéticas 9.9% Amenazas dirigidas Delitos tradicionales 90% Thank you! Dani Creus | @them0ux Marc Rivero | @seifreed dani.creus at kaspersky dot com [email protected] more : securelist.com more : ecrime.info .
Load more

Recommended publications
  • Statistical Structures: Fingerprinting Malware for Classification and Analysis
    Statistical Structures: Fingerprinting Malware for Classification and Analysis Daniel Bilar Wellesley College (Wellesley, MA) Colby College (Waterville, ME) bilar <at> alum dot dartmouth dot org Why Structural Fingerprinting? Goal: Identifying and classifying malware Problem: For any single fingerprint, balance between over-fitting (type II error) and under- fitting (type I error) hard to achieve Approach: View binaries simultaneously from different structural perspectives and perform statistical analysis on these ‘structural fingerprints’ Different Perspectives Idea: Multiple perspectives may increase likelihood of correct identification and classification Structural Description Statistical static / Perspective Fingerprint dynamic? Assembly Count different Opcode Primarily instruction instructions frequency static distribution Win 32 API Observe API calls API call vector Primarily call made dynamic System Explore graph- Graph structural Primarily Dependence modeled control and properties static Graph data dependencies Fingerprint: Opcode frequency distribution Synopsis: Statically disassemble the binary, tabulate the opcode frequencies and construct a statistical fingerprint with a subset of said opcodes. Goal: Compare opcode fingerprint across non- malicious software and malware classes for quick identification and classification purposes. Main result: ‘Rare’ opcodes explain more data variation then common ones Goodware: Opcode Distribution 1, 2 ---------.exe Procedure: -------.exe 1. Inventoried PEs (EXE, DLL, ---------.exe etc) on XP box with Advanced Disk Catalog 2. Chose random EXE samples size: 122880 with MS Excel and Index totalopcodes: 10680 3, 4 your Files compiler: MS Visual C++ 6.0 3. Ran IDA with modified class: utility (process) InstructionCounter plugin on sample PEs 0001. 002145 20.08% mov 4. Augmented IDA output files 0002. 001859 17.41% push with PEID results (compiler) 0003. 000760 7.12% call and general ‘functionality 0004.
    [Show full text]
  • A the Hacker
    A The Hacker Madame Curie once said “En science, nous devons nous int´eresser aux choses, non aux personnes [In science, we should be interested in things, not in people].” Things, however, have since changed, and today we have to be interested not just in the facts of computer security and crime, but in the people who perpetrate these acts. Hence this discussion of hackers. Over the centuries, the term “hacker” has referred to various activities. We are familiar with usages such as “a carpenter hacking wood with an ax” and “a butcher hacking meat with a cleaver,” but it seems that the modern, computer-related form of this term originated in the many pranks and practi- cal jokes perpetrated by students at MIT in the 1960s. As an example of the many meanings assigned to this term, see [Schneier 04] which, among much other information, explains why Galileo was a hacker but Aristotle wasn’t. A hack is a person lacking talent or ability, as in a “hack writer.” Hack as a verb is used in contexts such as “hack the media,” “hack your brain,” and “hack your reputation.” Recently, it has also come to mean either a kludge, or the opposite of a kludge, as in a clever or elegant solution to a difficult problem. A hack also means a simple but often inelegant solution or technique. The following tentative definitions are quoted from the jargon file ([jargon 04], edited by Eric S. Raymond): 1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary.
