04/11/2022

 

Lecturer: Nguyễn Thị Thanh Vân – FIT - HCMUTE

 Intruder
 Hacker: 4 phases
 Malicious Software:
o Malicious Software - Introduction
o Malware Terminology
o Where malware lives
o What to Infect
o Taxonomy of Malicious Software

 Modern Malware
 Malware analysis

04/11/2022 2

1
 04/11/2022

 A significant security problem for networked systems is:

o hostile,
o or at least unwanted, trespass by users or software.

 User trespass (intrude) can take the form of:

o unauthorized logon to a machine or,
o an authorized user gaining of privileges or
o performance of actions beyond (pass) those that have been
authorized.

 Software trespass can take the form of a:

o virus,
o worm, or
o Trojan horse

04/11/2022 3

 The two most publicized threats to security:

o the intruder: often referred to as a hacker or cracker
o (the other is viruses).
 3 classes of intruders:
o Masquerader: A person penetrates a system’s access controls to exploit
a legitimate user’s account -> outsider
o Misfeasor: A legitimate user who accesses data, programs, or resources
for which such access is not authorized, or who is authorized for such
access but misuses his or her privileges -> insider
o Clandestine user: An individual who seizes supervisory control of the
system and uses this control to evade auditing and access controls ->
outsider or insider
 Other class: benign vs. serious

04/11/2022 4

2
 04/11/2022

 

Nguyen Thi Thanh Van - Khoa CNTT

04/11/2022

 Benign intruders might be tolerable, although they do

consume resources and may slow performance for
legitimate users.
 However, there is no way in advance to know whether an
intruder will be benign or harmful.
 IDSs and IPSs are designed to counter this type of hacker
threat.
 One of the results of the growing awareness of the
intruder problem has been the establishment of a number
of Computer Emergency Response Teams (CERTs).
o collect / disseminate vulnerability info / responses

04/11/2022 6

3
 04/11/2022

Foot printing/Reconnaissance

Scanning and Enumeration

Gaining access

Maintaining access

Covering track
04/11/2022 7

 

4
 04/11/2022

 Malicious Software - Introduction

 Malware Terminology
 Where malware lives
 What to Infect
 Taxonomy of Malicious Software

04/11/2022 9

 programs exploiting system vulnerabilities

 known as malicious software or malware
o program fragments that need a host program
• e.g. viruses, logic bombs, and backdoors
o independent self-contained programs
• e.g. worms, bots
o replicating or not
 sophisticated threat to computer systems

5
 04/11/2022

 Virus
 Worm
 Logic bomb
 Trojan horse
 Backdoor (trapdoor)
 Mobile code
 Auto-rooter Kit (virus generator)
 Spammer and Flooder programs
 Keyloggers
 Rootkit
 Zombie, bot

 Folder auto - start

 [Link]: run =[backdoor]" or "load =[backdoor]".

 [Link]: shell =”myexplorer. exe”

 [Link]

 [Link]

 Init.d

04/11/2022 12

6
 04/11/2022

 • Executable
• Interpreted file
• Kernel
• Service
• Master Boot Record

04/11/2022 13

Virus

Trojan
Applet
Logic
bombs Replication
Malicious Trap door

Worm
Alone
Zombie
04/11/2022 14

7
 04/11/2022

 piece of software that infects other programs

o modifying them to include a copy of the virus
o so it executes secretly when host program is run
 specific to operating system and hardware
o taking advantage of their details and weaknesses

8
 04/11/2022

Dormant Propagation Triggering Execution

 Dormant:
o The virus is idle. It will eventually be activated by some event

 Propagation:
o The virus places an identical copy of itself into other programs or into
certain system areas
 Triggering:
o The virus is activated to perform the function for which it was
intended (such as a date, the presence of another program or file)
 Execution
o The function is performed, which may be harmless

 components:
o infection mechanism - enables replication
o trigger - event that makes payload activate
o payload - what it does, malicious or benign
 prepended / postpended / embedded
 when infected program invoked, executes virus code
then original program code
 can block initial infection (difficult)
 or propogation (with access controls)

9
 04/11/2022

 Virus V:
o 1: go to “main” of virus program
o 2: a special flag (infected or not)

 Main:
o Find uninfected programs - infect
them
o Do something damaging to the
system
o “Go to“ first line of the host
program - do normal work

 Avoid detection by looking at

size of program
• Compress/decompress the
host program

10
 04/11/2022

P1 is infected with the virus CV,

1. P2 (uninfected) is found, the virus
compresses that file to P2’.
2. A copy of the virus is prepended to the
compressed program.
3. The compressed version of the original
infected program, is uncompressed.
4. The uncompressed program is executed.

boot sector
Parasic
Memory
Target
Macro
Rootkits

Virus Email
encrypted
Stealth
Concealment
polymorphic
strategy
metamorphic

11
 04/11/2022

 Boot Sector Virus: Infects master boot record / boot record (boot
sector) of a disk and spreads when a system is booted with an
infected disk (original DOS viruses).

