Malicious Code Karlstads universitet mCrowds: Anonymity for the - PDF document

2005-10-12 Malicious Code an Increasing Problem Malicious Code Karlstads universitet mCrowds: Anonymity for the mobile Internet Karlstads universitet DAV C19 – Applied Security 2 Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Media Publicity Different Malicious Code Malicious code (“Virus”) Virus Worms Malicious Trojans Logical Trap Scripts Bombs doors Replicate Karlstads universitet 3 DAV C19 – Applied Security Karlstads universitet 4 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Virus Boot Virus • A malicious piece of code that • Hard drive virus spreads itself from file to file – Infects the Master Boot Record (MBR) of the hard drive before OS is loaded • Need a host file Infected File – Spreads via bootable device, e.g. floppy disc • Different types of viruses – Boot virus – Program viruses – Macro virus Virus as payload Karlstads universitet 5 DAV C19 – Applied Security Karlstads universitet 6 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Datavetenskap, Karlstads universitet 1

2005-10-12 Program Virus Example: Chernobyl/CIH (1998) • Infects executable programs on the computer by • Destroys flash BIOS appending itself to the code • Makes data on hard drive unreadable • Was triggered on every 26 th of April – “Logical bomb” functionality Karlstads universitet DAV C19 – Applied Security Karlstads universitet DAV C19 – Applied Security 7 8 Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Macro Virus Auto Executing Macros in Word 1. Command macro • Set of macro commands for a specific application • If a macro stored in a global macro file, or attached to a document, which automatically executes and spreads to that has the same name as an existing Word command (e.g. “Save applications documents file”), the macro is executed whenever a user performs that command • Normally spread via Office applications (Visual 2. Autoexecute Basic macros in Word, Excel, etc) • A macro named “AutoExec” in template “normal.dot” or in global • Macros are spread via e-mail attachments template in Words startup directory is always executed when Word is started 3. Automacro 1011011 • An “automacro” is executed when a specific event occurs, e.g. 010 opening a document or quitting Word Karlstads universitet 9 DAV C19 – Applied Security Karlstads universitet 10 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Example: Concept Virus Malicious Scripts • Malicious scripts written in JavaScript, VBScript, • When infected document is opened – If not already existing, creates the macro “FileSaveAs” in the Active X controls, etc. “NORMAL.DOT” template in Word • Hidden in e-mails or web sites. Can also be part – Also creates macro that contains message: of viruses or worms Sub MAIN REM That's enough to prove my point • Cross-site scripting End Sub vulnerabilities let scripts • When user chooses “Save As” in execute in user’s browser the menu, the macro FileSaveAs or even locally always executes – User cannot specify which drive to save to and cannot specify file type Karlstads universitet 11 DAV C19 – Applied Security Karlstads universitet 12 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Datavetenskap, Karlstads universitet 2

2005-10-12 Trojans Logical Bombs • “Trojan Horse” • Malicious code programmed to be activated on • Programs with hidden a specific date/time malicious functionalities • Action could be everything from format hard drive to display a silly message • Appears to be screen savers, games, or other • Often combined with “useful” programs virus/worm (e.g. Chernobyl virus) Karlstads universitet DAV C19 – Applied Security Karlstads universitet DAV C19 – Applied Security 13 14 Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Trapdoors Worm • A secret entry point into a • A malicious piece of code that spreads itself program that allows someone from computer to computer aware of the trap door to gain • A worm needs no host file access without going through • Can spread via normal security procedures – E-mail attachments • Usually left by programmers for – LAN or Internet debugging and testing purposes, intentionally or unintentionally Karlstads universitet 15 DAV C19 – Applied Security Karlstads universitet 16 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Example: ILOVEYOU Example: Code Red • Starts to spread when uses clicks on an e-mail • A worm that spread via attachment (ILOVEYOU.TXT .vbs ) Extension sometimes hidden HTTP exploiting a buffer- automatically by Windows overflow vulnerability – The attachment is a malicious Visual Basic Script masked as a text file • Spreads automatically – The script executes locally in Windows Scripting Host, when visiting web site where it first changes registry settings about the – I.e. does not require privileges of scripts, and then starts to spread itself via for “human hand” to spread example the contact list • Requires “human hand” to spread, therefore sometimes called virus (e.g. in Stallings book) Karlstads universitet 17 DAV C19 – Applied Security Karlstads universitet 18 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Datavetenskap, Karlstads universitet 3

2005-10-12 Vulnerabilities Vulnerabilities • A vulnerability is a security weakness in a • Buffer Overflow program/OS that could be exploited by malicious – Occurs when a program writes more information into software, e.g. viruses/worms the buffer than the space it has allocated in the memory. This allows an attacker to (1) overwrite data • Microsoft rolls out update patches that tries to that controls the program execution path and (2) hijack patch novel vulnerabilities the control of the program to (3) execute the attacker’s code instead the process code Example: http://nsfsecurity.pr.erau.edu/bom/Smasher.html Example: http://nsfsecurity.pr.erau.edu/bom/Smasher.html Karlstads universitet DAV C19 – Applied Security Karlstads universitet DAV C19 – Applied Security 19 20 Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Vulnerabilities Blended Threats • Unvalidated input • Advanced malicious code that – Information from web requests is not validated before combines the characteristics of being used by a web application. Attackers can use viruses, worms, Trojans and these flaws to attack (by injecting malicious code) malicious scripts are sometimes backside components through a web application called “blended Threats” • Cross site scripting, script injection, … • Exploit vulnerabilities in programs – The web application can be used as a mechanism to or operating systems transport an attack to an end user’s browser – Nowadays often Microsoft OS/apps – Clicking links in web pages or emails, etc, lets remote – Why is that? (malicious) scripts execute in the user’s browser Karlstads universitet 21 DAV C19 – Applied Security Karlstads universitet 22 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Blended Threats Example: Appix (Sep, 2002) • Worms are spread by exploiting vulnerabilities and • A combined worm, virus and Trojan horse often does not require human intervention • Exploits vulnerabilities in Outlook Express and • 2 nd generation of worms automatically searches Internet Explorer for vulnerable computers and infects them • Can infect directly from a web page • Whole Internet can be infected in less than 20 • Uses an own SMTP server minutes • Spreads via e-mail, KaZaA or eDonkey2000 • Kills anti virus software and personal firewalls Karlstads universitet 23 DAV C19 – Applied Security Karlstads universitet 24 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Datavetenskap, Karlstads universitet 4

2005-10-12 Example: Sasser (May, 2004) Viruses in Mobile Phones • Mobile phones starting to behave like small • Starts up an FTP server and automatically scans computers with Internet access randomly chosen IP addresses for vulnerabilities – Not to mention PDAs… • 128 threads that scans IP addresses are started � The virus problem will probably spread to – System will be very slow • Stops user from shutting down computer mobile phones in the near future Karlstads universitet DAV C19 – Applied Security Karlstads universitet DAV C19 – Applied Security 25 26 Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Viruses in Mobile Phones Viruses in Mobile Phones Fall 2005… Spring 2005… Karlstads universitet 27 DAV C19 – Applied Security Karlstads universitet 28 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Hacker Tools Example: Back Orifice Back Orifice Remotely control other computers. Similar programs: NetBus Karlstads universitet 29 DAV C19 – Applied Security Karlstads universitet 30 DAV C19 – Applied Security Datavetenskap 2005-10-12 Datavetenskap 2005-10-12 Datavetenskap, Karlstads universitet 5