Managed Code Rootkits.Pdf

Total Page:16

File Type:pdf, Size:1020Kb

Managed Code Rootkits.Pdf Managed Code Rootkits Hooking into Runtime Environments This page intentionally left blank Managed Code Rootkits Hooking into Runtime Environments Erez Metula AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an imprint of Elsevier Acquiring Editor: Rachel Roumeliotis Development Editor: Matthew Cater Project Manager: Laura Smith Designer: Kristen Davis Syngress is an imprint of Elsevier 30 Corporate Drive, Suite 400, Burlington, MA 01803, USA © 2011 Elsevier, Inc. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or any information storage and retrieval system, without permission in writing from the publisher. Details on how to seek permission, further information about the Publisher’s permissions policies and our arrangements with organizations such as the Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website: www.elsevier .com/permissions. This book and the individual contributions contained in it are protected under copyright by the Publisher (other than as may be noted herein). Notices Knowledge and best practice in this field are constantly changing. As new research and experience broaden our understanding, changes in research methods or professional practices, may become necessary. Practitioners and researchers must always rely on their own experience and knowledge in evaluating and using any information or methods described herein. In using such information or methods they should be mindful of their own safety and the safety of others, including parties for whom they have a professional responsibility. To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume any liability for any injury and/or damage to persons or property as a matter of products liability, negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas contained in the material herein. Library of Congress Cataloging-in-Publication Data Metula, Erez. Managed code rootkits : hooking into runtime environments / Erez Metula. â p. cm. Includes bibliographical references and index. Summary: “Introduces the reader briefly to managed code environments and rootkits in general—Completely details a new type of rootkit hiding in the application level and demonstrates how a hacker can change language runtime implementation—Focuses on managed code including Java, .Net, Android Dalvik, and reviews malware development scenarios”— Provided by publisher. ISBN 978-1-59749-574-5 1. Computers—Access control. 2. Virtual computer systems—Security measures. 3. Rootkits (Computer software) 4. Common Language Runtime (Computer science) 5. Computer security. I. Title. QA76.9.A25M487 2010 005.8—dc22 2010036631 British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library. ISBN: 978-1-59749-574-5 Printed in the United States of America 10 11 12 13 14 10 9 8 7 6 5 4 3 2 1 Typeset by: diacriTech, India For information on all Syngress publications visit our website at www.syngress.com Contents Acknowledgements ���������������������������������xi About the Author.....................................................................................................xiii PART I OVERVIEW CHAPTER 1 Introduction ���������������������������������������������������������������������������� 3 The Problem of Rootkits and Other Types of Malware ������4 Why Do You Need This Book? ������������������ï6 How This Book Is Organized �����������������ï¿6 How This Book Is Different from Other Books on Rootkits �ï¿7 Terminology Used in This Book �����������������ï¿9 Technology Background: An Overview �������������ï10 Managed versus Unmanaged Code ��������������11 Managed Code Environments: An Overview ���������12 Summary �����������������������������21 CHAPTER 2 Managed Code Rootkits...................................å°................... 23 What Can Attackers Do with Managed Code Rootkits? �����24 Common Attack Vectors ���������������������ï26 Maintaining Access after Successful Attacks ���������27 The Trusted Insider ����������������������ï28 Malware ����������������������������30 Why Are Managed Code Rootkits Attractive to Attackers? ���ï30 MCRs Have a Large Attack Surface.........................................30 MCRs Have a Single Control Point..........................................31 MCRs Can Act as a Universal Rootkit ������������ï31 MCRs Are an Ideal Place to Hide Malicious Code ������32 Security Products Do Not Understand Intermediate Language Bytecode ��������������������ï32 Developers’ Backdoors Are Hidden from Code Review Audits �����������������������ï32 Attackers’ Backdoors Can Be Planted as Deliberate Security Holes �����������������������33 Managed Code Becomes Part of the OS �����������ï34 MCRs Provide Low-Level Access to Important Methods ��ï¿35 Object-Oriented Malware Has Many Implications ������35 Summary �����������������������������35 Endnotes �����������������������������ï36 v vi Contents PART II MALWARE DEVELOPMENT CHAPTER 3 Tools of the Trade ����������������������������������������������������������������� 39 The Compiler ��������������������������ï¿40 The Decompiler �������������������������ï¿42 The Assembler ��������������������������ï46 The Disassembler ������������������������ï¿49 The Role of Debuggers ���������������������ï¿52 The Native Compiler �����������������������56 File Monitors ���������������������������60 Summary �����������������������������61 CHAPTER 4 Runtime Modification ������������������������������������������������������������ 63 Is It Possible to Change the Definition of a Programming Language? ��������������������������ï¿63 Attacking the Runtime Class Libraries ������������66 Attacking the JIT Compiler ������������������66 Abusing Runtime Instrumentation Features ���������ï¿67 Walkthrough: Attacking the Runtime Class Libraries...................71 Case Study: The .NET Runtime ���������������ï¿72 Component Analysis ���������������������ï73 Disassembling the Binaries ������������������79 Modifying the IL Code ��������������������ï80 Reassembling the Code ��������������������82 Deployment ��������������������������83 Case Study: The Java Runtime ����������������ï90 Case Study: The Dalvik Runtime ���������������94 Summary �����������������������������99 CHAPTER 5 Manipulating the Runtime ��������������������������������������������������� 101 Manipulating the Runtime According to Our Needs...................101 Logical Manipulation ��������������������ï102 Execution Flow Manipulation ����������������113 Literal Value Manipulation �����������������ï¿122 Reshaping the Code.....................................................................129 Referencing External Methods and Class Members ����ï¿129 Injecting References ���������������������130 Max Stack Size �����������������������ï¿131 Setting the Labels ����������������������ï134 Code Injection Points ��������������������ï137 Code Generation..........................................................................139 Summary ����������������������������ï142 Contents vii CHAPTER 6 Extending the Language with a Malware API ������������������������ 143 Why Should We Extend the Language? ������������ï¿143 Extending the Runtime with a Malware API ����������146 Sending Data
Recommended publications
  • Advance Dynamic Malware Analysis Using Api Hooking
    www.ijecs.in International Journal Of Engineering And Computer Science ISSN:2319-7242 Volume – 5 Issue -03 March, 2016 Page No. 16038-16040 Advance Dynamic Malware Analysis Using Api Hooking Ajay Kumar , Shubham Goyal Department of computer science Shivaji College, University of Delhi, Delhi, India [email protected] [email protected] Abstract— As in real world, in virtual world also there are type of Analysis is ineffective against many sophisticated people who want to take advantage of you by exploiting you software. Advanced static analysis consists of reverse- whether it would be your money, your status or your personal engineering the malware’s internals by loading the executable information etc. MALWARE helps these people into a disassembler and looking at the program instructions in accomplishing their goals. The security of modern computer order to discover what the program does. Advanced static systems depends on the ability by the users to keep software, analysis tells you exactly what the program does. OS and antivirus products up-to-date. To protect legitimate users from these threats, I made a tool B. Dynamic Malware Analysis (ADVANCE DYNAMIC MALWARE ANAYSIS USING API This is done by watching and monitoring the behavior of the HOOKING) that will inform you about every task that malware while running on the host. Virtual machines and software (malware) is doing over your machine at run-time Sandboxes are extensively used for this type of analysis. The Index Terms— API Hooking, Hooking, DLL injection, Detour malware is debugged while running using a debugger to watch the behavior of the malware step by step while its instructions are being processed by the processor and their live effects on I.
    [Show full text]
  • Middleware in Action 2007
    Technology Assessment from Ken North Computing, LLC Middleware in Action Industrial Strength Data Access May 2007 Middleware in Action: Industrial Strength Data Access Table of Contents 1.0 Introduction ............................................................................................................. 2 Mature Technology .........................................................................................................3 Scalability, Interoperability, High Availability ...................................................................5 Components, XML and Services-Oriented Architecture..................................................6 Best-of-Breed Middleware...............................................................................................7 Pay Now or Pay Later .....................................................................................................7 2.0 Architectures for Distributed Computing.................................................................. 8 2.1 Leveraging Infrastructure ........................................................................................ 8 2.2 Multi-Tier, N-Tier Architecture ................................................................................. 9 2.3 Persistence, Client-Server Databases, Distributed Data ....................................... 10 Client-Server SQL Processing ......................................................................................10 Client Libraries ..............................................................................................................