    [Show full text]
  • Miscellaneous: Malware Cont'd & Start on Bitcoin
    Miscellaneous: Malware cont’d & start on Bitcoin CS 161: Computer Security Prof. Raluca Ada Popa April 19, 2018 Credit: some slides are adapted from previous offerings of this course Viruses vs. Worms VIRUS WORM Propagates By infecting Propagates automatically other programs By copying itself to target systems Usually inserted into A standalone program host code (not a standalone program) Another type of virus: Rootkits Rootkit is a ”stealthy” program designed to give access to a machine to an attacker while actively hiding its presence Q: How can it hide itself? n Create a hidden directory w /dev/.liB, /usr/src/.poop and similar w Often use invisiBle characters in directory name n Install hacked Binaries for system programs such as netstat, ps, ls, du, login Q: Why does it Become hard to detect attacker’s process? A: Can’t detect attacker’s processes, files or network connections By running standard UNIX commands! slide 3 Sony BMG copy protection rootkit scandal (2005) • Sony BMG puBlished CDs that apparently had copy protection (for DRM). • They essentially installed a rootkit which limited user’s access to the CD. • It hid processes that started with $sys$ so a user cannot disaBle them. A software engineer discovered the rootkit, it turned into a Big scandal Because it made computers more vulneraBle to malware Q: Why? A: Malware would choose names starting with $sys$ so it is hidden from antivirus programs Sony BMG pushed a patch … But that one introduced yet another vulneraBility So they recalled the CDs in the end Detecting Rootkit’s
    [Show full text]
  • Éric FREYSSINET Lutte Contre Les Botnets
    THÈSE DE DOCTORAT DE L’UNIVERSITÉ PIERRE ET MARIE CURIE Spécialité Informatique École doctorale Informatique, Télécommunications et Électronique (Paris) Présentée par Éric FREYSSINET Pour obtenir le grade de DOCTEUR DE L’UNIVERSITÉ PIERRE ET MARIE CURIE Sujet de la thèse : Lutte contre les botnets : analyse et stratégie Présentée et soutenue publiquement le 12 novembre 2015 devant le jury composé de : Rapporteurs : M. Jean-Yves Marion Professeur, Université de Lorraine M. Ludovic Mé Enseignant-chercheur, CentraleSupélec Directeurs : M. David Naccache Professeur, École normale supérieure de thèse M. Matthieu Latapy Directeur de recherche, UPMC, LIP6 Examinateurs : Mme Clémence Magnien Directrice de recherche, UPMC, LIP6 Mme Solange Ghernaouti-Hélie Professeure, Université de Lausanne M. Vincent Nicomette Professeur, INSA Toulouse Cette thèse est dédiée à M. Celui qui n’empêche pas un crime alors qu’il le pourrait s’en rend complice. — Sénèque Remerciements Je tiens à remercier mes deux directeurs de thèse. David Naccache, officier de réserve de la gendarmerie, contribue au développement de la recherche au sein de notre institution en poussant des personnels jeunes et un peu moins jeunes à poursuivre leur passion dans le cadre académique qui s’impose. Matthieu Latapy, du LIP6, avec qui nous avions pu échanger autour d’une thèse qu’il encadrait dans le domaine difficile des atteintes aux mineurs sur Internet et qui a accepté de m’accueillir dans son équipe. Je voudrais remercier aussi, l’ensemble de l’équipe Réseaux Complexes du LIP6 et sa responsable d’équipe actuelle, Clémence Magnien, qui m’ont accueilli à bras ouverts, accom- pagné à chaque étape et dont j’ai pu découvrir les thématiques et les méthodes de travail au fil des rencontres et des discussions.
    [Show full text]
  • Symantec White Paper
    QUARTERLY REPORT: SYMANTEC ENTERPRISE SECURITY SYMANTEC REPORT: QUARTERLY Symantec Intelligence Quarterly July - September, 2009 Published October 2009 Technical Brief: Symantec Enterprise Security Symantec Intelligence Quarterly July - September, 2009 Contents Introduction . 1 Highlights . 2 Metrics. 2 Meeting the Challenge of Sophisticated Attacks . 8 Timeline of a zero-day event . 8 How secure are security protocols?. 11 Why attackers use packers. 14 Protection and Mitigation . 16 Appendix A—Best Practices . 18 Appendix B—Methodologies. 20 Credits . 24 Symantec Intelligence Quarterly July - September, 2009 Introduction Symantec has established some of the most comprehensive sources of Internet threat data in the world through the Symantec™ Global Intelligence Network. More than 240,000 sensors in over 200 countries monitor attack activity through a combination of Symantec products and services such as Symantec DeepSight™ Threat Management System, Symantec™ Managed Security Services and Norton™ consumer products, as well as additional third-party data sources. Symantec also gathers malicious code intelligence from more than 130 million client, server, and gateway systems that have deployed its antivirus products. Additionally, the Symantec distributed honeypot network collects data from around the globe, capturing previously unseen threats and attacks and providing valuable insight into attacker methods. Spam data is captured through the Symantec probe network, a system of more than 2.5 million decoy email accounts, Symantec MessageLabs™ Intelligence, and other Symantec technologies in more than 86 countries from around the globe. Over 8 billion email messages, as well as over 1 billion Web requests, are scanned per day across 16 data centers. Symantec also gathers phishing information through an extensive antifraud community of enterprises, security vendors, and more than 50 million consumers.
