measuring pay per install the commodi8za8on of malware
play

Measuring*Pay-Per-Install:** - PowerPoint PPT Presentation

Sep 10, 2023 •334 likes •624 views

Measuring*Pay-Per-Install:** The*Commodi8za8on*of*Malware*Distribu8on* Juan*Caballero,* Chris&Grier ,** Chris8an*Kreibich*and*Vern*Paxson* * IMDEA*SoGware*Ins8tute,*UC*Berkeley,** Interna8onal*Computer*Science*Ins8tute* 2* 3* 4*

  1. Measuring*Pay-Per-Install:** The*Commodi8za8on*of*Malware*Distribu8on* Juan*Caballero,* Chris&Grier ,** Chris8an*Kreibich*and*Vern*Paxson* * IMDEA*SoGware*Ins8tute,*UC*Berkeley,** Interna8onal*Computer*Science*Ins8tute*

  2. 2*

  3. 3*

  4. 4*

  5. Market*for*Malware*Installa8on* • Goal:&Measure&and&understand&the&the&pay4per4install& ecosystem * • Our*approach:* – Infiltrate*four*PPI*programs* – Develop*“milkers”*to*automa8cally*download*malware* – Download,*execute,*and*classify*malware*being*installed* • Insights*into*the*pay-per-install*business* – Real-8me*monitoring*of*changes*in*malware*ecosystem* – Types*of*clients*using*PPI* – Financial*impacts*of*botnet*takedown* 5*

  6. Outline* • Background*on*pay-per-install* • Infiltra8on*and*monitoring*of*PPI* • Results*and*measurements* – Malware*being*installed*by*PPI* – Repacking*of*malware* – Geographically*diverse*distribu8on* 6*

  7. PPI*Ecosystem* • Clients* – Pay*the*PPI* – Want*malware*installed* – Spambots,*informa8on* harves8ng,*rootkits,*fake*AV* • Pay-per-install*(PPI)* – Purchases*compromised* hosts*from*affiliates* – Resells*to*clients* • Affiliates* – Compromise*machines* – Execute*the*PPI’s*binary* 7*

  8. PPI*Ecosystem* • Clients* – Pay*the*PPI* – Want*malware*installed* – Spambots,*informa8on* harves8ng,*rootkits,*fake*AV* • Pay-per-install*(PPI)* – Purchases*compromised* hosts*from*affiliates* – Resells*to*clients* • Affiliates* – Compromise*machines* – Execute*the*PPI’s*binary* 8*

  9. PPI*Ecosystem* • Clients* – Pay*the*PPI* – Want*malware*installed* – Spambots,*informa8on* harves8ng,*rootkits,*fake*AV* • Pay-per-install*(PPI)* – Purchases*compromised* hosts*from*affiliates* – Resells*to*clients* • Affiliates* – Compromise*machines* – Execute*the*PPI’s*binary* 9*

  10. Dropper*Lifecycle* Torpig& Rustock4dl& Rustock& 12&binaries&downloaded&& Pinit& Total&Time:&<5&minutes& PPI&exe& PPI&exe& PPI&exe& Ambler& PPI&exe& Pushdo& Zbot& Cutwail& Malware&exe& PPI&related&exe& 10*

  11. 11* PPI&InfiltraGon&and&Monitoring&

  12. Infiltra8on*Summary* • 12*of*the*20*most*popular*families*of*malware* distributed*by*PPI*services* • Infiltrated*four*PPI*command*and*control*networks* – Con8nual*monitoring*of*C&C* – Download*new*binaries* – Download*from*geo-diverse*loca8ons* • Dropped*Malware* – 1,060,895*client*binaries*downloaded* – 9,153*dis8nct*binaries* World’s(Top(Malware ,*FireEye,*July*2010.** hfp://blog.fireeye.com/research/2010/07/worlds_top_modern_malware.html** 12*

  13. PPI*Milking*System* 13*

  14. Milking*PPI*Services* 14*

  15. Running*Malware* GQ:&PracGcal&Containment&for&Measuring&Modern&Malware&Systems& C.*Kreibich,*N.*Weaver,*C.*Kanich,*W.*Cui,*V.*Paxson.*IMC*2011.* 15*