    [Show full text]
  • Userland Hooking in Windows
    Your texte here …. Userland Hooking in Windows 03 August 2011 Brian MARIANI SeniorORIGINAL Security SWISS ETHICAL Consultant HACKING ©2011 High-Tech Bridge SA – www.htbridge.ch SOME IMPORTANT POINTS Your texte here …. This document is the first of a series of five articles relating to the art of hooking. As a test environment we will use an english Windows Seven SP1 operating system distribution. ORIGINAL SWISS ETHICAL HACKING ©2011 High-Tech Bridge SA – www.htbridge.ch WHAT IS HOOKING? Your texte here …. In the sphere of computer security, the term hooking enclose a range of different techniques. These methods are used to alter the behavior of an operating system by intercepting function calls, messages or events passed between software components. A piece of code that handles intercepted function calls, is called a hook. ORIGINAL SWISS ETHICAL HACKING ©2011 High-Tech Bridge SA – www.htbridge.ch THE WHITE SIDE OF HOOKING TECHNIQUES? YourThe texte control here …. of an Application programming interface (API) call is very useful and enables programmers to track invisible actions that occur during the applications calls. It contributes to comprehensive validation of parameters. Reports issues that frequently remain unnoticed. API hooking has merited a reputation for being one of the most widespread debugging techniques. Hooking is also quite advantageous technique for interpreting poorly documented APIs. ORIGINAL SWISS ETHICAL HACKING ©2011 High-Tech Bridge SA – www.htbridge.ch THE BLACK SIDE OF HOOKING TECHNIQUES? YourHooking texte here can …. alter the normal code execution of Windows APIs by injecting hooks. This technique is often used to change the behavior of well known Windows APIs.
    [Show full text]
  • Portable Microsoft Visual Foxpro 9 SP2 Serial Key Keygen
    Portable Microsoft Visual FoxPro 9 SP2 Serial Key Keygen 1 / 4 Portable Microsoft Visual FoxPro 9 SP2 Serial Key Keygen 2 / 4 3 / 4 License · Commercial proprietary software. Website, msdn.microsoft.com/vfoxpro. Visual FoxPro is a discontinued Microsoft data-centric procedural programming language that ... As of March 2008, all xBase components of the VFP 9 SP2 (including Sedna) were ... CLR Profiler · ILAsm · Native Image Generator · XAMLPad .... Download Microsoft Visual FoxPro 9 SP1 Portable Edition . Download ... Visual FoxPro 9 Serial Number Keygen for All Versions. 9. 0. SP2.. Download Full Cracked Programs, license key, serial key, keygen, activator, ... Free download the full version of the Microsoft Visual FoxPro 9 Windows and Mac. ... 9 Portable, Microsoft Visual FoxPro 9 serial number, Microsoft Visual FoxPro 9 .... Download Microsoft Visual FoxPro 9 SP 2 Full. Here I provide two ... Portable and I include file . 2015 Free ... Visual FoxPro 9.0 SP2 provides the latest updates to Visual FoxPro. ... autodesk autocad 2010 keygens only x force 32bits rh.. ... cs5 extended serial number keygen photo dvd slideshow professional 8.23 serial ... canadian foreign policy adobe acrobat 9 standard updates microsoft money ... microsoft visual studio express 2012 for web publish website microsoft office ... illustrator cs5 portable indowebsteradobe illustrator cs6 portable indowebster .... Download Microsoft Visual FoxPro 9 SP 2 Full Intaller maupun Portable. ... serial number Visual FoxPro 9 SP2 Portable, keygen Visual FoxPro 9 SP2 Portable, .... Microsoft Visual FoxPro 9.0 Service Pack 2.0. Important! Selecting a language below will dynamically change the complete page content to that .... Microsoft Visual FoxPro all versions serial number and keygen, Microsoft Visual FoxPro serial number, Microsoft Visual FoxPro keygen, Microsoft Visual FoxPro crack, Microsoft Visual FoxPro activation key, ..
