Computer Security: Principles and Practice Introduction by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown & Susan Lincke Chapter 6 – Malicious Software = Malware
Study Sheet Ø Ø Ø Ø Define attacks: cracking, script kiddies, cyberterrorist, phishing, spearphishing, pharming, drive-by download. Define and provide examples for: social engineering, Denial Of Service. Define and describe DDOS, logic bomb, worm, virus, trojan horse, backdoor, botnet, handler, bot, spyware, adware, root kit, spamware, crimeware. Define and describe stealth virus, polymorphic virus, metamorphic virus, macro virus, boot sector virus, zero-day exploit, rate limiting, immune system Describe why ‘ethical’ hackers are not completely ethical. Define the 4 stages of viruses and worms Define 4 mechanisms antivirus software uses to recognize or control viruses and worms
FBI PRIORITIES 1. Protect the United States from terrorist attack 2. Protect the United States against foreign intelligence operations and espionage 3. Protect the United States against cyber-based attacks and high-technology crimes 4. Combat public corruption at all levels 5. Protect civil rights 6. Combat transnational/national criminal organizations and enterprises 7. Combat major white-collar crime 8. Combat significant violent crime 9. Support federal, state, local and international partners 10. Upgrade technology to successfully perform the FBI’s mission
The Problem of Network Security The Internet allows an attacker to attack from anywhere in the world from their home desk. They just need to find one vulnerability: a security analyst need to close every vulnerability.
Threat Type Progression of Security Attacks Year: Example Threats Experiment 1984: Fred Cohen publishes “Computer Viruses: Theory and Experiments” Vandalism Hactivism 1988: Jerusalem Virus deletes all executable files on the system, on Friday the 13 th. 1991: Michelangelo Virus reformats hard drives on March 6, M’s birthday. 2010: Anonymous’ Operation Payback hits credit card and communication companies with DDOS after companies refuse to accept payment for Wiki-Leaks. Cyber 2007: Zeus Trojan becomes ‘popular’; turns computers into zbots and spyware crime steals credit card (CC) numbers. 2008, 2009: Gonzales re-arrested for implanting spyware on WLANs, affecting 171 M CC. 2013: In July 160 M CC numbers are stolen via SQL Attack. In Dec. 70 M CC numbers are stolen through Target stores. Informatio 2007, 2008: Russia launches DDOS attack against Estonia, Georgia news, gov’t, n Warfare banks 2010: Stuxnet worm disables 1000 of Iran’s nuclear centrifuges. Surveillanc 2012: Chinese affiliations attack U. S. /foreign businesses to steal intellectual e State property. 2013: Lavabit closes secure email service rather than divulge corporate private key to NSA without customers’ knowledge.
HISTORY OF CYBER-WAR YEAR FROM -> TO ATTACK DESCRIPTION 2007 Russia -> Estonia DOS attacks on gov’t, financial inst. , news 2008 Russia -> Georgia DOS attacks on Internet, gov’t websites 2008 US -> US Malware to top aides of pres. candidates 2009 China->Embassies, Ghost. Net malware: Command & Control foreign ministries software 2012 US, Israel -> Iran Stuxnet Worm disables nuclear facilities 2010 India <->Pakistan Hacker groups hit gov’t websites 2011 China -> Canada Spyware virus causes shutdown of economic agencies 2012 -> Iran, Middle East Flame cyber-espionage malware 2013 N. Korea -> S. Korea Dark Seoul Malware hits TV, banks; makes computers unusable.
