DOCSLIB.ORG

Storm Worm & Botnet Analysis

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Storm Worm & Botnet Analysis Storm Worm & Botnet Analysis Jun Zhang Security Researcher, Websense Security Labs June 2008 Websense Security Labs Introduction This month, we caught a new Worm/Trojan sample on ours labs. This worm uses email and various phishing Web sites to spread and infect computers. When the worm breaks into the system, it installs a kernel driver to protect itself. With the help of the driver, it then injects and runs malicious code from the legitimate process "services.exe". So, it can bypass firewalls easily and open a back door for the bad guys. This worm contains an SMTP client engine and a peer-to-peer client component. Obviously, these components are prepared for spamming or mass-mailing purposes. During my research, I found that this worm used various rootkit techniques to protect itself (such as hiding files, registers, ports, and the like), so it's not easily detected and removed. The worm also used a custom packer and encryption to protect itself. In the driver that the worm dropped, we learned that it employs a user-mode APC to inject malicious code (embedded) into the process named "services.exe". In this paper, I will explain the worm from three aspects: 1. The interesting things that reside in its executable file (custom packer and encryption) 2. Rootkit techniques it uses 3. Peer-to-peer botnet & spamming Okay, let’s start our journey. Overview When this worm is running, it unpacks itself first, and then drops a malicious PE file that is embedded in the executable file. Then, it decrypts the malicious PE file into heap memory. When these steps are complete, the worm jumps to the heap memory (containing the malicious PE file) and executes the decrypted malicious code. This is the code that is responsible for the bad behavior. Figure 1 is a high-level view of this worm's activities: Figure 1. Overview of the worm Next, I will explain how this worm accomplishes all of this, step by step. Page 2 of 26 Websense Security Labs Analysis sequence The worm uses a custom packer and encryption to protect its binary file, so the first step it takes is to unpack and decrypt the embedded PE file. In this section, I will demonstrate how to use OllyDbg and IDA Pro to analyze the worm. Dynamic Analysis First, I use OllyDbg to debug the worm and try to dump the unpacked file. Stage 1 – Getting Start Figure 2. Main Routine of the Worm Notice that Figure 2 shows the main routine of the worm. It exports two functions: plr and wsx. The plr function is used to unpack worm-self, and wsx is the real entry point. The plr function is passed to wsx as a parameter. This function implements the custom packer used by the worm. Stage 2 – Unpack Figure 3. Calling Unpack Routine – plr After the execution path reaches the wsx function, the first thing it does is to unpack the data section, which contains the code that will be executed further. Page 3 of 26 Websense Security Labs Figure 4 shows the packed data section. Figure 4. Packed Code From Figure 4 we can see that this code does not have any actual functions and is used only to obscure its purpose. The figure below shows the same data section after it has been unpacked: Figure 5. Unpacked Code Well, it looks very nice. At this moment, we can dump the memory to a file and do a static analysis (using IDA Pro or other tools). This is my favorite way, but we can continue debugging this worm by OllyDbg and watch what it does next. In the next section, I will use the IDA Pro tool to continue exploring the worm. Page 4 of 26 Websense Security Labs Static Analysis I am very grateful for IDA Pro, which is an amazing tool. With its help, we can search every corner of the malware. Stage 1 – Decrypt & Decompress in heap memory During the analysis, I found a TEA constant – 0x9E3779B9 in the unpacked file, and after a short analysis I was sure that this worm uses a TEA algorithm to encrypt the embedded malicious PE file. Figure 6. TEA Algorithm Entire Decrypt & Decompress Routine: Figure 7. Decrypt & Decompress in Heap memory Stage 2 – Jump to Heap Memory From here, the worm has already expanded its payload (the malicious PE file) to heap memory, and the last thing it does is to fix IAT and handle relocation. Page 5 of 26 Websense Security Labs Figure 8. Fix IAT & Relocation Assuming everything is okay, the worm jumps to the heap memory to execute the malicious PE file. From that point forward, the worm can start breaking in to the system. Figure 9. Jump to Heap to execute Please compare Figure 9 with Figure 5, and note that they are the same. At this point, the