    [Show full text]
  • C++/CLI Tutorial
    CC++++//CCLLII TTuuttoorriiaall Author: Adam Sawicki, [email protected], www.asawicki.info Version 1.0, December 2011 Table of Contents Table of Contents .............................................................................................................................................................. 1 Introduction ...................................................................................................................................................................... 2 What is C++/CLI? ............................................................................................................................................................... 2 Why Use C++/CLI? ......................................................................................................................................................... 2 What C++/CLI is Not? .................................................................................................................................................... 2 Hello World Example ........................................................................................................................................................ 3 Project Properties ............................................................................................................................................................. 3 Namespaces .....................................................................................................................................................................
    [Show full text]
  • Introduction to Managed Code
    McGrath.book Page 89 Thursday, December 7, 2006 10:04 AM 3 Introduction to Managed Code Technology is dominated by two types of people: those who understand what they do not manage, and those who manage what they do not understand. —PUTT’S LAW Topics Covered in This Chapter What Is Managed Code? Introduction to Object-Oriented Programming Exploring the .NET Framework VSTO and Managed Code Summary Review Questions What Is Managed Code? Code that runs within the .NET Framework is considered managed code. This includes applications written in languages such as Visual C# and Visual Basic 2005. Code that is not managed by the .NET Frame- work is typically referred to as unmanaged code. This includes applica- tions written in programming languages such as C++, Visual Basic 6.0, and VBA. All Office solutions created using VSTO are written in managed code. VSTO supports both Visual Basic 2005 and Visual C#; however, we refer only to Visual Basic 2005 in text and in code examples in this book 89 McGrath.book Page 90 Thursday, December 7, 2006 10:04 AM 90 Chapter 3 Introduction to Managed Code because we believe it is easier to transition from VBA to Visual Basic 2005. Keep in mind that there is much to learn about the .NET Frame- work and managed code; this chapter only scratches the surface. Following are some benefits of using managed code: • Improved security. Often, security permissions are enabled or disabled by end users or determined by the identity of the user who is attempting to run code. However, code managed by the .NET Framework uses the security model code access security (CAS), which is based on the code’s identity and location.
    [Show full text]
  • Visual Basic .NET and the .NET Platform: an Advanced Guide
    Visual Basic .NET and the .NET Platform: An Advanced Guide ANDREWTROELSEN APress Media, LLC Visual Basic .NET and the .NET Platform: An Advanced Guide Copyright ©2002 by Andrew'Ii'oelsen Originally published by Apress in 2002 All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. ISBN 978-1-893115-26-2 ISBN 978-1-4302-0849-5 (eBook) DOI 10.1007/978-1-4302-0849-5 Trademarked names may appear in this book. Rather than use a trademark sym­ bol with every occurrence of a trademarked name, we use the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. Editorial Directors: Dan Appleman, Gary Cornell, Jason Gilmore, Karen Watterson Technical Reviewers: Pamela Fanstill, Rob Macdonald, Dan Appleman, William Oellermann Managing Editor: Grace Wong Copy Editors: Anne Friedman, Nicole LeClerc Production Editors: Janet Vail with Kari Brooks and Anne Friedman Composition and Art Services: Impressions Book and Journal Services, Inc. Indexer: Carol Burbo Cover Designer: Tom Debolski Marketing Manager: Stephanie Rodriguez Distributed to the book trade in the United States by Springer-Verlag New York, lnc.,175 Fifth Avenue, New York, NY, 10010 and outside the United States by Springer-Verlag GmbH & Co. KG, Tiergartenstr. 17, 69112 Heidelberg, Germany In the United States, phone 1-800-SPRINGER, email orders@springer-ny.
