CONTENTS in THIS ISSUE Fighting Malware and Spam
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G
Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G. van Eeten, Delft University of Technology https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/asghari This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere and Michel J.G. van Eeten Delft University of Technology Abstract more sophisticated C&C mechanisms that are increas- ingly resilient against takeover attempts [30]. Research on botnet mitigation has focused predomi- In pale contrast to this wealth of work stands the lim- nantly on methods to technically disrupt the command- ited research into the other side of botnet mitigation: and-control infrastructure. Much less is known about the cleanup of the infected machines of end users. Af- effectiveness of large-scale efforts to clean up infected ter a botnet is successfully sinkholed, the bots or zom- machines. We analyze longitudinal data from the sink- bies basically remain waiting for the attackers to find hole of Conficker, one the largest botnets ever seen, to as- a way to reconnect to them, update their binaries and sess the impact of what has been emerging as a best prac- move the machines out of the sinkhole. This happens tice: national anti-botnet initiatives that support large- with some regularity. The recent sinkholing attempt of scale cleanup of end user machines. -
Using Malware's Self-Defence Mechanism to Harden
Using Malware’s Self-Defence Mechanism to Harden Defence and Remediation Tools Jonathan Pan Wee Kim Wee School of Communication and Information, Nanyang Technological University, Singapore [email protected] Abstract— Malware are becoming a major problem to every them to completely bypass the protection of Firewall and individual and organization in the cyber world. They are Anti-Virus. According to Filiol [30], Malware detection is a advancing in sophistication in many ways. Besides their NP-hard problem. Besides the fact that these defences are advanced abilities to penetrate and stay evasive against detection becoming ineffective against Malware, these defences are also and remediation, they have strong resilience mechanisms that becoming victims of attacks by Malware as part of the latter’s are defying all attempts to eradicate them. Malware are also attacking defence of the systems and making them defunct. self-preservation strategy [21], [27]. The starting point of this When defences are brought down, the organisation or individual cyber problem with Malware is their ability to infiltrate. This will lose control over the IT assets and defend against the is typically done through the weakest link in the defence Malware perpetuators. In order to gain the capability to defend, strategy due to humans are involved. One went as far as to it is necessary to keep the defences or remediation tools active comment that it is people’s stupidity that led to security lapses and not defunct. Given that Malware have proven to be resilient [7]. Malware will inevitably infiltrate past the defences and against deployed defences and remediation tools, the proposed when they do, it is essential to quickly contain these Malware research advocates to utilize the techniques used by Malware to before they induce greater damages to the organizations. -
Iptrust Botnet / Malware Dictionary This List Shows the Most Common Botnet and Malware Variants Tracked by Iptrust
ipTrust Botnet / Malware Dictionary This list shows the most common botnet and malware variants tracked by ipTrust. This is not intended to be an exhaustive list, since new threat intelligence is always being added into our global Reputation Engine. NAME DESCRIPTION Conficker A/B Conficker A/B is a downloader worm that is used to propagate additional malware. The original malware it was after was rogue AV - but the army's current focus is undefined. At this point it has no other purpose but to spread. Propagation methods include a Microsoft server service vulnerability (MS08-067) - weakly protected network shares - and removable devices like USB keys. Once on a machine, it will attach itself to current processes such as explorer.exe and search for other vulnerable machines across the network. Using a list of passwords and actively searching for legitimate usernames - the ... Mariposa Mariposa was first observed in May 2009 as an emerging botnet. Since then it has infected an ever- growing number of systems; currently, in the millions. Mariposa works by installing itself in a hidden location on the compromised system and injecting code into the critical process ͞ĞdžƉůŽƌĞƌ͘ĞdžĞ͘͟/ƚŝƐknown to affect all modern Windows versions, editing the registry to allow it to automatically start upon login. Additionally, there is a guard that prevents deletion while running, and it automatically restarts upon crash/restart of explorer.exe. In essence, Mariposa opens a backdoor on the compromised computer, which grants full shell access to ... Unknown A botnet is designated 'unknown' when it is first being tracked, or before it is given a publicly- known common name. -
Chapter 1 Practical Investigative Strategies
