Malware Xiaowei Yang Previous Lecture

590.05 Lecture 5: Malware Xiaowei Yang Previous lecture

• Accountability

• OS security Today

• Malware Malware: Malicious Software 10/21/13 Malware

4 Viruses, Worms, Trojans, Rootkits • Malware can be classiﬁed into several categories, depending

on propagaon and concealment • Propagaon 10/21/13 • Virus: human-assisted propagaon (e.g., open email aachment) • Worm: automac propagaon without human assistance Malware • Concealment • Rootkit: modiﬁes operang system to hide its existence • Trojan: provides desirable funconality but hides malicious operaon • Various types of payloads, ranging from annoyance to crime

5 Insider Attacks

• An insider aack is a security breach that is caused or facilitated by someone who is a part of the very organizaon

that controls or builds the asset that should be protected.

• In the case of malware, an insider aack refers to a security 10/21/13 hole that is created in a soware system by one of its

programmers. Malware

6 Backdoors

• A backdoor, which is also somemes called a trapdoor, is a hidden feature or command in a program that allows a user to perform

acons he or she would not normally be allowed to do.

• When used in a normal way, this program performs completely as 10/21/13 expected and adversed.

• But if the hidden feature is acvated, the program does something Malware unexpected, oen in violaon of security policies, such as performing a privilege escalaon. • Benign example: Easter Eggs in DVDs and soware

An Easter egg is an intenonal inside joke, hidden message, or feature in a work such as a computer program, movie, book, or 7 crossword. Logic Bombs

• A logic bomb is a program that performs a malicious acon as a result of a certain logic condion. • The classic example of a logic bomb is a programmer coding up the soware for the payroll system who puts in code that makes the program crash should it ever process two consecuve payrolls without 10/21/13 paying him. • Another classic example combines a logic bomb with a backdoor, where a programmer puts in a logic bomb that will crash the program Malware on a certain date.

8 The Omega Engineering Logic Bomb • An example of a logic bomb that was actually triggered and caused damage is one that programmer Tim Lloyd was

convicted of using on his former employer, Omega

Engineering Corporaon. On July 31, 1996, a logic bomb was 10/21/13 triggered on the server for Omega Engineering’s manufacturing operaons, which ulmately cost the company Malware millions of dollars in damages and led to it laying oﬀ many of its employees.

9 The Omega Bomb Code

• The Logic Behind the Omega Engineering Time Bomb included the following strings: • 7/30/96 • Event that triggered the bomb • F: 10/21/13 • Focused aenon to volume F, which had crical files • F:\LOGIN\LOGIN 12345 Malware • Login a ficous user, 12345 (the back door) • CD \PUBLIC • Moves to the public folder of programs • FIX.EXE /Y F:\*.* • Run a program, called FIX, which actually deletes everything • PURGE F:\/ALL 10 • Prevent recovery of the deleted files Defenses against Insider Attacks • Avoid single points of failure.

• Use code walk-throughs. • Use archiving and reporng tools. • Limit authority and permissions. 10/21/13 • Physically secure crical systems. Malware • Monitor employee behavior. • Control soware installaons.

11 Computer Viruses

• A computer virus is computer code that can replicate itself by modifying other ﬁles or programs to insert code that is

capable of further replicaon.

• This self-replicaon property is what disnguishes computer 10/21/13 viruses from other kinds of malware, such as logic bombs.

• Another disnguishing property of a virus is that replicaon Malware requires some type of user assistance, such as clicking on an email aachment or sharing a USB drive.

12 Biological Analogy • Computer viruses share some properes with Biological viruses

10/21/13 Malware

Aack Penetraon

Replicaon and assembly Release Early History l1972 sci-ﬁ novel “When HARLIE Was One” features a program called VIRUS that reproduces itself

lFirst academic use of term virus by PhD student Fred Cohen in 1984, who credits advisor Len Adleman with 10/21/13 coining it Malware lIn 1982, high-school student Rich Skrenta wrote ﬁrst virus released in the wild: Elk Cloner, a boot sector virus l(c)Brain, by Basit and Amjood Farooq Alvi in 1986,

credited with being the ﬁrst virus to infect PCs 14 Virus Phases

• Dormant phase. During this phase, the virus just exists—the virus is laying low and avoiding detecon.