  16. Classifying*Malware* 16*

  17. Malware*Family*Coverage* 12*/*20*Being*dropped* by*PPI!* 17*

  18. Most*Seen*Families:*Aug*2010* 18*

  19. Binary*Repacking* • Repacking*or*cryp8ng* – Changes*program*content*without*changing*func8onality* – Frequency*reflects*concern*about*AV*signatures* * • PPI*client*binaries* – Depends*on*family*of*malware* – Average*repacking*every*11*days* • PPI*affiliate*binaries* – Repacking*done*by*PPI,*usually*daily* – Zlob*repacking*done*on-the-fly* 19*

  20. 14 | | | | 12 | | | | 10 | | | | Rustock* 8 | | VM Detection MD5 | | 6 | | | | 4 | | | | | | 2 | | | | | | 08/02 08/04 08/06 08/08 08/10 08/12 08/14 08/16 08/18 08/20 08/22 08/24 08/26 08/28 08/30 09/01 Date | | | | | | | | || | | | | || 140 | | | | | | | || | | | | || || | | | | | || 120 | | | | || | | SecuritySuite* || ||| || || | | | | | | | | | | | | | | | 100 | | || | | | || | | | MD5 VM Detection 80 | | | | | | | | | | || | || 60 | | | | | | | | | | | | | ||| | | | | | | | | | | | | | | || | | | | | | || 40 | || | | | | | || | | | | | | | | | | ||| || || | | | | | | | | | | | | | | | | 20 | | | | | | | | | | | | |||||| | | | | | | | | | | || || ||| | | | 08/01 08/03 08/05 08/07 08/09 08/11 08/13 08/15 08/17 08/19 08/21 08/23 08/25 08/27 08/29 08/31 09/02 Date MD5s*by*date*for*August,*2010*for*two*families*of*malware.* 20*

  21. | | | | | | | | || | | | | || 140 | | | | | | | || | | | | || || | | | 120 | | || | | | | || | | ||| || || || | | | | | | | | | | | | | | | 100 | | || | | | || | | | MD5 VM Detection 80 | | | | | | | | | | || | || | 60 | | | | | | | | | | | | ||| | | | | | | | | | | | | | | | || | | | || | | 40 | || | | | | | || | | | | | | | | | | ||| || || | | | | | | | | | | | | | | | | 20 | | | | | | | | | | | | |||||| | | | | | | | | | | || || ||| | | | 08/01 08/03 08/05 08/07 08/09 08/11 08/13 08/15 08/17 08/19 08/21 08/23 08/25 08/27 08/29 08/31 09/02 Date | | | | | | | | || | | || | | | | | | | | | || | | | 140 | | | | | | | || | | | | || || | | | | | || | | | | | | | | | | | || | | | | | || 120 | | | | || | | ||| || || || | | | | | | | | | | | | | | | || | | | 100 || | | || | | | | | || | || | || | | | | || || | || | | | || | | | | MD5 VM Detection | 80 | | | | | | | | | | | | | || | | | || | | | | | || | | | | | | | | || | | || | 60 | | | | | | | | | | | | | | | ||| | | | | | | | | | | | | | | | || | | | || | | | | 40 | || | | | | | || | | | | | | | | | | ||| || || | | | | | | | | | | | | | | || | | | | | | | | 20 | | | | | | | | | | | | |||||| | | | | | | | | | | | | || || ||| | | | 08/01 08/03 08/05 08/07 08/09 08/11 08/13 08/15 08/17 08/19 08/21 08/23 08/25 08/27 08/29 08/31 09/02 Date VM Detection SecuritySuite*MD5s*by*date* | no | yes 21*

  22. Geographic*Distribu8on*of*Malware* • Use*Tor*exit*points*in*15*different*countries* – Verify*exit-node*IP*using*MaxMind*GeoIP*database* – Zlob*blocks*Tor* • PPI*clients*are*given*a* choice *for*installs* 22*

  23. Geographic*Distribu8on*of*Malware* • Use*Tor*exit*points*in*15*different*countries* – Verify*exit-node*IP*using*MaxMind*GeoIP*database* – Zlob*blocks*Tor* • PPI*clients*are*given*a* choice *for*installs* – Prices*vary*depending*on*install*loca8on* – Clients*mone8ze*hosts*differently* • Localiza8on*of*Fake*AV* • Stolen*credit*card*value*varies* • Legal*limita8ons* 23*

