and malware
play

AND MALWARE Ben Livshits, Microsoft Research Overview of Todays - PowerPoint PPT Presentation

Dec 18, 2022 •351 likes •915 views

VIRUSES, WORMS, AND MALWARE Ben Livshits, Microsoft Research Overview of Todays Lecture 2 Viruses Intrusion detection Behavioral detection Firewalls Virus/antivirus Application firewalls coevolution paper discussed

  1. VIRUSES, WORMS, AND MALWARE Ben Livshits, Microsoft Research

  2. Overview of Today’s Lecture 2  Viruses  Intrusion detection  Behavioral detection  Firewalls  Virus/antivirus  Application firewalls coevolution paper discussed  Worms

  3. What is a Virus?  a program that can infect other programs by modifying them to include a, possibly evolved, version of itself Fred Cohen, 1983

  4. Malware Timeline 4

  5. Virus/Antivirus Coevolution 5  Basic idea  Attacks and defenses follow hand in hand  Attackers are usually one step ahead of the game

  6. Coevolution: Basic Setup 6 Virus Antivirus  Identify a sequence of  Wait for user to instructions or data execute an infected file  Formulate a signature  Scan all files  Infect other (binary)  Look for signature files found verbatim  Bottleneck: scanning speed  Spread that way

  7. Basic Virus Signature Matching 7

  8. Simple Virus Strategy 8

  9. Coevolution: Entry Point Scanning 9 Virus Antivirus  Entry point scanning  Place virus at the entry point or make it directly reachable  Do exploration of reachable instruction from the entry point starting with the entry point of the program  Make virus small to avoid being easily  Continue until no more noticed by user instructions are found

  10. Coevolution: Virus Encryption 10 Virus Antivirus  Decryption (and encryption)  Decryption routine routines (packers) used by  Virus body viruses are easy to fingerprint  Decrypt into memory, not do disk  Develop signatures to match these routines  Set PC to the beginning of the decryption buffer  Attempt to decrypt the virus  Encrypt with a different body to perform a secondary key before adding virus to verification (x-raying) new executable

  11. Coevolution: Polymorphic 11 Virus Antivirus  Custom detection program Use a mutation engine to generate  a (decryption routine, encryption designed to recognize specific routine) pair detection engines Functionally similar or the same,   Generic decryption (GD) but syntactically very different  Emulator  Signature matching engine Use the encryption routine to   Scan memory/disk at regular encode the body of the virus intervals in hopes of finding decoded virus body No fixed part of the virus preserved  (decryption, encryption, body)

  12. GD Challenges 12  How long to emulate the execution? Viruses use padding instructions to delay execution. Can also use sleep for a while to slow down the scanner.  What is the quality of the emulator? How many CPUs to support?  What if decryption starts upon user interactions? How do we trigger it? What about anti-emulation tricks?

  13. False Positives in Virus Detection 13 • A "false positive" is when antivirus software identifies a non-malicious file as a virus. When this happens, it can cause serious problems. • For example, if an antivirus program is configured to immediately delete or quarantine infected files, a false positive in an essential file can render the operating system or some applications unusable. In May 2007, a faulty virus signature issued by In April 2010, McAfee VirusScan detected svchost.exe,   Symantec mistakenly removed essential operating a normal Windows binary, as a virus on machines system files, leaving thousands of PCs unable to boot running Windows XP with Service Pack 3, causing a reboot loop and loss of all network access Also in May 2007, the executable file required by  Pegasus Mail was falsely detected by Norton AntiVirus In December 2010, a faulty update on the AVG anti-  as being a Trojan and it was automatically removed, virus suite damaged 64-bit versions of Windows 7, preventing Pegasus Mail from running. Norton anti- rendering it unable to boot, due to an endless boot virus had falsely identified three releases of Pegasus loop created Mail as malware, and would delete the Pegasus Mail installer file when that happened n response to this Pegasus Mail stated: In October 2011, Microsoft Security Essentials  removed the Google Chrome browser, rival to Microsoft's own Internet Explorer. MSE flagged On the basis that Norton/Symantec has done this for Chrome as a Zbot banking trojan  every one of the last three releases of Pegasus Mail, we can only condemn this product as too flawed to use, and recommend in the strongest terms that our users cease using it in favor of alternative, less buggy anti-virus packages

  14. Top 20 Malware on Internet/user Computer 14 http://www.securelist.com/en/analysis/204792170/Monthly_Malware_Statistics_March_2011

  15. Vulnerability Gap 15  As long as user has the right virus signatures and computer has recently been scanner, detection will likely work  But the virus landscape changes fast  This calls for monitoring techniques for unknown viruses http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf

  16. CVE-2009-4324: December 2009 16 http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf

  17. Exploit in the PDF Unfolding… 17 http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf

  18. Automatic Zero-Day Blocking 18 Scanning engine recognizes the newPlayer() vulnerability (checked in red)  Because this is a zero-day vulnerability, the newPlayer() vulnerability would be  considered unknown Subsequently, the M86 Secure Web Gateway falls back to its behavioral analysis capability  Below, the behavior of the JavaScript is suspicious; therefore it is blocked by this default rule,  requiring no update http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf

  19. Proactive Detection Techniques 19  heuristic analyzer  policy-based security  intrusion detection/prevention systems  etc. http://www.securelist.com/en/downloads/vlpdfs/wp_nikishin_proactive_en.pdf

  20. Heuristic Analyzers 20  A heuristic analyzer looks at  code of executable files  Macros  Scripts  memory or boot sectors to detect malicious programs that cannot be identified using the usual (signature-based) methods  Heuristic analyzers search for unknown malicious software  Detection rates are usually low: 20-30% at most http://www.m86security.com/documents/pdfs/security_labs/m86_security_labs_vulnerability_report.pdf

  21. Policy-based Security 21  Use an overall security policy  The Cisco-Microsoft approach to restrict certain types of  Scan computers of users actions on the machine connecting to the network  Limit network access from  For instance machines that are not found  Don’t open email to be fully compliant (i.e. attachments virus definitions are out of  Don’t open files from the date) internet whose reputation is unknown  Force access to an update  Only allow access to a server whitelist of web sites  Disallow software installation  “Shepherd” the user into compliance

  22. Behavioral Monitoring Techniques 22

  23. IDS: Intrusion Detection Systems 23  What it is  Components  Security guards and  Collect signals “beware of dog” signs  Process and are forms of IDS create alerts  Serve two purposes:  Notify system  Detect something bad operators was happening  deter the perpetrator

  24. Host-Based vs. Network-Based IDS 24  Log analyzers  Scan incoming and outgoing traffic  Signature-based sensors  Primarily signature- based  System call analyzers  Combined into  Application behavior firewalls analyzers  Can be located on a  File integrity checkers different machine

  25. Host-Based Intrusion Detection open() f(int x) { Entry(g) Entry(f) x ? getuid() : geteuid(); x++ } g() { close() getuid() geteuid() fd = open("foo", O_RDONLY); f(0); close(fd); f(1); exit(0); exit() } Exit(g) Exit(f) If the observed code behavior is inconsistent with the statically inferred model, something is wrong

  26. Firewalls : Network and App-level Elizabeth D. Zwicky Michael Becher Simon Cooper D. Brent Chapman

  27. Basic Firewall Concept  Separate local area net from internet Firewall Local network Internet Router All packets between LAN and internet routed through firewall

  28. Firewall Goals  Prevent malicious attacks  Provide defense in depth on hosts  Programs contain bugs and are vulnerable to attack  Port sweeps, ICMP echo to broadcast addr, syn flooding,  Network protocols may … contain;  Worm propagation  Design weaknesses (SSH CRC)  Implementation flaws (SSL, NTP, FTP, SMTP...)  Prevent general disruption of internal network  Control traffic between “zones of trusts”  Monitor and control  Can control traffic between quality of service (QoS) separate local networks, etc.

  29. Review: TCP Protocol Stack Application protocol Application Application TCP, UDP protocol Transport Transport IP protocol IP protocol IP Network Network Network Data Data Link Link Access Link Link Transport layer provides ports , logical channels identified by number

  30. Review: Data Formats TCP Header Application message - data message Application segment Transport (TCP, UDP) TCP data TCP data TCP data packet Network (IP) IP TCP data frame Link Layer ETH IP TCP data ETF IP Header Link (Ethernet) Link (Ethernet) Header Trailer

Recommend

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND & CONTROL QUESTIONS & ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides
On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS & Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides
Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Describe types of malware See certain malware behaviors Scan and analyze malware

883 views • 25 slides
Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487

Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487

Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides based on Baileys ECE 422 Malware review How does the malware start running? Logic bomb? Trojan horse? Virus?

470 views • 27 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides
More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based

More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based

More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based malware: Exploit kits Fake AV Ransomware Today (continuation) How Malware Spreads Adware Computer Virus A type of malicious

647 views • 23 slides
Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd

Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd

Linux malware presentation Linux malware presentation @r00tbsd Paul Rascagnres Malware.lu July 2013 @r00tbsd Paul Rascagnres from Malware.lu Linux malware presentation Plan - Presentation - Darkleech/Chapro - Cdorked - Wirenet

425 views • 31 slides
MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs

MALWARE: VIRUSES CMSC 414 FEB 08 2018 MALWARE Malicious code that is stored on and runs on a victims system How does it get to run? Attacks a user- or network-facing vulnerable service Backdoor: Added by a malicious

1.02k views • 81 slides
PIN-point control for analyzing malware Jason Jones REcon 2014 1 Me Sr

PIN-point control for analyzing malware Jason Jones REcon 2014 1 Me Sr

PIN-point control for analyzing malware Jason Jones REcon 2014 1 Me Sr Sec Research Analyst @ Arbor ex-TippingPoint ASI Primarily reverse malware Interests / Research DDoS Botnet tracking Malware Clustering Bug

419 views • 29 slides
CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu

CS7038 - Malware Analysis - Wk07.2 Malware Research Online Coleman Kane kaneca@mail.uc.edu February 22, 2018 Exploring the Online Ecosystem One nice aspect of malware analysis is that, since much of it originates online and

119 views • 10 slides

More recommend