• Propagaon phase. During this phase, the virus is replicang

itself, infecng new ﬁles on new systems. 10/21/13 • Triggering phase. In this phase, some logical condion causes

the virus to move from a dormant or propagaon phase to Malware perform its intended acon. • Acon phase. In this phase, the virus performs the malicious acon that it was designed to perform, called payload. • This acon could include something seemingly innocent, like displaying a silly picture on a computer’s screen, or something quite malicious, such as deleng all essenal ﬁles on the hard 15 drive. Infection Types

• Overwring original code • Destroys original code

• Pre-pending virus

• Keeps original code, possibly 10/21/13 compressed • Infecon of libraries Malware • Allows virus to be memory compressed resident • E.g., kernel32.dll • Macro viruses • Infects MS Oﬃce documents • Oen installs in main document template 16 Degrees of Complication

• Viruses have various degrees of complicaon in how they can insert themselves in computer code.

10/21/13 Malware

17 Concealment

• Encrypted virus • Decrypon engine + encrypted body

• Randomly generate encrypon key

• Detecon looks for decrypon engine 10/21/13 • Polymorphic virus • Encrypted virus with random variaons of the decrypon engine (e.g., Malware padding code) • Detecon using CPU emulator • Metamorphic virus • Diﬀerent virus bodies • Approaches include code permutaon and instrucon replacement • Challenging to detect 18 Encrypted Viruses Computer Worms

• A computer worm is a malware program that spreads copies of itself without the need to inject itself in other programs,

and usually without human interacon.

• Thus, computer worms are technically not computer viruses 10/21/13 (since they don’t infect other programs), but some people

nevertheless confuse the terms, since both spread by self- Malware replicaon. • In most cases, a computer worm will carry a malicious payload, such as deleng ﬁles or installing a backdoor.

20 Early History

lFirst worms built in the labs of John Shock and Jon

Hepps at Xerox PARC in the early 80s

lCHRISTMA EXEC wrien in REXX, released in 10/21/13 December 1987, and targeng IBM VM/CMS

systems was the ﬁrst worm to use e-mail service Malware lThe ﬁrst internet worm was the Morris Worm, wrien by Cornell student Robert Tappan Morris and released on November 2, 1988

21 Worm Development

• Idenfy vulnerability sll • Worm template unpatched – Generate target list

• Write code for – For each host on target list

– Exploit of vulnerability • Check if infected 10/21/13 • Check if vulnerable – Generaon of target list • Infect

• Random hosts on the internet Malware • Recur • Hosts on LAN • Divide-and-conquer • Distributed graph search – Installaon and execuon of algorithm payload – Forward edges: infecon – Querying/reporng if a host is – Back edges: already infected or infected not vulnerable • Inial deployment on botnet 22 Worm Propagation • Worms propagate by ﬁnding and infecng vulnerable hosts. • They need a way to tell if a host is vulnerable • They need a way to tell if a host is already infected.

10/21/13 Malware inial infecon

23 Propagation: Theory

l Classic epidemic model Source: Cliﬀ C. Zou, Weibo Gong, Don Towsley, and • N: total number of vulnerable Lixin Gao.

hosts The Monitoring and Early Detecon of Internet Worms, IEEE/ACM Transacons on • I(t): number of infected hosts at Networking, 2005. me t 10/21/13 • S(t): number of suscepble hosts at me t Malware • I(t) + S(t) = N • β: infecon rate l Diﬀerenal equaon for I(t): dI/dt = βI(t) S(t) l More accurate models adjust propagaon rate over me 24 Propagation: Practice

• Cumulave total of unique IP addresses infected by the ﬁrst

outbreak of Code-RedI v2 on July 19-20, 2001

Source: 10/21/13 David Moore, Colleen Shannon, and Jeﬀery Brown. Malware Code-Red: a case study on the spread and vicms of an Internet worm, CAIDA, 2002

25 Trojan Horses • A Trojan horse (or Trojan) is a malware program that appears to perform some useful task, but which also does something with negave consequences (e.g., launches a keylogger).