04/11/2022 23

 Memory-resident Virus:
o Reside in RAM
o is infect running programs
 Parasic Virus:
o Infects executable files.
o They attach their self to executable files as part of their code.
o Runs whenever the host program is executed.

04/11/2022 24

12
 04/11/2022

 Macro Virus:
o became very common in mid-1990s
o platform independent
o infect documents (Word or excel files)
o easily spread
o often a form of Basic
o more recent releases include protection
o recognized by many anti-virus programs

 Resides in operating systems and modifies OS code and data

structure
 set of programs installed for admin access and may hide its existence
o difficult to determine that the rootkit is present and to identify what
changes have been made
o disrupting report mechanisms on processes, files, registry entries…
 can be classified on whether survive a reboot and execution mode:
o Persistent: Activates each time the system boots, store code in a persistent store
o memory-based: Has no persistent code and therefore cannot survive a reboot
o user mode: Intercepts calls to APIs and modifies returned results.
o kernel mode: Can intercept calls to native APIs in kernel mode; may hide the malware process by
removing it from the kernel's list of active processes.
 installed by user via Trojan or intruder on system
 range of countermeasures needed

13
 04/11/2022

Rootkit filters
call and results

Modify the system call table

Modify system call table targets
Redirect the system call table

 more recent development

 e.g. Melissa
o exploits MS Word macro in attached doc
o if attachment opened, macro activates
o sends email to all on users address list
o and does local damage
 then saw versions triggered reading email
 hence much faster propagation
 file types should never be opened if …
.E XE, .PIF, . BAT, .VBS, .COM

14
 04/11/2022

 Encrypted Virus - A portion of virus creates a random

encryption key and encrypts the remainder of the virus. The
key is stored with the virus. When the virus replicates, a
different random key is generated.

 Stealth Virus - explicitly designed to hide from Virus

Scanning programs.

 Polymorphic Virus - mutates with every new host to prevent

signature detection, signature detection is useless.

 Metamorphic Virus – Rewrites itself completely with every

new host, may change their behavior and appearance.

04/11/2022 29

 prevention - ideal solution but difficult

 realistically need:
o detection
o identification
o Removal
 if detect but can’t identify or remove, must discard and
replace infected program
 Solutions:
o Anti-Virus
o Generic Decryption
o Digital Immune System
o Behavior-Blocking Software

15
 04/11/2022

 virus & antivirus tech have both evolved

 early viruses simple code, easily removed
 as become more complex, so must the countermeasures
 Generations
o Scanner:
• first - signature scanners
• second - heuristics
o Real time Monitors
• third - identify actions
• fourth - combination packages

 Kaspersky

04/11/2022 32

16
 04/11/2022

 runs executable files through GD scanner:

o CPU emulator to interpret instructions
o virus scanner to check known virus signatures
o emulation control module to manage process
 lets virus decrypt itself in interpreter
 periodically scan for virus signatures
 issue is long to interpret and scan
o tradeoff chance of detection vs time delay

captures it, analyzes it, adds detection and

shielding for it, removes it,

and passes information

about that virus to other
systems
so that it can be detected before it is
allowed to run elsewhere

17
 04/11/2022

 —
Secret entry point into a program

 Allows those who know access by passing usual security

procedures

 Remains hidden to casual inspection

 Can be a new program to be installed

 Can modify an existing program

 Trap doors can provide access to a system for unauthorized

procedures
 Very hard to block in O/S

04/11/2022 36

18
 04/11/2022

 One of oldest types of malicious software

 Piece of code that executes itself when predefined conditions
are met
 Logic Bombs that execute on certain days are known as Time
Bombs
 Activated when specified conditions met
– E.g., presence/ absence of some file
– particular date/ time
– particular user
 When triggered typically damage system
– modify/ delete files / disks , halt machine, etc.

04/11/2022 37

 the gift horse left outside the gates of Troy by the Greeks, Trojan
Horses appear to be useful or interesting to an unsuspecting user,
04/11/2022 but are actually harmful. 38

19
 04/11/2022

 Trojan horse is a malicious program

that is designed as authentic, real and
honest software.
 Common features of Trojan
Programs :
• Capturing screenshots of your
computer.
• Recording key strokes and sending
files to the hacker
• Giving full Access to all your drives
and files.
• Ability to use your computer to do
other hacking related activities
04/11/2022 39

 What Trojan scan do ?

o Erase or overwrite data on a computer
o Spread other viruses or install a backdoor. ('dropper'. )
o Networks of zombie computers in order to launch DoS attacks or
send Spam.
o Logging keystrokes to steal information such as passwords and
credit card numbers (known as a key logger)
o Phish for bank or other account details, which can be used for
criminal activities.
o Or simply to destroy data
o Mail the password file