    [Show full text]
  • An Introduction to Malware
    Downloaded from orbit.dtu.dk on: Sep 24, 2021 An Introduction to Malware Sharp, Robin Publication date: 2017 Document Version Publisher's PDF, also known as Version of record Link back to DTU Orbit Citation (APA): Sharp, R. (2017). An Introduction to Malware. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. Users may download and print one copy of any publication from the public portal for the purpose of private study or research. You may not further distribute the material or use it for any profit-making activity or commercial gain You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. An Introduction to Malware Robin Sharp DTU Compute Spring 2017 Abstract These notes, written for use in DTU course 02233 on Network Security, give a short introduction to the topic of malware. The most important types of malware are described, together with their basic principles of operation and dissemination, and defenses against malware are discussed. Contents 1 Some Definitions............................2 2 Classification of Malware........................2 3 Vira..................................3 4 Worms................................
    [Show full text]
  • Ilomo Botnet a Study of the Ilomo / Clampi Botnet
    Ilomo A study of the Ilomo / Clampi botnet Ilomo Botnet A study of the Ilomo / Clampi Botnet by Alice Decker: Network Analysis David Sancho: Reverse Engineering Max Goncharov: Network Analysis Robert McArdle: Project Coordinator Release Date: 20 August 2009 Classification: Public Ilomo A study of the Ilomo / Clampi botnet Table of Contents Introduction ........................................................................................................................................................... 3 Ilomo Analysis ....................................................................................................................................................... 4 Stage 1: Dropper ....................................................................................................................................... 4 Stage 2: Main Executable ........................................................................................................................ 7 Stage 3: Injected Code ............................................................................................................................ 12 VMProtect Obfuscator ........................................................................................................................................ 17 Background Information .......................................................................................................................... 17 Technical Information .............................................................................................................................
    [Show full text]
  • Ronald L. Chichester*
    30990-txb_44-1 Sheet No. 4 Side A 02/01/2012 14:53:16 ZOMBIES (DO NOT DELETE) 10/27/2011 12:39 PM SLAYING ZOMBIES IN THE COURTROOM:TEXAS ENACTS THE FIRST LAW DESIGNED SPECIFICALLY TO COMBAT BOTNETS Ronald L. Chichester* I. INTRODUCTION ............................................................................................... 2 II. WHAT IS A BOTNET? ...................................................................................... 2 III. ZOMBIFICATION—CREATING THE BOTNET ............................................ 3 IV. OTHER CURRENT COMPUTER MISUSE STATUTES ................................. 4 V. A SHORT DESCRIPTION OF THE FIRST ANTI-BOTNET STATUTE ........ 6 VI. UTILIZING S.B. 28—THE CAUSE OF ACTION ............................................ 8 VII. GATHERING THE EVIDENCE ........................................................................ 9 VIII. FINDING THE PERPETRATOR(S) .................................................................. 9 IX. CONCLUSIONS ............................................................................................... 10 X. APPENDIX A ................................................................................................... 10 30990-txb_44-1 Sheet No. 4 Side A 02/01/2012 14:53:16 * Ron Chichester is an attorney, a certified computer forensic examiner, and an Adjunct Professor at the University of Houston Law Center, where he teaches “Digital Transaction” (www.digitaltransactions.info). Ron is admitted to practice in the State of Texas, the U.S. Courts for the Southern District of
    [Show full text]
  • The Trojan Wars: Building the Big Picture to Combat Efraud
    THE TROJAN WARS: BUILDING THE BIG PICTURE TO COMBAT EFRAUD MNEMONIC THREAT INTELLIGENCE UNIT White Paper TABLE OF CONTENTS INTRODUCTION ................................................................................3 THE INITIAL TORPIG CAMPAIGN ......................................................4 • Infection Cycles ..........................................................................................5 • Ice IX – Downloading Torpig and Pushdo ...................................................6 • Torpig Campaign C&C infrastructure ..........................................................9 • Ice IX Takedown Avoidance Technique .......................................................10 THE FOLLOW-ON P2P ZEUS CAMPAIGN ..........................................11 • Infection Cycles ...........................................................................................12 • Neurevt – Downloading P2P Zeus ..............................................................13 THE WAY FORWARD: CONCLUSIONS AND RECOMMENDATIONS ....14 ABOUT MNEMONIC ..........................................................................15 REFERENCES ...................................................................................16 THE TROJAN WARS - BUILDING THE BIG PICTURE TO COMBAT EFRAUD MNEMONIC AS INTRODUCTION Trojans are a very sophisticated type of malware and their use by cybercriminals to perform widespread eFraud is now well established. They are rarely operated in a standalone mode and the infrastructure used to spread and maintain Trojans is
    [Show full text]
  • Computer Viruses, in Order to Detect Them
    Behaviour-based Virus Analysis and Detection PhD Thesis Sulaiman Amro Al amro This thesis is submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy Software Technology Research Laboratory Faculty of Technology De Montfort University May 2013 DEDICATION To my beloved parents This thesis is dedicated to my Father who has been my supportive, motivated, inspired guide throughout my life, and who has spent every minute of his life teaching and guiding me and my brothers and sisters how to live and be successful. To my Mother for her support and endless love, daily prayers, and for her encouragement and everything she has sacrificed for us. To my Sisters and Brothers for their support, prayers and encouragements throughout my entire life. To my beloved Family, My Wife for her support and patience throughout my PhD, and my little boy Amro who has changed my life and relieves my tiredness and stress every single day. I | P a g e ABSTRACT Every day, the growing number of viruses causes major damage to computer systems, which many antivirus products have been developed to protect. Regrettably, existing antivirus products do not provide a full solution to the problems associated with viruses. One of the main reasons for this is that these products typically use signature-based detection, so that the rapid growth in the number of viruses means that many signatures have to be added to their signature databases each day. These signatures then have to be stored in the computer system, where they consume increasing memory space. Moreover, the large database will also affect the speed of searching for signatures, and, hence, affect the performance of the system.