• Trojan horses can be installed as part of the payload of other malware but are oen installed by a user or administrator, either deliberately or accidentally. 10/21/13 Malware

26 Current Trends

• Trojans currently have largest infecon potenal • Oen exploit browser vulnerabilies

• Typically used to download other malware in mul-stage aacks

Source: 10/21/13 Symantec Internet

Security Threat Malware Report, April 2009

27 Rootkits

• A rootkit modifies the operang system to hide its existence – E.g., modifies file system exploraon ulies

– Hard to detect using soware that relies on the OS itself

• Rootkit Revealer 10/21/13 – By Bryce Cogswell and Mark Russinovich (Sysinternals) Malware – Two scans of ﬁle system – High-level scan using the Windows API – Raw scan using disk access methods – Discrepancy reveals presence of rootkit – Could be defeated by rootkit that intercepts and modiﬁes results of raw scan operaons 28 Malware Zombies • Malware can turn a computer in to a zombie, which is a machine that is controlled externally to perform

malicious aacks, usually as a part of a botnet. Botnet Controller (Aacker) 10/21/13

Aack Commands

Botnet:

Aack Acons 29

Vicm Financial Impact

l Malware oen aﬀects a large user populaon Source:(Computer(

Economics( l Signiﬁcant ﬁnancial impact, though esmates vary widely, up to $100B per year (mi2g) !$15B! 10/21/13 l Examples Malware ¡ LoveBug (2000) caused $8.75B in !$10B! damages and shut down the Brish parliament !$5B! ¡ In 2004, 8% of emails infected by W32/MyDoom.A at its peak !$! ¡ In February 2006, the Russian 1997! 1999! 2001! 2003! 2005! Stock Exchange was taken down 30 by a virus. Economics of Malware

• Source: New malware threats Symantec Internet

have grown from 20K to Security Threat Report, April 2009

1.7M in the period 10/21/13 2002-2008

• Most of the growth has Malware been from 2006 to 2008 • Number of new threats per year appears to be growing an exponenal rate. 31 Professional Malware

• Growth in professional cybercrime and online fraud has led to demand for professionally developed

malware

• New malware is oen a custom- 10/21/13 designed variaons of known exploits, so the malware designer can sell diﬀerent “products” to his/ Malware her customers. • Like every product, professional malware is subject to the laws of supply and demand. • Recent studies put the price of a soware keystroke logger at $23 and a botnet use at $225. 32 Image by User:SilverStar from hp://commons.wikimedia.org/wiki/File:Supply-demand-equilibrium.svg used by permission under the Creave Commons Aribuon ShareAlike 3.0 License Adware Adware soware payload Computer user Adware engine infects a user’s computer

10/21/13 Adware engine requests adversements

Adversers contract with from adware agent Malware adware agent for content

Adware agent delivers ad content to user Adware agent 33 Adversers Spyware

Spyware soware payload Computer user 1. Spyware engine infects a user’s computer.

10/21/13

2. Spyware process collects keystrokes, passwords, and screen captures. Malware

3. Spyware process periodically sends collected data to spyware data collecon agent.

Spyware data collecon agent Signatures: A Malware Countermeasure

• Scan compare the analyzed object with a database of signatures

• A signature is a virus ﬁngerprint – E.g.,a string with a sequence of instrucons speciﬁc for each virus

– Diﬀerent from a digital signature 10/21/13 • A ﬁle is infected if there is a signature inside its code – Fast paern matching techniques to search for signatures Malware • All the signatures together create the malware database that usually is proprietary

35 Signatures Database

• Common Malware Enumeraon (CME)