i “Davidhoff” — 2012/5/16 — 16:26 — page 3 — #1 i i i Chapter 1 Practical Investigative Strategies ‘‘A victorious army first wins and then seeks battle; a defeated army first battles and then seeks victory.’’ ---Sun Tsu, The Art of War1 Evidence scattered around the world. Not enough time. Not enough staff. Unrealistic expectations. Internal political conflicts. Gross underestimation of costs. Mishandling of evidence. Too many cooks in the kitchen. Network forensic investigations can be tricky. In addition to all the challenges faced by traditional investigators, network forensics investiga- tors often need to work with unfamiliar people in different countries, learn to interact with obscure pieces of equipment, and capture evidence that exists only for fleeting moments. Laws surrounding evidence collection and admissibility are often vague, poorly understood, or nonexistent. Frequently, investigative teams find themselves in situations where it is not clear who is in charge, or what the team can accomplish. An organized approach is key to a successful investigation. While this book is primar- ily designed to explore technical topics, in this chapter, we touch on the fundamentals of investigative management. This is particularly important because network forensics inves- tigations often involve coordination between multiple groups and evidence that may be scattered around the globe. We begin by presenting three cases from different industries in order to give you some examples of how network forensics is used to support investigations in the real world. Next, we explore the fundamentals of evidence collection and distinctions that are made between different types of evidence in many courts. We discuss the challenges specific to network- based evidence, such as locating evidence on a network and questions of admissibility. -
Software Analysis for Security
Software Analysis for Security Spiros Mancoridis Department of Computer Science College of Engineering Drexel University Philadelphia, PA 19147, USA E-mail: [email protected] Abstract ware architecture to assure the system’s security. The qual- ity of a security architecture, however, also depends on the This is a survey of the processes, practices, and technolo- security of the applications that constitute the system. In gies that can help software maintenance engineers improve low security operating environments, such as most commer- the security of software systems. A particular emphasis is cial operating systems, it is assumed, albeit optimistically, placed on validating security architectures, verifying that that these applications are trustworthy. Therefore, it is im- the implementation of an architecture’s constituent appli- portant to articulate the practices to support the secure cod- cations adhere to secure coding practices, and protecting ing of applications and the tools for detecting malware. Se- software systems against malicious software. In addition to cure coding involves programming practices and run-time surveying the state-of-the-art, research challenges pertain- mechanisms that can be used to limit the vulnerabilityof ap- ing to software security are posed to the software mainte- plications to dangerous malware that exploit, for example, nance research community. buffer overflows, format string vulnerabilities, and integer vulnerabilities to attack computer systems. One approach to software security is to verify that (a) the security mechanisms used are trustworthy; (b) the security 1. Introduction architecture has been validated against the security policy; and (c) the software applications that constitute the system The goal of computer security is to protect computer as- are trustworthy (e.g., they have been developed using secure sets (e.g., servers, applications, web pages, data) from cor- coding practices, or they are not malware). -
Computer Viruses and Malware Advances in Information Security
Computer Viruses and Malware Advances in Information Security Sushil Jajodia Consulting Editor Center for Secure Information Systems George Mason University Fairfax, VA 22030-4444 email: [email protected] The goals of the Springer International Series on ADVANCES IN INFORMATION SECURITY are, one, to establish the state of the art of, and set the course for future research in information security and, two, to serve as a central reference source for advanced and timely topics in information security research and development. The scope of this series includes all aspects of computer and network security and related areas such as fault tolerance and software assurance. ADVANCES IN INFORMATION SECURITY aims to publish thorough and cohesive overviews of specific topics in information security, as well as works that are larger in scope or that contain more detailed background information than can be accommodated in shorter survey articles. The series also serves as a forum for topics that may not have reached a level of maturity to warrant a comprehensive textbook treatment. Researchers, as well as developers, are encouraged to contact Professor Sushil Jajodia with ideas for books under this series. Additional tities in the series: HOP INTEGRITY IN THE INTERNET by Chin-Tser Huang and Mohamed G. Gouda; ISBN-10: 0-387-22426-3 PRIVACY PRESERVING DATA MINING by Jaideep Vaidya, Chris Clifton and Michael Zhu; ISBN-10: 0-387- 25886-8 BIOMETRIC USER AUTHENTICATION FOR IT SECURITY: From Fundamentals to Handwriting by Claus Vielhauer; ISBN-10: 0-387-26194-X IMPACTS AND RISK ASSESSMENT OF TECHNOLOGY FOR INTERNET SECURITY.'Enabled Information Small-Medium Enterprises (TEISMES) by Charles A. -
What Are Kernel-Mode Rootkits?