Advanced Persistent Threat Ø Advanced: Combination of custom & common malware l Target: Business or Gov’t data/operation Ø Persistent: Extended period attack until target is compromised Ø Threat: Organized, capable, well-funded attacker l Source: Gov’t or criminal enterprise
A Common Means of Attack
2014 Ponemon Breach Cost by Industry Prob. of Breach Cost/rec Churn rate Communications Consumer Education Energy Financial Health care Hospitality Industry Media Pharmaceutical Public sector Research Retail Services Technology Transportation 15. 6% 19. 9% 21. 1% 7. 5% 17. 1% 19. 2% 19. 5% 9. 0% 19. 7% 16. 9% 23. 8% 11. 5% 22. 7% 19. 8% 18. 9% 13. 5% 219 196 254 237 236 316 93 204 183 209 172 73 125 223 181 286 1. 2 2. 6 2. 0 4. 0 7. 1 5. 3 2. 9 3. 6 1. 9 3. 8 0. 1 0. 7 1. 4 4. 2 6. 3 5. 5
Crackers Cracker: Computer-savvy programmer creates attack software Script Kiddies: Know how to execute programs System Administrators Some scripts are useful to protect networks… Hacker Bulletin Board Sql Injection Buffer overflow Password Crackers Password Dictionaries Successful attacks! Crazyman broke into … Cool. Cat penetrated… Criminals: Create & sell botnets -> spam Sell credit card numbers, … Crimeware or Attack Kit=$1 K-2 K 1 M Email addresses = $8 10, 000 PCs = $1000
Other Hackers/Crackers: Cyberterrorists Ø Cyberwar: National governments attack IT Ø Espionage: Accused: France, Russia, China, South Korea, Germany, Israel, India, Pakistan, US. Ø Ethical Hackers Ø “Do no damage” However they approve of: l l Changing security logs Disabling security protections Reading corporate information Attitude: hacking is beneficial: keeps ‘stupid corp’s on their toes’
Covert Channel Exfiltrate information outside the organization Ø E. g. : manipulate bits in a jpeg or mpeg Ø E. g. : carry out info in a Lady Ga. Ga CD Ø E. g. : set bytes in an Excel spreadsheet Ø
Malicious Software Ø programs exploiting system vulnerabilities Ø known as malicious software or malware l program fragments that need a host program • e. g. viruses, logic bombs, and backdoors l independent self-contained programs • e. g. worms, bots l replicating or not Ø sophisticated threat to computer systems
Malware Propagation Classification Infection Of Executable (e. g. , Virus) Exploit of Software Vulnerability (SQL Attack, Worm) Social Engineering (E. g. , Phishing, Watering hole, Trojans)
Social Engineering This is John, the System Admin. What is your password? I need a password reset. What is the passwd set to? Email: k has ABC Ban noticed a with problem ount… your acc What ethnicity are you? Your mother’s maiden name? and have some software patches I have come to repair your machine…
Phishing = Fake Email The bank has found problems with your account. Please contact …” ABC BANK Your bank account password is about to expire. Please login… Spearfishing John: This was a cool You. Tube link: … Alice
Pharming = Fake web pages Pharming: Ø A fake web page may lead to a real web page Ø The fake web page looks like the real thing l Extracts account information www. abc. com Login Passwd www. abc. Bank. com Welcome To ABC Bank
Denial of Service Single-Message Do. S Attacks: Crash or disable system by attacking vulnerability Ø Flooder Do. S Attack: Flood victim with requests Ø l l l SYN Flooding: Flood victim host with TCP SYNs (which initiate session). Smurf Attack: Broadcast Pings to third parties with source address of victim host Rabbit or Bacteria: Reproduces exponentially, using up system resources
Logic Bomb= Functional software has a built-in malicious attack or failure mechanism Ø E. g. , Software will malfunction if maintenance fee is not paid Ransomware: E. g. , Pay fee to decrypt software Trojan Horse: E. g. , Social Engineering: “Try this game…it is so cool” l Game also emails password file.
