Milware: Identification and Implications of State Authored Malicious Software Trey Herr, Eric Armbrust The George Washington University Abstract and non-state authored code but its primary contribution is to highlight five major implications of milware: The difference between state and non-state authored code Public disclosure is not as effective. States have little is typically described in vague terms of sophistication, to fear from public disclosure of their activities and so the contributing to the inaccurate confirmation bias of many traditional paradigm of revealing tactics and techniques in the policy community that states simply ’do it bet- to dissuade attackers and aid defenders is less effective. ter’. Leveraging the results of reverse engineering sev- States may be doing R&D for all malicious actors. eral malware samples, including Sandworm and Tinba, States have far more resources to develop new techniques this paper is an interdisciplinary effort to distinguish be- and exploits than non-state actors. The eventual prolifer- tween state authored code, milware, and that produced ation of this code by individuals and criminals means the by non-state actors, malware. Working through this ini- state of the art will continue to advance, funded by gov- tial set of samples, the paper describes a new analytic ernments. framework for differentiating state authored code from Even where they do not build the capabilities, states other samples. This MAlicious Software Sophistication may be distorting the market. State’s financial re- or MASS index relies on a set of characteristics which sources may price defenders out of the market for ex- describe the behavior and construction of malicious soft- ploits and even bring new sellers into play. ware: propagation to and within a target network, ex- Existing legal tools presume the targets of prose- ploit severity, and payload customization. Highlighting cution are non-state actors. Law enforcement targets these distinctions then serves to support a larger analy- individuals and non-state groups but states are operating sis of the policy implications these separate categories of under this same legal regime, allowing them to act with malicious code have. By identifying a systematic differ- relative impunity. ence between non-state authored code and that created Milware privileges access over effects. States have by states, this pilot project is an effort to generate a new taken advantage of the current emphasis on defensive and analytic asset for the technical community and highlight information assurance standards over software developer attendant policy implications. liability. Before understanding the implications of this dis- 1 Introduction tinct category of code, our first task is to recognize its existence. Previous work presented has attempted to Pervasive development and use of milware constitutes move beyond the simple sophisticated/unsophisticated not only a direct technical challenge of decomposing and dichotomy and succeeded in developing a metric that analyzing well obfuscated code but also threatens a set measured social engineering tactics. [1] We advance this of key assumptions underpinning the current information scholarship by focusing on the functional characteristics security research and defense paradigm. States operate in malicious code and comparing the work of state and non- a different legal regime than criminal groups and individ- state actors to better understand what is common to ma- uals, inverting the power relationship between attacker licious software and what depends on the unique opera- and defender and altering what is possible in the defense tional demands of state versus non-state actors. against and prosecution of sources of information assur- Starting with a description of the samples analyzed ance threats. This paper develops the MASS index as a and our selection process, this paper explains the char- rudimentary tool for analysts to distinguish between state acteristics we developed to delineate between milware and malware. Walking through an example reversing work [2] has a distinct purpose and works in combination process, the paper describes the key features in the sam- with the others to constitute a malicious package. ple, highlighting where they tend to differ between the Differentiating between sophisticated and unsophisti- categories. Milware has a higher frequency of 0day cated samples is not a new area of work in the infor- use and generally employs vulnerabilities with a more mation security community; static and dynamic analy- severe CVE classification. While the targets of mal- sis techniques have been in use and evolving for several ware, and milware overlap, their movement within target decades. [4, 5, 6, 7, 8] The origin of samples has come networks differs; milware propagates to particular high to the foreground more in the past decade as efforts have value nodes in a deliberate, often human directed, fash- shifted to understand the nature of threats and their ac- ion while malware reflects an automated, scattershot ap- tivities beyond the network perimeter. As part of this proach. change, the motivations of attackers and their political status has become a factor of interest. [1, 9] Analytically, 2 Background the next step is understanding the relationship between the complexity and capability of a piece of malicious Malicious software analysis has long been focused on in- code and the nature of its authors. We do this by focusing dividually functional components in code, using infor- on the discrete components outlined above, the propaga- mation gleaned from particular modules to describe the tion method, exploits, and payload, an approach which function of an entire sample in a sound but somewhat has seen some use. [10] limiting bottom up approach. Our approach attempts to work top down, establishing three broad components 3 Data Collection of all malicious samples; propagation methods, exploits, and payloads. [2] We selected a set of malware and milware samples for Propagation is the means of transporting malicious both accessibility and their chronological proximity. Our code from origin to target; this could be as simple as a ability to work directly with the milware samples was mass email for spear phishing attacks or as complex as a limited by agreement and so relies in part on open source crafted dropper module. Exploits act to enable the prop- documentation. Malware selection was driven by three agation method and payloads operation. The payload is key factors: scope of impact, availability of samples, code written to achieve some desired malicious end. and knowledge of lineage. Using malware samples with The three components work in concert but each have a long history of use allowed us to consider crossover substantially different roles; the propagation method between samples and select more complete instances of moves the entire software package from origin to tar- code. get while the payload is written to manipulate system To achieve the clearest possible distinction be- resources and create some effect on a computer system. tween milware and malware, we selected two sam- Exploits are not themselves malicious, but rather act to ples from each category. Malware samples included support the propagation method and payload. Achiev- Game Over Zeus (GOZ) and Tinybanker (Tinba) while ing root access on a machine does not create an effect by Sandworm and code used in the Sony Attacks were se- itself; rather it makes such an operation possible, creden- lected as our milware samples. Each code has had wordl- tials theft for example. This terminology is at odds with wide impact of one type or another and propagates using some usage, which combines the payload’s function into a different method. the exploit and uses the combination as a verb, to ’ex- ploit’ a system. [3] This approach however limits our ability to categorize 4 Methods and understand malicious code; the two are logically dis- tinct both in sequence and form as exploits are written to To gain a fuller understanding of our samples, we un- a particular vulnerability present in some piece of soft- dertook to reverse engineer each in a controlled lab en- ware while payloads are written to achieve a particular vironment using both static and dynamic analysis. This effect. This distinction, between writing to the target and process leveraged existing and widely used tools, includ- writing to the effect, make for divergent practices in de- ing IDA Pro [11], BOCHS [12], WinDBG [13], Immu- veloping, selling, and integrating exploits and payloads. nity [14], and SysAnalyzer [15], in a live running envi- Without one or several exploits, a payload would almost ronment. These tools helped document the changes our never be able to execute on a target computer - these ex- samples made to the testing system and parsed each bi- ploits serve to manipulate the target system into giving naries, enabling us to work with readable machine code. malicious code access and user privileges necessary to This analysis also considered how samples interacted function. Each of the three components of this frame- with their surrounding network so we included TCP- 2 DUMP [16] and WireShark [17] to gather and analyze hole Exploit Kit demonstrates a common feature of mal- outbound traffic. ware; reliance on pre-existing third-party exploit pack- ages. This is directly at odds with Sandworm’s use of 4.1 Milware a more particularly selected and applied exploit to gain access to target systems.