www.it-ebooks.info Hacking Exposed™ Malware & Rootkits Reviews “Accessible but not dumbed-down, this latest addition to the Hacking Exposed series is a stellar example of why this series remains one of the best-selling security franchises out there. System administrators and Average Joe computer users alike need to come to grips with the sophistication and stealth of modern malware, and this book calmly and clearly explains the threat.” —Brian Krebs, Reporter for The Washington Post and author of the Security Fix Blog “A harrowing guide to where the bad guys hide, and how you can find them.” —Dan Kaminsky, Director of Penetration Testing, IOActive, Inc. “The authors tackle malware, a deep and diverse issue in computer security, with common terms and relevant examples. Malware is a cold deadly tool in hacking; the authors address it openly, showing its capabilities with direct technical insight. The result is a good read that moves quickly, filling in the gaps even for the knowledgeable reader.” —Christopher Jordan, VP, Threat Intelligence, McAfee; Principal Investigator to DHS Botnet Research “Remember the end-of-semester review sessions where the instructor would go over everything from the whole term in just enough detail so you would understand all the key points, but also leave you with enough references to dig deeper where you wanted? Hacking Exposed Malware & Rootkits resembles this! A top-notch reference for novices and security professionals alike, this book provides just enough detail to explain the topics being presented, but not too much to dissuade those new to security.” —LTC Ron Dodge, U.S. -
Malware Primer Malware Primer
Malware Primer Malware Primer Table of Contents Introduction Introduction ...........................................................................................................................................................................2 In The Art of War, Sun Tzu wrote, “If you know the enemy and know yourself, you need not fear the result of a hundred battles.” This certainly applies Chapter 1: A Brief History of Malware—Its Evolution and Impact ..............................3 to cyberwarfare. This primer will help you get to know cybercriminals by providing you with a solid foundation in one of their principle weapons: Chapter 2: Malware Types and Classifications ....................................................................................8 malware. Chapter 3: How Malware Works—Malicious Strategies and Tactics ........................11 Our objective here is to provide a baseline of knowledge about the different types of malware, what malware is capable of, and how it’s distributed. Chapter 4: Polymorphic Malware—Real Life Transformers .............................................14 Because effectively protecting your network, users, data, and company from Chapter 5: Keyloggers and Other Password Snatching Malware ...............................16 malware-based attacks requires an understanding of the various ways that the enemy is coming at you. Chapter 6: Account and Identity Theft Malware ...........................................................................19 Keep in mind, however, that we’re only able here -
Quantifying Complexity and Code Reuse in Malware Development Alejandro Calleja, Juan Tapiador, and Juan Caballero
1 The MalSource Dataset: Quantifying Complexity and Code Reuse in Malware Development Alejandro Calleja, Juan Tapiador, and Juan Caballero Abstract—During the last decades, the problem of malicious platforms as soon as these acquired a substantial user base, and unwanted software (malware) has surged in numbers and such as the recent case of smartphones [7]. sophistication. Malware plays a key role in most of today’s cyber attacks and has consolidated as a commodity in the underground The surge in number, sophistication, and repercussion of economy. In this work, we analyze the evolution of malware malware attacks has gone hand in hand with much research, from 1975 to date from a software engineering perspective. We both industrial and academic, on defense and analysis tech- analyze the source code of 456 samples from 428 unique families niques. The majority of such investigations have focused on and obtain measures of their size, code quality, and estimates of the development costs (effort, time, and number of people). Our binary analysis, since most malware samples distribute in results suggest an exponential increment of nearly one order of this form. Only very rarely researchers have access to the magnitude per decade in aspects such as size and estimated effort, source code and can report insights gained from its inspection. with code quality metrics similar to those of benign software. (Notable exceptions include the analysis of the source code of We also study the extent to which code reuse is present in our 4 IRC bots by Barford and Yegneswaran [8] and the work of dataset. -
Université Batna 2 – Mostefa Ben Boulaïd Thèse Doctorat En