– aims to provide unique, common idenﬁers to new 10/21/13 virus threats

– Hosted by MITRE Malware – hp://cme.mitre.org/ data/list.html • Digital Immune System (DIS) – Create automacally new signatures

36 White/Black Listing

• Maintain database of cryptographic hashes for • Operang system ﬁles

• Popular applicaons

• Known infected ﬁles 10/21/13 • Compute hash of each ﬁle • Look up into database Malware • Needs to protect the integrity of the database

37 Heuristic Analysis

• Useful to idenfy new and “zero day” malware

• Code analysis – Based on the instrucons, the anvirus can determine whether or not the program is malicious, i.e., program contains instrucon to 10/21/13 delete system ﬁles, Malware • Execuon emulaon – Run code in isolated emulaon environment – Monitor acons that target ﬁle takes – If the acons are harmful, mark as virus • Heurisc methods can trigger false alarms 38 Shield vs. On-demand

• Shield On-demand • Background process • Scan on explicit user request or (service/daemon) according to regular schedule • On a suspicious ﬁle, directory, • Scans each me a ﬁle is drive, etc. 10/21/13 touched (open, copy,

execute, etc.) Malware

Performance test of scan techniques o Comparave: check the number of already known viruses that are found and the me to perform the scan o Retrospecve: test the proacve detecon of the scanner for unknown viruses, to verify which vendor uses beer heuriscs An-viruses are ranked using both parameters: hp://www.av-comparaves.org/ 39 Online vs Ofline Anti Virus Software

Online Offline • • Free browser plug-in Paid annual subscripon • Authencaon through third • Installed on the OS party cerficate (i.e. VeriSign) • Soware distributed securely by 10/21/13 • No shielding the vendor online or a retailer • Soware and signatures update • System shielding Malware at each scan • Scheduled soware and • Poorly configurable signatures updates • Scan needs internet connecon • Easily configurable • Report collected by the company • Scan without internet connecon that offers the service • Report collected locally and may 40 be sent to vendor Quarantine

• A suspicious ﬁle can be isolated in a folder called quaranne:

– E.g,. if the result of the heurisc analysis is posive and you are waing for db signatures update 10/21/13 • The suspicious ﬁle is not deleted but made harmless: the user can

decide when to remove it or eventually restore for a false posive Malware – Interacng with a ﬁle in quaranne it is possible only through the anvirus program • The ﬁle in quaranne is harmless because it is encrypted • Usually the quaranne technique is proprietary and the details are kept secret 41 Static vs. Dynamic Analysis

Stac Analysis Dynamic Analysis • Checks the code without trying to • Check the execuon of codes inside a

execute it virtual sandbox • Quick scan in white list • Monitor

• Filtering: scan with different anvirus – File changes 10/21/13 and check if they return same result – Registry changes with different name – Processes and threads Malware • Weeding: remove the correct part of – Networks ports files as junk to beer idenfy the virus • Code analysis: check binary code to understand if it is an executable, e.g., PE • Disassembling: check if the byte code shows something unusual 42 Virus Detection is Undecidable

• Theorecal result by Fred • Suppose program

Cohen (1987) isVirus(P) determines whether program P is a • Virus abstractly modeled virus 10/21/13 as program that • Deﬁne new program Q eventually executes infect as follows: Malware • Code for infect may be if (not isVirus(Q)) generated at runme infect • Proof by contradicon stop similar to that of the • Running isVirus on Q halng problem achieves a contradicon 43 Other Undecidable Detection Problems

• Detecon of a virus – by its appearance – by its behavior • Detecon of an evoluon of a known virus • Detecon of a triggering mechanism 10/21/13 – by its appearance

– by its behavior Malware • Detecon of a virus detector – by its appearance – by its behavior • Detecon of an evoluon of – a known virus – a known triggering mechanism – a virus detector 44 Resources

• Computer Emergency Response Team • Research center funded by the US federal government • Vulnerabilies database • Symantec 10/21/13 • Reports on malware trends • Database of malware Malware • Art of Computer Virus Research and Defense by Peter Szor