    [Show full text]
  • INTRODUCTION to .NET FRAMEWORK NET Framework .NET Framework Is a Complete Environment That Allows Developers to Develop, Run, An
    INTRODUCTION TO .NET FRAMEWORK NET Framework .NET Framework is a complete environment that allows developers to develop, run, and deploy the following applications: Console applications Windows Forms applications Windows Presentation Foundation (WPF) applications Web applications (ASP.NET applications) Web services Windows services Service-oriented applications using Windows Communication Foundation (WCF) Workflow-enabled applications using Windows Workflow Foundation (WF) .NET Framework also enables a developer to create sharable components to be used in distributed computing architecture. NET Framework supports the object-oriented programming model for multiple languages, such as Visual Basic, Visual C#, and Visual C++. NET Framework supports multiple programming languages in a manner that allows language interoperability. This implies that each language can use the code written in some other language. The main components of .NET Framework? The following are the key components of .NET Framework: .NET Framework Class Library Common Language Runtime Dynamic Language Runtimes (DLR) Application Domains Runtime Host Common Type System Metadata and Self-Describing Components Cross-Language Interoperability .NET Framework Security Profiling Side-by-Side Execution Microsoft Intermediate Language (MSIL) The .NET Framework is shipped with compilers of all .NET programming languages to develop programs. Each .NET compiler produces an intermediate code after compiling the source code. 1 The intermediate code is common for all languages and is understandable only to .NET environment. This intermediate code is known as MSIL. IL Intermediate Language is also known as MSIL (Microsoft Intermediate Language) or CIL (Common Intermediate Language). All .NET source code is compiled to IL. IL is then converted to machine code at the point where the software is installed, or at run-time by a Just-In-Time (JIT) compiler.
    [Show full text]
  • Contents in This Issue
    APRIL 2006 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT LEAP YEAR Problems for AV vendors: some thoughts Although the hype surrounding OSX/Leap-A far outweighs the number of reported infections, the 3 NEWS virus does present a number of new ideas that we may well see again. Glyn Kennington investigates. More updating woes page 4 Spy couple sentenced ‘Real’ computer virus MR AND MRS ROOTKIT Viewers of the German version of the Mr. and Mrs. Smith movie DVD were surprised to find a little 3 VIRUS PREVALENCE TABLE more than they had bargained for on their DVDs thanks to the presence of a new protection system. VIRUS ANALYSES The protection software was found to be using 4 A small step for Mac OS X rootkit-like techniques to hide itself. Elia Florio discusses the security issues associated with the 6 Not a feeble attempt Settec DRM case. page 10 10 FEATURE LINUX COMPARATIVE Stories from the DRM world: the Settec case The main competition amongst products this month seemed to be to determine 13 COMPARATIVE REVIEW which could have the least useful Red Hat Linux 9 documentation – find out which products redeemed themselves by achieving a VB 100%. page 13 20 END NOTES & NEWS This month: anti-spam news & events and Sorin Mustaca takes an indepth look at PayPal phishing. ISSN 1749-7027 COMMENT ‘I see drowning in • Analysing proactive technologies, including heuristics and behaviour blockers so as to penetrate new malware as systems despite these barriers. one of the main • Interfering with anti-virus solutions, for instance, by issues facing the blocking automatic updates.
    [Show full text]
  • Ideas on Advanced Runtime Encryption of .NET Executables Christian Ammann
    Ideas on advanced runtime Encryption of .NET Executables Christian Ammann December 13, 2012 Nullsecurity team Encryption of .NET Executables 1 Introduction Runtime crypter accepts binary executable files as input and transforms them into an encrypted version (preserving its original behaviour). The encrypted file decrypts itself on startup and executes it’s original content. This approach allows the deployment of malicious executables in protected environments: As pattern based anti virus (AV) solution detects the signature of suspicious files and blocks their execution. The encrypted counterpart contains an unknown signature, it’s content can not be analysed by heuristics and is therefore executed normally without an intervention by the AV scanner. We presented in our last paper [1] the theoretic aspects of runtime PE [2] encryption and a reference implementation called Hyperion. Hyperion generates a random key and uses it to en- crypt the input file with AES-128 [3]. The encrypted file decrypts itself upon startup bruteforcing the necessary key. Therefore no AES key is stored inside the file which makes it hard for an anti virus solution to detect the encrypted payload. However, one major aspect is still missing: Hyperion encrypts only regular portable executables and support for .NET [4] byte code (which is used by Microsoft in C# [5], J# [6] and visual basic [7] applications) has to be implemented. Therefore, this paper reveals the aspects of .NET runtime encryption and presents a proof of concept implementation for Hyperion. It has the following structure: Section 2 describes the basic layout of .NET executables and their integration in native PE files.