Drive-By Download Ø A web site exploits a Games: vulnerability in the visitor’s browser when Ø Vampires and Wolfmen Ø Planet of the Apes the site is viewed Ø Dungeons and Dragons
Root Kit Ø Upon penetrating a computer, a hacker installs a root kit Ø May enable: l l Easy entrance for the hacker (and others) Keystroke logger Eliminates evidence of break-in Ø Modifies the operating system Ø Requires new OS install, when detected Ø Backdo or entry Keystro ke Logg er H n de id ser u
Rootkit System Table Mods
Exploit/Maintain Access Abnormal way to enter system, provided by Programmer or Vulnerability Backdoor Trojan Horse Useful utility also performs malicious function Bots Slave forwards/performs commands; spreads, list email addrs, DOS attacks Spyware/Adware Replaces system User-Level Rootkit executables: e. g. Login, ls, du to hide itself Spyware collects info: keystroke logger, collect credit card #s, Adware: insert ads, filter search results Kernel-Level Rootkit Replaces OS kernel: e. g. process or file control to hide
Distributed Denial of Service Zombies Attacker Handler Victim China Russia United States Can barrage a victim server with requests, causing the network to fail to respond to anyone Bots Flooder
Botnets: Bots Attacker India Handler Hungary Bots: Host illegal movies, music, pornography, criminal web sites, … Forward Spam for financial gain Sniffing traffic or Keylogging Zombies DDOS, spread bots Manipulate voting games Generate clicks for ads
Bots Ø program taking over other computers Ø hard to trace attacks Ø if coordinated form a botnet Ø characteristics: l remote control facility • via IRC/HTTP etc l spreading mechanism • attack software, vulnerability, scanning strategy Ø various counter-measures applicable
Bot Uses Ø DDOS attacks l E. g. , Internet Relay Chat overload Spamming Ø Spying Ø l l Ø Sniffing traffic Keylogging Malware abuse l l l Spread malware Install advertisement add-ons: pay-for-clicks Manipulating online games
Attack Kit - Crimeware Ø Attack kit = Crimeware: Tools which generate malware automatically l with varied propagation and payload mechanisms Auto-rooter: Breaks into new machines remotely Ø Downloader: Original attack opens the door, then downloads the full attack software Ø Spammer program: Generates large volumes of unwanted email Ø
Virus A virus attaches itself to a program, file, or disk Ø When the program is executed, the virus too is executed Ø When the program is given away (floppy/email) the virus spreads Ø The virus may be benign or malignant but executes its load pay at some point (often upon contact) Dear John, This link is a cool web site Ø Program A Extra Code Program A infects
Viruses Ø piece of software that infects programs l l Ø modifying them to include a copy of the virus so it executes secretly when host program is run a typical virus goes through phases of: 1. 2. 3. 4. Dormant: Wait for file presence, date, event, … Propagation: Spreading technique Triggering: Complete full intention Execution: Harmless or harmful
Virus Structure Ø components: l l l infection mechanism - enables replication trigger - event that makes payload activate payload - what it does, malicious or benign Ø prepended / postpended / embedded Ø when infected program invoked, executes virus code then original program code Ø can block initial infection (difficult) Ø or propogation (with access controls)
Virus Structure
Compression Virus
Virus Target Classification Ø boot sector: Spreads when system is booted from disk containing virus Ø macro virus: Inserted in application file as script (e. g. , MS Word doc. ) Ø file infector: Infects executable in OS or shell Ø multipartite: Infects multiple ways/files l Difficult to clean, eradicate
Virus Concealment Strategies Ø encrypted virus: Uses a random key to encrypt virus, and stores key with virus Ø stealth virus: Hides via encryption, file sizing, virus location, rootkit Ø polymorphic virus: Mutates new virus with each infection Ø metamorphic virus: Changes itself with each iteration; also polymorphic
Macro Virus Ø became very common in mid-1990 s since l l l platform independent infect documents easily spread Ø exploit macro capability of office apps l l executable program embedded in MS Office doc often a form of Basic Ø more recent releases include protection Ø recognized by many anti-virus programs
E-Mail Viruses Ø more recent development Ø e. g. Melissa l l l exploits MS Word macro in attached doc if attachment opened, macro activates sends email to all on users address list does local damage had no Dormant phase -> faster propagation • 100 k computers in 3 days
Brain Virus Lodges in upper memory then sets upper memory bound below itself Ø Replaces interrupt vector for disk reads to screen disk read calls. Calls interrupt handler after screening. Ø Places itself in the boot sector and six other sectors on disk Ø Marks sectors as ‘bad’ so they will not get overwritten. Ø Variants erase disks or destroy file allocation table Ø
Virus Countermeasures Ø prevention - ideal solution but difficult Ø realistically need: l l l detection identification removal Ø if detect but can’t identify or remove, must discard and replace infected program Ø But what has cracker done in the mean time?