execution path expands to heap memory, and in there, the worm accomplishes its evil task. Stage 3 – Drop a driver & Start Services The main purpose of the malicious PE file residing in the heap memory is to drop a driver and a P2P configuration file, and to start a Win32 service to load its driver. Page 6 of 26 Websense Security Labs Drop the driver: Figure 10. Release Driver This driver contains another malicious PE file that has been encrypted. Well, this worm carried so many PE files; what a hard worker. In the next section, I will show the technique the worm uses to inject this PE file into a system process from its driver. Page 7 of 26 Websense Security Labs Drop the P2P configuration file: Figure 11. Release Configuration File Contents of this configuration file: The worm reads other bots' information from this configuration file, and then uses this information to contact its brothers residing in the botnet. Page 8 of 26 Websense Security Labs Start a Win32 service to load its driver Figure 12. Install Service Now the worm has broken into the system. Next, I will investigate the heavy weapon that this worm uses to protect itself and bypass the firewall. This weapon is built from rootkit techniques, so in the next section we will dive deep into the Windows kernel. Page 9 of 26 Websense Security Labs The heavy weapon – Driver (rootkit technique) Figure 13. The workflow of the worm's driver As we saw earlier, this worm drops two files: a driver named “glok+<random_id>.sys” and a peer-to-peer configuration file named “glok+serv.config”. In the end, the worm starts a Win32 service to load its driver. Normally, it is difficult to find these sorts of malicious behaviors, but by intercepting the API call, we locate them with ease. API Calling Figure 14. API Call Win32 Service Figure 15. Register Changes Page 10 of 26 Websense Security Labs Worm's rootkit functionality The worm uses its driver to achieve the goals below: 1. Hide File (Avoid being deleted) 2. Hide TCP Port (Bypass the firewall) 3. Hide Win32 Service (Avoid being detected) 4. Inject Code to “services.exe” (Smart because it can easily bypass the ring3 detector) 1. Hide file or directory This worm hooks the native API named “NtQueryDirectoryFile”, so the worm can hide the file or directory whose name contains the string “glok+”. Do you remember the name of its driver that I mentioned earlier? Yes, the name of the driver is “glok+<random_id>.sys”; it contains the string – “glok+”. Code slice – Hook NtQueryDirectoryFile: Figure 16. Filter in NtQueryDirectoryFile 2. Hide Win32 Service As we know, using the Win32 service to load the kernel driver will leave some footprint in the register. So the worm hooks two register-related native APIs named “NtEnumerateKey” and “NtEnumerateValueKey”; through them the worm can erase its footprint. Code slice – Hook NtEnumerateKey: Figure 17. Filter in NtEnumerateKey Code slice – Hook NtEnumerateValueKey: Figure 18. Filter in NtEnumerateValueKey 3. Hide Port This worm will send spam and connect to other bots that are in the botnet, so it must obscure network-related things from everyone's eyes. In the kernel, the worm searches the TCP device (Device\Tcp) and inline hooks its dispatch function. When people try to query the network information, the worm hides itself from the result of the query. Inline hook TCP DeviceIoContorl functions: Page 11 of 26 Websense Security Labs Set up a completion routine for each Irps Code Slice - Hide Port: 4. Inject malicious PE to“services.exe” This worm does not use the normal way to inject the malicious code to other processes, such as through “CreateRemoteThread”. Instead, it does this from the kernel through a user-mode APC. In the injected code, the worm uses some shellcode techniques to locate the base address of kernel32.dll and do API searching by itself. The detailed steps are shown in Figure 13. Page 12 of 26 Websense Security Labs Code slice: Using user-mode APC Running in “services.exe” As mentioned earlier, the injected code is responsible for initializing the bot and joining the botnet. Page 13 of 26 Websense Security Labs Locating kernel32 && Searching APIs – often used by shellcode Start main thread Page 14 of 26 Websense Security Labs The super weapon – P2P-based botnet Overview In recent years, P2P technology has been used frequently in worms and has become more and more popular. The P2P-based botnet is very hard to trace and to shut down, because the botnet has robust network connectivity, uses encryption, and controls traffic dispersion. Each bot influences only a small part of the botnet, and upgrade/recovery is accomplished easily by its botmaster.