  24. Dis8nct*Geographic*Distribu8on* Gleishug Russkill 0.8 0.6 Fraction 0.4 0.2 0.0 DE ES FR GB GR IT JP KR PT RU US DE ES FR GB GR IT JP KR PT RU US Rustock SmartAdsSolutions 0.8 0.6 Fraction 0.4 0.2 0.0 DE ES FR GB GR IT JP KR PT RU US DE ES FR GB GR IT JP KR PT RU US Frac8on*of*each*binaries*per*family*by*Tor*exit*country* 24*

  25. PPI*Arbitrage* • Affiliate*at*one*PPI,*client* at*another!* • Exploit*price*differen8al* – PPI*1:*Buys*1k*installs*for* $60*in*Greece* – PPI*2:*Sells*1k*installs*for* $40*in*Greece* 25*

  26. Conclusions* • First*systema8c*study*of*the*PPI*ecosystem* • Infiltra8on*provides* malware+intelligence+ – Used*to*perform*several*measurements* • Much*of*world’s*top*malware*using*PPI* • Regular*repacking*of*binaries* • Clients*target*geographic*loca8ons* 26*

  27. Ques8ons?* 27*

Recommend

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

570 views • 22 slides
Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware

Malware What is malware? Malware: malicious software worm ransomware adware virus trojan horse etc. and how do we fight it? AV software Firewalls Filtering Patching Writing more secure software

540 views • 42 slides
Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the

Android Malware Analysis on Attacks and Defense Android malware Android malware With the explosive growth of mobile device market and usage, there is an increasing number of malicious mobile applications targeting these devices and

819 views • 44 slides
Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal

Entrapment: Tricking Malware with Transparent, Scalable Malware Analysis Paul Royal paul@gtisc.gatech.edu Agenda Modern Malware Obfuscations, Server-side Polymorphism, Collection Volume Malware Analysis Detection

504 views • 27 slides
Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that

Getting started with malware analysis Judith van Stegeren Definitions Malware : any software that does something that causes harm to a user, computer or network, including viruses, trojan horses, worms, rootkits, scareware and spyware. Malware

119 views • 9 slides
GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI

GOODWARE DRUGS FOR MALWARE: ON-THE-FLY MALWARE ANALYSIS AND CONTAINMENT DAMIANO BOLZONI CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS AGENDA Something about malware Malware internals Current analysis

398 views • 27 slides
A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND

A CUCKOOS EGG IN THE MALWARE NEST ON-THE-FLY SIGNATURE-LESS MALWARE ANALYSIS, DETECTION AND CONTAINMENT FOR LARGE NETWORKS CHRISTIAAN SCHADE TWENTE SECURITY LAB UNIVERSITY OF TWENTE THE NETHERLANDS MALWARE WARS In the last

313 views • 14 slides
Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer

Overview Malware Halting 1. Malware 2. Software diversity Part I: Method Development 3. Computer immunization Kjell Jrgen Hole Simula@UiB 4. Epidemiological model 5. Malware halting analysis 6. Malware halting method Last updated

672 views • 29 slides
How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement

How does Malware Use RDTSC? A Study on Operations Executed by Malware with CPU Cycle Measurement Yoshihiro Oyama University of Tsukuba 1 Background Many malware programs execute operations for analysis evasion Detection of

346 views • 31 slides
Perl Post Install Tests April 10, 2013 Upgrading dependencies w/o fear 1. You install a module

Perl Post Install Tests April 10, 2013 Upgrading dependencies w/o fear 1. You install a module

Perl Post Install Tests April 10, 2013 Upgrading dependencies w/o fear 1. You install a module named Bear 2. You install the module Human , which depends on the availability of Bears ride() method 3. You install an new version of Bear , which

220 views • 8 slides
Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware

Anti-anti-malware (part 3) / Stack Smashing 1 last time various kinds of armored malware malware that evades analysis 2 logistics: LEX homework detect push ret pattern using fmex probably easier than TRICKY 3 upcoming exam next Wednesday