Anti-Virus Evolution Ø virus & antivirus tech have both evolved Ø early viruses simple code, easily removed Ø more complex viruses -> more complex countermeasures Ø 4 generations: l l first - signature scanners second – heuristics • Integrity checking & fragment recognition l l third - identify actions (e. g. , decompression) fourth - combination packages • Limit access control to system & files
Antivirus, Antispyware Antivirus Ø Scheduled scans Ø Antivirus updates Ø Real-time file access protection Ø E-mail protection Ø Popular: Norton, Mc. Afee, Panda, Fprot, AVG Antispyware Ø Real-time protection Ø Scheduled scans Ø Browser hijack protection Ø Auto updates Ø Popular: Spybot, Ad-aware, MS Windows Defender All-in-one also includes Ø URL Filter Ø Content inspection: packet content
Generic Decryption Ø runs executable files through GD scanner: l l l CPU emulator to interpret instructions virus scanner to check known virus signatures emulation control module to manage process Ø lets virus decrypt itself in interpreter Ø periodically scan for virus signatures Ø issue is how long to interpret and scan? l tradeoff chance of detection vs time delay
Digital Immune System
Behavior-Blocking Software
Worm Ø Worm: Independent program which replicates itself and sends copies from computer to computer across network connections. Upon arrival the worm may be activated to replicate. To Joe To Ann To Jill Email List: Joe@uwp. edu Ann@uws. edu Jill@uwm. edu
Worms Ø replicating program that propagates over net l Ø has phases like a virus: l l l Ø using email, remote exec, remote login dormant, propagation, triggering, execution propagation phase: automatically ‘scans’ for other systems, connects to it, copies self to it and runs fast spread phase: each infection spreads to n other nodes, exponentially may disguise itself as a system process
Morris Worm Ø one of best know worms Ø released by Robert Morris in 1988 Ø various attacks on UNIX systems l l l cracking password file to use login/password to logon to other systems exploiting a bug in the finger protocol exploiting a bug in sendmail to issue commands Ø if succeed have remote shell access
Morris Worm – cont’d Created by Robert Morris, convicted 1990, received $10 K fine & 3 years jail, 400 hours community service Ø Unintended Effect: Denial of service due to resource exhaustion: Worms created more worms (even on same machine) Once system penetrated Ø Send a bootstrap loader with 99 lines of C code to be executed on target machine Ø Downloader: Fetch rest of worm, verified by password Ø Stealth: encrypted itself, deleted original version, changed name periodically Ø
Worm Technology Ø Multiplatform: Unix, Windows, … Ø Multi-exploit: travels in multiple ways Ø Polymorphic: generations mutate Ø Metamorphic: self-mutating & polymorphic Ø Transport vehicles: auto-builds bots Ø Zero-day exploit: attacks a vulnerability before vulnerability is known
Worm Countermeasures Ø overlaps with anti-virus techniques Ø once worm on system A/V can detect Ø worms also cause significant net activity Ø worm defense approaches include: l l l signature-based worm scan filtering filter-based worm containment payload-classification-based worm containment threshold random walk scan detection rate limiting and rate halting • puts speed limit on scanning / fignerprinting actions
Proactive Worm Containment Looks for surges in the rate of frequency of outgoing connection attempts and the diversity of connections to remote hosts. When such a surge is detected, the software immediately blocks its host from further connection attempts.
Network Based Worm Defense
Summary: Malware Payload Classification Theft of Information: E. g. Keyloggers, spyware, pharming, exfiltration Theft of Service Botnet, Denial of Service DDOS, ransomware, adware, spammers Stealth: Hide presence: Rootkit, backdoors, viruses/worms Corruption of System Or Files Virus, worm, rootkit
Summary: Malware Controls Countermeasures: Ingress Monitor: Are traffic (flows) entering network valid? Ø Egress Monitor: Is traffic exiting network valid? Ø Host Scanner: Are actions on the computer suspicious? Ø Malware Countermeasure: Are actions by the program suspicious? Ø Distributed Intelligence: Host-based and perimeter sensors, intelligence analysis Ø
Скачать презентацию Computer Security Principles and Practice Introduction by William
98b75f204dd4b08ed136df7b45366d26.ppt