Load more

Recommended publications
  • Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G
    Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere, and Michel J.G. van Eeten, Delft University of Technology https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/asghari This paper is included in the Proceedings of the 24th USENIX Security Symposium August 12–14, 2015 • Washington, D.C. ISBN 978-1-939133-11-3 Open access to the Proceedings of the 24th USENIX Security Symposium is sponsored by USENIX Post-Mortem of a Zombie: Conficker Cleanup After Six Years Hadi Asghari, Michael Ciere and Michel J.G. van Eeten Delft University of Technology Abstract more sophisticated C&C mechanisms that are increas- ingly resilient against takeover attempts [30]. Research on botnet mitigation has focused predomi- In pale contrast to this wealth of work stands the lim- nantly on methods to technically disrupt the command- ited research into the other side of botnet mitigation: and-control infrastructure. Much less is known about the cleanup of the infected machines of end users. Af- effectiveness of large-scale efforts to clean up infected ter a botnet is successfully sinkholed, the bots or zom- machines. We analyze longitudinal data from the sink- bies basically remain waiting for the attackers to find hole of Conficker, one the largest botnets ever seen, to as- a way to reconnect to them, update their binaries and sess the impact of what has been emerging as a best prac- move the machines out of the sinkhole. This happens tice: national anti-botnet initiatives that support large- with some regularity. The recent sinkholing attempt of scale cleanup of end user machines.
    [Show full text]
  • Using Malware's Self-Defence Mechanism to Harden
    Using Malware’s Self-Defence Mechanism to Harden Defence and Remediation Tools Jonathan Pan Wee Kim Wee School of Communication and Information, Nanyang Technological University, Singapore [email protected] Abstract— Malware are becoming a major problem to every them to completely bypass the protection of Firewall and individual and organization in the cyber world. They are Anti-Virus. According to Filiol [30], Malware detection is a advancing in sophistication in many ways. Besides their NP-hard problem. Besides the fact that these defences are advanced abilities to penetrate and stay evasive against detection becoming ineffective against Malware, these defences are also and remediation, they have strong resilience mechanisms that becoming victims of attacks by Malware as part of the latter’s are defying all attempts to eradicate them. Malware are also attacking defence of the systems and making them defunct. self-preservation strategy [21], [27]. The starting point of this When defences are brought down, the organisation or individual cyber problem with Malware is their ability to infiltrate. This will lose control over the IT assets and defend against the is typically done through the weakest link in the defence Malware perpetuators. In order to gain the capability to defend, strategy due to humans are involved. One went as far as to it is necessary to keep the defences or remediation tools active comment that it is people’s stupidity that led to security lapses and not defunct. Given that Malware have proven to be resilient [7]. Malware will inevitably infiltrate past the defences and against deployed defences and remediation tools, the proposed when they do, it is essential to quickly contain these Malware research advocates to utilize the techniques used by Malware to before they induce greater damages to the organizations.