496 views • 48 slides
Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware

DeepSec IDSC Android Malware Adventures Mert Can Cokuner Krat Ouzhan Aknc Android Malware Adventures Agenda INTRODUCTION ANDROID MALWARE COMMAND &amp; CONTROL QUESTIONS &amp; ANSWERS 2 1 2 3 4 Android Malware

1.01k views • 64 slides
awe@columba $ apt install apache2 awe@columba $ apt install apache2 awe@columba $ vim

awe@columba $ apt install apache2 awe@columba $ apt install apache2 awe@columba $ vim

TORTOISE : IMPERATIVE SYSTEM CONFIGURATION REPAIR Aaron Weiss, Arjun Guha, Yuriy Brun Northeastern University and University of Massachusetts awe@columba $ apt install apache2 awe@columba $ apt install apache2 awe@columba $ vim

1.14k views • 95 slides
Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of

Malware Defense I TDDD17 Information Security, Second Course Ulf Kargn Department of Computer and Information Science Linkping University Malware Defense Agenda 2 Two lectures Lecture I : Malware basics, malware on the PC,

621 views • 40 slides
FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for

FIGHTING MALWARE WITH MACHINE LEARNING Edward Raff Jared Sylvester Mark McLean Need ML for Malware Amount of malware is growing exponentially Anti-virus and signature based approaches are reactionary, dont work for novel malware

127 views • 11 slides
CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is

CO 445H MALWARE AND VIRUSES Dr. Benjamin Livshits Malware: Different Types 2 Spyware is software that aids in gathering A virus is a computer program that is information about a person or organization capable of making copies of itself

716 views • 56 slides
Jewelry Box JewelryBox Install RVM JewelryBox Install RVM Google rvm Click first result

Jewelry Box JewelryBox Install RVM JewelryBox Install RVM Google rvm Click first result

Jewelry Box JewelryBox Install RVM JewelryBox Install RVM Google rvm Click first result Copy script Paste and run script in terminal JewelryBox install ruby 1.9.2.something JewelryBox install ruby 1.9.2.something rvm list

207 views • 19 slides
CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane

CS7038 - Malware Analysis - Wk03.1 Malware Taxonomy and Terminology Coleman Kane kaneca@mail.uc.edu January 24, 2017 Why Classification is Important Malware classification helps us in multiple ways. Here are a couple key ways:

787 views • 16 slides
On Static Malware Detection Tayssir Touili LIPN, CNRS &amp; Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS &amp; Univ. Paris 13 Motivation: Malware

On Static Malware Detection Tayssir Touili LIPN, CNRS &amp; Univ. Paris 13 Motivation: Malware Detection The number of new malware exceeds 75 million by the end of 2011, and is still increasing. The number of malware that produced

1.34k views • 91 slides
Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning

Introduction to Security Malware Ming Chow (mchow@cs.tufts.edu) Twitter: @0xmchow Learning Objectives By the end of this week, you will be able to: Describe types of malware See certain malware behaviors Scan and analyze malware

883 views • 25 slides
Install and run chef-solo in minutes benjaminrtz@gmail.com Install chef ============ curl -L

Install and run chef-solo in minutes benjaminrtz@gmail.com Install chef ============ curl -L

Install and run chef-solo in minutes benjaminrtz@gmail.com Install chef ============ curl -L https://www.opscode.com/chef/install.sh | bash Check ===== # chef-solo -v Chef: 11.6.2 Setup chef repository ===================== #wget

571 views • 4 slides
Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487

Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487

Lecture 12 Malware Defenses Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides based on Baileys ECE 422 Malware review How does the malware start running? Logic bomb? Trojan horse? Virus?

470 views • 27 slides
Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal

Impeding Automated Malware Analysis with Environment-sensitive Malware Chengyu Song , Paul Royal and Wenke Lee College of Computing Georgia Institute of Technology Agenda l Background l Defeating Automated Malware Analysis Host

1.28k views • 28 slides
More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based

More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based

More Malware Last Class Worms: Morris Worm Stuxnet Conficker Web-based malware: Exploit kits Fake AV Ransomware Today (continuation) How Malware Spreads Adware Computer Virus A type of malicious

647 views • 23 slides

More recommend