    [Show full text]
  • Software Analysis for Security
    Software Analysis for Security Spiros Mancoridis Department of Computer Science College of Engineering Drexel University Philadelphia, PA 19147, USA E-mail: [email protected] Abstract ware architecture to assure the system’s security. The qual- ity of a security architecture, however, also depends on the This is a survey of the processes, practices, and technolo- security of the applications that constitute the system. In gies that can help software maintenance engineers improve low security operating environments, such as most commer- the security of software systems. A particular emphasis is cial operating systems, it is assumed, albeit optimistically, placed on validating security architectures, verifying that that these applications are trustworthy. Therefore, it is im- the implementation of an architecture’s constituent appli- portant to articulate the practices to support the secure cod- cations adhere to secure coding practices, and protecting ing of applications and the tools for detecting malware. Se- software systems against malicious software. In addition to cure coding involves programming practices and run-time surveying the state-of-the-art, research challenges pertain- mechanisms that can be used to limit the vulnerabilityof ap- ing to software security are posed to the software mainte- plications to dangerous malware that exploit, for example, nance research community. buffer overflows, format string vulnerabilities, and integer vulnerabilities to attack computer systems. One approach to software security is to verify that (a) the security mechanisms used are trustworthy; (b) the security 1. Introduction architecture has been validated against the security policy; and (c) the software applications that constitute the system The goal of computer security is to protect computer as- are trustworthy (e.g., they have been developed using secure sets (e.g., servers, applications, web pages, data) from cor- coding practices, or they are not malware).
    [Show full text]
  • Dgarchive a Deep Dive Into Domain Generating Malware
    DGArchive A deep dive into domain generating malware Daniel Plohmann [email protected] 2015-12-03 | Botconf, Paris © 2015 Fraunhofer FKIE 1 About me Daniel Plohmann PhD candidate at University of Bonn, Germany Security Researcher at Fraunhofer FKIE Focus: Reverse Engineering / Malware Analysis / Automation Projects ENISA Botnet Study 2011 [1] Analysis Tools PyBox, IDAscope, DGArchive, … Botnet Analysis Gameover Zeus / P2P protocols [2] DGA-based Malware [1] http://www.enisa.europa.eu/act/res/botnets/botnets-measurement-detection-disinfection-and-defence [2] http://christian-rossow.de/publications/p2pwned-ieee2013.pdf © 2015 Fraunhofer FKIE 2 Agenda Intro: Domain Generation Algorithms / DGArchive Comparison of DGA Features Registration Status of DGA Domain Space Case Studies © 2015 Fraunhofer FKIE 3 Intro Domain Generation Algorithms © 2015 Fraunhofer FKIE 4 Domain Generation Algorithms Definitions Concept first described ~2008: Domain Flux Domain Generation Algorithm (DGA) An algorithm producing Command & Control rendezvous points dynamically Shared secret between malware running on compromised host and botmaster Seeds Collection of parameters influencing the output of the algorithm Algorithmically-Generated Domain (AGD) Domains resulting from a DGA © 2015 Fraunhofer FKIE 5 Domain Generation Algorithms Origin & History Feb 2006 Sality: dynamically generates 3rd-level domain part July 2007 Torpig: Report by Verisign includes DGA-like domains July 2007 Kraken: VirusTotal upload of binary using DDNS
    [Show full text]