    [Show full text]
  • Iptrust Botnet / Malware Dictionary This List Shows the Most Common Botnet and Malware Variants Tracked by Iptrust
    ipTrust Botnet / Malware Dictionary This list shows the most common botnet and malware variants tracked by ipTrust. This is not intended to be an exhaustive list, since new threat intelligence is always being added into our global Reputation Engine. NAME DESCRIPTION Conficker A/B Conficker A/B is a downloader worm that is used to propagate additional malware. The original malware it was after was rogue AV - but the army's current focus is undefined. At this point it has no other purpose but to spread. Propagation methods include a Microsoft server service vulnerability (MS08-067) - weakly protected network shares - and removable devices like USB keys. Once on a machine, it will attach itself to current processes such as explorer.exe and search for other vulnerable machines across the network. Using a list of passwords and actively searching for legitimate usernames - the ... Mariposa Mariposa was first observed in May 2009 as an emerging botnet. Since then it has infected an ever- growing number of systems; currently, in the millions. Mariposa works by installing itself in a hidden location on the compromised system and injecting code into the critical process ͞ĞdžƉůŽƌĞƌ͘ĞdžĞ͘͟/ƚŝƐknown to affect all modern Windows versions, editing the registry to allow it to automatically start upon login. Additionally, there is a guard that prevents deletion while running, and it automatically restarts upon crash/restart of explorer.exe. In essence, Mariposa opens a backdoor on the compromised computer, which grants full shell access to ... Unknown A botnet is designated 'unknown' when it is first being tracked, or before it is given a publicly- known common name.
    [Show full text]
  • Chapter 1 Practical Investigative Strategies
    i “Davidhoff” — 2012/5/16 — 16:26 — page 3 — #1 i i i Chapter 1 Practical Investigative Strategies ‘‘A victorious army first wins and then seeks battle; a defeated army first battles and then seeks victory.’’ ---Sun Tsu, The Art of War1 Evidence scattered around the world. Not enough time. Not enough staff. Unrealistic expectations. Internal political conflicts. Gross underestimation of costs. Mishandling of evidence. Too many cooks in the kitchen. Network forensic investigations can be tricky. In addition to all the challenges faced by traditional investigators, network forensics investiga- tors often need to work with unfamiliar people in different countries, learn to interact with obscure pieces of equipment, and capture evidence that exists only for fleeting moments. Laws surrounding evidence collection and admissibility are often vague, poorly understood, or nonexistent. Frequently, investigative teams find themselves in situations where it is not clear who is in charge, or what the team can accomplish. An organized approach is key to a successful investigation. While this book is primar- ily designed to explore technical topics, in this chapter, we touch on the fundamentals of investigative management. This is particularly important because network forensics inves- tigations often involve coordination between multiple groups and evidence that may be scattered around the globe. We begin by presenting three cases from different industries in order to give you some examples of how network forensics is used to support investigations in the real world. Next, we explore the fundamentals of evidence collection and distinctions that are made between different types of evidence in many courts. We discuss the challenges specific to network- based evidence, such as locating evidence on a network and questions of admissibility.
    [Show full text]
  • Malware Primer Malware Primer
    Malware Primer Malware Primer Table of Contents Introduction Introduction ...........................................................................................................................................................................2 In The Art of War, Sun Tzu wrote, “If you know the enemy and know yourself, you need not fear the result of a hundred battles.” This certainly applies Chapter 1: A Brief History of Malware—Its Evolution and Impact ..............................3 to cyberwarfare. This primer will help you get to know cybercriminals by providing you with a solid foundation in one of their principle weapons: Chapter 2: Malware Types and Classifications ....................................................................................8 malware. Chapter 3: How Malware Works—Malicious Strategies and Tactics ........................11 Our objective here is to provide a baseline of knowledge about the different types of malware, what malware is capable of, and how it’s distributed. Chapter 4: Polymorphic Malware—Real Life Transformers .............................................14 Because effectively protecting your network, users, data, and company from Chapter 5: Keyloggers and Other Password Snatching Malware ...............................16 malware-based attacks requires an understanding of the various ways that the enemy is coming at you. Chapter 6: Account and Identity Theft Malware ...........................................................................19 Keep in mind, however, that we’re only able here
    [Show full text]
  • The Ultimate Cybersecurity Guide for the It Professional
    THE ULTIMATE CYBERSECURITY GUIDE FOR THE IT PROFESSIONAL { 01101000 01110100 01110100 01110000 01110011 00111010 00101111 00101111 01110111 01110111 01110111 00101110 01100011 01100001 01110010 01100010 01101111 01101110 01100010 01101100 01100001 01100011 01101011 00101110 01100011 01101111 01101101 } THE ULTIMATE CYBERSECURITY GUIDE FOR THE IT PROFESSIONAL 2019 Welcome to our comprehensive guide on the basics of cybersecurity. Whether you've been in IT for a long time or are just starting out, there is an expectation that everyone in IT should have some degree of expo- sure to InfoSec. A good way to do that is to learn from and get connected in the community. Cybersecurity is a fascinating and rapidly evolving area of IT. And those that are involved are friendly people who care passionately about keeping us all safe. With information from over 150 sourced references, and personal input from The Howler Hub community of security experts, this guide contains the key information to help you: • Understand key concepts that drive the security professional. • Learn a common language to engage with cybersecurity professionals. • Connect with sources to stay up-to-date on this evolving field. • Engage with cybersecurity experts and the threat hunting community at large. CONTENTS 01 02 03 History of Attackers + Common Cybersecurity Their Motives Attacks <pg num="001" /> <pg num="005" /> <pg num="007" /> 04 05 06 Terms to Know Experts to Blogs to Read <pg num="009" /> Follow <pg num="014" /> <pg num="013" /> 07 08 09 Events to Books to Read Movies + Shows Attend <pg num="017" /> to Watch <pg num="015" /> <pg num="019" /> 10 11 12 Communities Become a References to Engage Threat Hunter <pg num="023" /> <pg num="021" /> <pg num="022" /> 13 Appendices <pg num="024" /> <pg num="001" /> SEC.
    [Show full text]
  • CONTENTS in THIS ISSUE Fighting Malware and Spam
    DECEMBER 2007 Fighting malware and spam CONTENTS IN THIS ISSUE 2 COMMENT MULTI-PLATFORM A year of threats across several technologies The author of MSIL/Yakizake claimed that ‘very few implementations of multi-platform malware 3 VIRUS PREVALENCE TABLE exist up until now’. Peter Ferrie explains why Yakizake, for one, does not qualify for the category. page 5 4 NEWS Yuletide greetings MULTIMEDIA Vista fails to reassure web users Today’s Internet users are accustomed to seeing and Botnets roasting on an open fire downloading interactive multimedia content on websites. Unfortunately such content can include 4 CALL FOR PAPERS more than one might expect. Christoph Alme and Dennis Elser present a round-up of recent VB2008 Ottawa multimedia vulnerabilities. page 13 5 ANALYSIS Something smells fishy MULTIPLE PROBLEMS Fewer than half the products submitted FEATURES for this month’s VB100 comparative Dec 2007 review on Windows 2000 made the 6 Exploring the evolutionary patterns of grade, largely thanks to some pesky Tibs-packed executables polymorphic file-infecting viruses and a 10 Exepacker blacklisting part 2 rash of false positives. John Hawes has the details. 13 Blow up your video page 16 16 COMPARATIVE REVIEW Windows 2000 Professional 30 END NOTES & NEWS This month: Reza Rajabiun considers the implications of spam for developing countries and the persistence of the digital divide. ISSN 1749-7027 COMMENT ‘The main trend I time, emails containing links to the Storm worm took on many different forms, with subjects ranging from have observed this supposed missile strikes to reports of genocide and other year has been the socially engineered trapdoors.