    [Show full text]
  • A Brief Survey on Rootkit Techniques in Malicious Codes
    A Brief Survey on Rootkit Techniques in Malicious Codes Sungkwan Kim, Junyoung Park, Kyungroul Lee Ilsun You Soonchunhyang University Korean Bible University Shinchang-myun, Asan-si, Republic of Korea Seoul, Republic of Korea fcarpedm, wwkim3, [email protected] [email protected] Kangbin Yim∗ Soonchunhyang University Shinchang-myun, Asan-si, Republic of Korea [email protected] Abstract Nowadays, malicious codes are significantly increasing, leading to serious damages to information systems. It is worth to note that these codes generally depend on the rootkit techniques to make it more difficult for themselves to be analyzed and detected. Therefore, it is of paramount importance to research the rootkits to effectively defend against malicious codes. In this paper, we explore and survey the rootkit techniques both in user-level and kernel-level. Several rootkit samples are also utilized for the test and verification purpose. Keywords: rootkit, malicious codes, keyboard security 1 Introduction The superlative invention of the Internet in the 20th century has generated innovative developments in the computer industry. While internet speed is increasing, adverse effects are also increasing. A com- puter virus, which would have taken a long time to propagate in former days, can now spread throughout the world currently in a few seconds or minutes. In the past, the spreading technology was very simple and the path was limited, thus enabling an account technician sufficient time to protect against the virus. However, malicious codes have been intelligently armed with self-deformation and concealment, cre- ating many problems such as Distributed Denial of Services Attacks (DDoS), SPAM, and hijacking of personal information[2].
    [Show full text]
  • Captain Hook: Pirating AVS to Bypass Exploit Mitigations WHO?
    Captain Hook: Pirating AVS to Bypass Exploit Mitigations WHO? Udi Yavo . CTO and Co-Founder, enSilo . Former CTO, Rafael Cyber Security Division . Researcher . Author on BreakingMalware Tomer Bitton . VP Research and Co-Founder, enSilo . Low Level Researcher, Rafael Advanced Defense Systems . Malware Researcher . Author on BreakingMalware AGENDA . Hooking In a Nutshell . Scope of Research . Inline Hooking – Under the hood - 32-bit function hooking - 64-bit function hooking . Hooking Engine Injection Techniques . The 6 Security Issues of Hooking . Demo – Bypassing exploit mitigations . 3rd Party Hooking Engines . Affected Products . Research Tools . Summary HOOKING IN A NUTSHELL . Hooking is used to intercept function calls in order to alter or augment their behavior . Used in most endpoint security products: • Anti-Exploitation – EMET, Palo-Alto Traps, … • Anti-Virus – Almost all of them • Personal Firewalls – Comodo, Zone-Alarm,… • … . Also used in non-security products for various purposes: • Application Performance Monitoring (APM) • Application Virtualization (Microsoft App-V) . Used in Malware: • Man-In-The-Browser (MITB) SCOPE OF RESEARCH . Our research encompassed about a dozen security products . Focused on user-mode inline hooks – The most common hooking method in real-life products . Hooks are commonly set by an injected DLL. We’ll refer to this DLL as the “Hooking Engine” . Kernel-To-User DLL injection techniques • Used by most vendors to inject their hooking engine • Complex and leads security issues Inline Hooking INLINE HOOKING – 32-BIT FUNCTION HOOKING Straight forward most of the time: Patch the Disassemble Allocate Copy Prolog Prolog with a Prolog Code Stub Instructions JMP INLINE HOOKING – 32-BIT FUNCTION HOOKING InternetConnectW before the hook is set: InternetConnectW After the hook is set: INLINE HOOKING – 32-BIT FUNCTION HOOKING The hooking function (0x178940) The Copied Instructions Original Function Code INLINE HOOKING – 32-BIT FUNCTION HOOKING .
    [Show full text]