République Algérienne Démocratique et Populaire Ministère de l’Enseignement Supérieur et de la Recherche Scientifique Université Batna 2 – Mostefa Ben Boulaïd Faculté de Technologie Département de Génie Industriel Thèse Préparée au sein du laboratoire d’Automatique & Productique Présentée pour l’obtention du diplôme de : Doctorat en Sciences en Génie Industriel Option : Génie Industriel Sous le Thème : An Optimized Approach to Software Security via Malware Analysis Présentée par : OURLIS Lazhar Devant le jury composé de : M. ABDELHAMID Samir MCA Université de Batna 2 Président M. BELLALA Djamel MCA Université de Batna 2 Rapporteur Mme. BOUAME Souhila MCA Université de Batna 2 Examinateur M.DJEFFAL Abdelhamid MCA Université de Biskra Examinateur M.KAHLOUL Laid Prof Université de Biskra Examinateur M. BENMOHAMMED Mohamed Prof Université de Constantine 2 Examinateur Novembre 2020 To my parents and family Contents List of Figures. .I List of Tables. .II Program Listings. III Abbreviations. IV Publications. .V Acknowledgements. .VI Abstract. VII Chapter 1 Introduction ...................................................................................................................... 1 1.1 Motivation for the research ............................................................................................ 3 1.2 Thesis scope .................................................................................................................... 3 1.3 Thesis outline ................................................................................................................. -
A Politics of Cybersecurity
Malware Ecologies: A Politics of Cybersecurity Submitted in partial fulfilment of the requirements for the degree of Doctor of Philosophy Andrew Carl Dwyer Mansfield College University of Oxford Trinity 2019 Abstract Computation, in popular imaginations, is at perennial risk of infection from the tools of nefarious hackers, commonly referred to as malware. Today, malware pervade and perform a crucial and constitutive role in the insecurities of contemporary life from financial transactions, to ‘critical national infrastructures’ – such as electricity, water, and transportation – to devices in our ‘smart’ homes and cities, and even to potential ‘cyberwar.’ Yet, critical security research has rarely turned its attention to malware. In contrast, I explore malware and their politics, situated and extended beyond, an (auto)ethnographic study of the malware analysis laboratory of the UK endpoint protection business, Sophos. I argue that malware are currently processed through a patho-logic that conflate organic and non-organic materialities, permitting analogies between biology and computation, and are generative of particular forms of security that relegate malware to the intent of their authors. I explore how endpoint protection businesses are imbibed with these logics in order to attend to how malware are analysed, detected, and curated beyond them. By drawing on my method of ‘becoming-analyst,’ I critically reflect on how malware become known, are responded to by ad hoc political groups, and can assist in rethinking the role of computational agency in geography, international relations, security studies, and beyond. I instead conceive of malware as performative political actors making limited choices in broader computational ecologies. I therefore advocate for an eco-logical repositioning of malware, where cyberspace is not simply a neutral domain; but is central to the formation of choice that gives space for malware to be political. -
E©RIME ®EVOLUTION
e©RIME ®EVOLUTION Dani Creus | @them0ux Marc Rivero | @seifreed Security Researcher Senior eCrime Global Research & Analysis Team IT Ers Kaspersky Lab Deloitte | CyberSOC CONTEXTO ‣ MOTIVACIONES ‣ OFF-LINE/ONLINE ‣ ACTORES Y VÍCTIMAS ‣ TÉCNICAS, TÁCTICAS y PROCEDIMIENTOS ‣ MALWARE !! ‣ COMUNIDADES Epoca Romántica (198X-2000) ‣ CONOCIMIENTO, SUPERACIÓN ‣ INDIVIDUALISTAS, GRUPOS REDUCIDOS ‣ OBJETIVOS (EXCEPCIONES) ‣ COMUNIDADES 1.0 (BBS, IRC) ‣ OFF-LINE / ONLINE NUMB3RS ‣ ;1234567891234567=152024041234567891234? The only limit is your imagination! Originals designs can be designed from any country worldwide, and in any language of your choice... from Scuba instructor, Warranty, Security, Massage Therapist, Auto Mechanic Instructor, Business License, Award, Real Estate, Degree and Diploma Certificates. Various Degrees, Ordained Minister, Royalty Titles, Kung Fu Master, Club Member, Library, Scuba Diver, International Driver, Frequent Flyer, Novelty Id Cards, Fake Driver License, Driver Permits, Security Social Card, New Identity, Membership cards, CIA, DEA, FBI, Private Detective, Bondsman, Bounty Hunter, Casino, Press, Access Cards and much more...or virtually any kind of product you desire. MALWARE (198X - 2000) CARACTER “EXPERIMENTAL” AUTO-REPRODUCCIÓN 1995 : CONCEPT (M) POLIMORFISMO 1998 : CIH, NETBUS (R) MACRO VIRUSES 1999 : HAPPY99, MELISSA, RATS SUB7,BACKORIFFICE (R) 2000 : ILOVEYOU (VBS) FIRMAS ESTÁTICAS AVP: (GUI / SOFTWARE + DB) NUEVOS FORMATOS/SISTEMAS ANTIVIRUS DIALERS ‣ MODIFICAN CONEXIÓN TELEFÓNICA 806 ‣ TARIFICACIÓN PREMIUM/INTERNACIONAL