    [Show full text]
  • CMSC 414 — Computer and Network Security Viruses and Other Malware
    CMSC 414 — Computer and Network Security Viruses and Other Malware Dr. Michael Marsh September 11, 2017 Malware Malware is any malicious software that runs on a victim’s system. General categories: Virus hides in stored code, propagates based on user action Worm hides in running code, propagates automatically Trojan immitates legitimate SW, typically propagated by attacker Some malware combines these characteristics Worms Hide on a system, running behind the scenes Try to replicate themselves onto other systems May be a stand-alone program: /etc/rc3.d/S00malservd Usually try to hide themselves from ls, ps, netstat,... Attempt to spread rapidly Trojans Run by user, but do more than advertised void game() { struct Move* m; while( m = getMove() ) { stealUserInfo(); processMove(m); } } May look similar to “real” programs I “Fileless Trojan Kovter Poses as Firefox Update,” SecurityWeek, July 2016 I “Mozilla Firefox for Mac free download. Always available from the Softonic servers” I “Angry Birds Transformers Trojan targets Android, warns ‘Obey or be hacked’,” Computerworld, October 2014 Trojans Viruses “Infect” executable files (or parts of files): I Binaries I Macros, such as in Word or Excel documents I Javascript, such as in PDF files I Boot sector, before the OS loads void func(int b) { int a = 0; if ( (a-b) > 3 ) { printf("some condition n"); \ push %eip jmp 0xbaddbadd g(); } } Attempt to evade detection Virus Features We will look at two orthogonal aspects of viruses: I How do they propagate? I What else do they do? Infection Vectors May
    [Show full text]
  • THE THREAT LANDSCAPE a Practical Guide from the Kaspersky Lab Experts Written by David Emm Senior Regional Researcher, Global Research & Analysis Team
    THE THREAT LANDSCAPE A practical guide from the Kaspersky Lab experts Written by David Emm Senior Regional Researcher, Global Research & Analysis Team With Kaspersky, now you can. kaspersky.com/business Be Ready for What’s Next ABOUT THE AUTHOR David Emm Senior Regional Researcher Global Research & Analysis Team, also known as the GReAT team David has been with Kaspersky Lab since 2004. In his role as Senior Technology Consultant, David presented information on malware and other IT threats at exhibitions and events, and provided comment to both broadcast and print media. He also provided information on Kaspersky Lab products and technologies. He was promoted to his current position in 2008. David has a particular interest in the malware ecosystem, ID theft, and Kaspersky Lab technologies, and he conceived and developed the company’s Malware Defence Workshop. David has worked in the anti-virus industry since 1990 in a variety of roles. Prior to joining Kaspersky Lab, David worked as Systems Engineer, Product Manager and Product Marketing Manager at McAfee; and before that as Technical Support Manager CONTENTS and Senior Technology Consultant at Dr Solomon’s Software. 1. The evolution of malware 2. Are you in the firing line? A new era of targeted attacks 3. Malware: now on the move as much as you are 4. How malware spreads 5. The human factor in security 6. Anti-malware technologies 7. Top tips for creating security awareness in your organization CHAPTER 1 THE EVOLUTION OF MALWARE CONTEXT INCREASING IN SCALE, INCREASING IN SEVERITY It is more than 25 years since the first PC viruses appeared.
    [Show full text]
  • Virus Bulletin, August 2001
    ISSN 0956-9979 AUGUST 2001 THE INTERNATIONAL PUBLICATION ON COMPUTER VIRUS PREVENTION, RECOGNITION AND REMOVAL Editor: Helen Martin CONTENTS Technical Consultant: Matt Ham Technical Editor: Jakub Kaminski COMMENT What’s in a Name? 2 Consulting Editors: VIRUS PREVALENCE TABLE 3 Nick FitzGerald, Independent consultant, NZ Ian Whalley, IBM Research, USA NEWS Richard Ford, Independent consultant, USA 1. Pentagon on Red Alert 3 Edward Wilding, Maxima Group Plc, UK 2. The Greatest Form of Flattery? 3 3. SirCam Heads for the Top 3 4. EICAR 2002 3 IN THIS ISSUE: LETTERS 4 • Chinese Whispers at the Whitehouse: ‘Code Red’ VIRUS ANALYSIS caused Whitehouse administrators to change the IP address Holding the Bady 5 of the official Whitehouse Web site, and even penetrated the mighty Microsoft’s own IIS servers. Costin Raiu TECHNICAL FEATURE analyses Win32/Bady.worm, starting on p.5. Pocket Monsters? 8 • CE-ing the Future: In the light of the Common Execut- FEATURES able File format introduced in Windows CE 3.0, Péter Ször warns us to be prepared for the first Windows CE worms for 1. Trust and the ASP Model 9 Pocket PCs; see p.8. 2. Security Bulletin Gazing 11 3. The Electronic Crime Scene 12 • ASP and Ye Shall Receive: Do customers trust their 4. Is it a Bird, is it a Plane? 14 AV vendor sufficiently to outsource their anti-virus protec- tion? John Bloodworth investigates the ASP model, starting INSIGHT on p.9. Up to the Challenge 16 CONFERENCE REPORT Viva Las Vegas 18 PRODUCT REVIEW F-Prot Antivirus 3.10 for Win95/98/ME 20 END NOTES AND NEWS 24 VIRUS BULLETIN ©2001 Virus Bulletin Ltd, The Pentagon, Abingdon, Oxfordshire, OX14 3YP, England.
    [Show full text]
  • 6 a Survey on Automated Dynamic Malware-Analysis Techniques And
    CSUR4402-06 ACM-TRANSACTION February 8, 2012 20:36 6 A Survey on Automated Dynamic Malware-Analysis Techniques and Tools MANUEL EGELE, Vienna University of Technology THEODOOR SCHOLTE, SAP Research, Sophia Antipolis ENGIN KIRDA, Institute Eurecom, Sophia Antipolis CHRISTOPHER KRUEGEL, University of California, Santa Barbara Anti-virus vendors are confronted with a multitude of potentially malicious samples today. Receiving thou- sands of new samples every day is not uncommon. The signatures that detect confirmed malicious threats are mainly still created manually, so it is important to discriminate between samples that pose a new unknown threat and those that are mere variants of known malware. This survey article provides an overview of techniques based on dynamic analysis that are used to analyze potentially malicious samples. It also covers analysis programs that employ these techniques to assist human analysts in assessing, in a timely and appropriate manner, whether a given sample deserves closer manual inspection due to its unknown malicious behavior. Categories and Subject Descriptors: K.6.5 [Management of Computing and Information Systems]: Security and Protection General Terms: Security Additional Key Words and Phrases: Dynamic analysis, malware ACM Reference Format: Egele, M., Scholte, T., Kirda, E., and Kruegel, C. 2012. A survey on automated dynamic malware-analysis techniques and tools. ACM Comput. Surv. 44, 2, Article 6 (February 2012), 42 pages. DOI = 10.1145/2089125.2089126 http://doi.acm.org/10.1145/2089125.2089126 1. INTRODUCTION The Internet has become an essential part of daily life as more and more people use services that are offered on the Internet. The Internet has evolved from a basic commu- nication network to an interconnected set of information sources enabling, new forms of (social) interactions and marketplaces for the sale of products and services among other things.
    [Show full text]
  • Computer Security 37 8.1 Vulnerabilities
    Contents 1 Antivirus software 1 1.1 History ................................................ 1 1.1.1 1949-1980 period (pre-antivirus days) ............................ 1 1.1.2 1980-1990 period (early days) ................................ 2 1.1.3 1990-2000 period (emergence of the antivirus industry) ................... 2 1.1.4 2000-2005 period ...................................... 3 1.1.5 2005 to present ........................................ 3 1.2 Identification methods ........................................ 4 1.2.1 Signature-based detection .................................. 4 1.2.2 Heuristics ........................................... 4 1.2.3 Rootkit detection ....................................... 5 1.2.4 Real-time protection ..................................... 5 1.3 Issues of concern ........................................... 5 1.3.1 Unexpected renewal costs ................................... 5 1.3.2 Rogue security applications .................................. 5 1.3.3 Problems caused by false positives .............................. 5 1.3.4 System and interoperability related issues ........................... 6 1.3.5 Effectiveness ......................................... 6 1.3.6 New viruses .......................................... 6 1.3.7 Rootkits ............................................ 6 1.3.8 Damaged files ......................................... 6 1.3.9 Firmware issues ........................................ 7 1.4 Performance and other drawbacks .................................. 7 1.5 Alternative solutions
    [Show full text]