04/11/2022 40

20
 04/11/2022

04/11/2022 41

 replicating program that propagates over net

o using email, remote exec, remote login
 has 4 phases like a virus
 may disguise itself as a system process
 Once active:
o It can behave as a computer virus or bacteria,
o Iit could implant Trojan horse programs
o Perform any number of disruptive or
o Destructive actions
 The features:
o Do not require a host application to perform their activities
o Do not necessarily require any user interaction, direct or
otherwise, to function
o Replicate extremely rapidly across networks and hosts
o Consume bandwidth and resources

21
 04/11/2022

 one of best know worms, released by Robert Morris in 1988

 various attacks on UNIX systems
o cracking password file to use login/password to logon to other systems
o exploiting a bug in the finger protocol
o exploiting a bug in sendmail
o used a number of different techniques for propagation
 if succeed have remote shell access
o sent bootstrap program to copy worm over
 Effects of the worm
o $100,000–10,000,000.
o 6,000 major UNIX machines were infected
o Clifford Stoll fight the worm removing the virus often took two days."[7

 The speed of propagation and the total number of hosts

infected depend on a number of factors, including
o the mode of propagation,
o the vulnerability
or vulnerabilities exploited,
o the degree of similarity
to preceding attacks.

22
 04/11/2022

 Code Red
o July 2001 exploiting MS IIS bug
o probes random IP address, does DDoS attack
o consumes significant net capacity when active
 Code Red II variant includes backdoor
 SQL Slammer
o early 2003, attacks MS SQL Server
o compact and very rapid spread
 Mydoom
o mass-mailing e-mail worm that appeared in 2004
o installed remote access backdoor in infected systems

 Multiplatform: attack a variety of platforms (UNIX)

 multi-exploit: worms penetrate systems in a variety of
ways
 ultrafast spreading: accelerate the spread of a worm
 Polymorphic: To evade detection, skip past filters, and
foil real-time analysis
 Metamorphic: have a repertoire of behavior patterns that
are unleashed at different stages of propagation
 transport vehicles: ideal for spreading other distributed
attack tools, such as distributed denial of service bots
 zero-day exploit: To achieve maximum surprise and
distribution

23
 04/11/2022

 overlaps with anti-virus techniques

 once worm on system A/V can detect
 worms also cause significant net activity
 worm defense approaches include:
o signature-based worm scan filtering
o filter-based worm containment
o payload-classification-based worm containment
o threshold random walk scan detection
o rate limiting and rate halting

24
 04/11/2022

 The program which secretly takes over another networked

computer and force it to run under a common command and
control infrastructure.

 Uses it to indirectly launch aNacks, e.g., DDoS, phishing,

spamming, cracking
 Difficult to trace zombie’ s creator)
 Infected computers — mostly Windows machines — are
now the major delivery method of spam.
 Zombies have been used extensively to send e-mail
spam; between 50% to 80% of all spam worldwide is now
sent by zombie computers.

04/11/2022 50

25
 04/11/2022

Zombies

Attacker Handler Victim

Russia Bulgaria United

States

Can barrage a victim

server with requests,
causing the network Zombies
to fail to respond to anyone

 Bot: a program secretly takes over hundreds or thousands

of computer then uses that computer to launch attacks that
are difficult to trace to the bot's creator.
 Botnet: The collection of bots
 Botnet has characteristics:
o the bot functionality
o remote control facility
• via IRC/HTTP etc
o spreading mechanism
• attack software, vulnerability, scanning strategy
 various counter-measures applicable
 Some uses of bots include:
o DDoS attacks, spamming, sniffing traffic, keylogging, spreading
new malware, installing advertisement add-ons .

26
 04/11/2022

Botnets: Bots

Handler
Attacker

China Hungary
Bots: Host illegal movies,
music, pornography,
criminal web sites, …
Forward Spam for
financial gain
Zombies

04/11/2022 54

27
 04/11/2022

04/11/2022 55

04/11/2022 56

28
 04/11/2022

 a type of malicious software from cryptovirology that

threatens to publish the victim's data or perpetually block
access to it unless a ransom is paid.

04/11/2022 57

04/11/2022 58

29
 04/11/2022

 1. Crypto malware. it encrypts things like your files, folders, and hard-drives.
Victims were asked to pay ransom in Bitcoin to retrieve their data.
 2. Lockers: is known for infecting your operating system to completely lock you
out of your computer or devices, making it impossible to access any of your files
or applications. Ex, Android-based.
 3. Scareware. fake software acts like an antivirus or a cleaning tool, It often
claims to have found issues on your computer, demanding money to resolve the
problems, some types of scareware lock your computer, flood your screen with
annoying alerts and pop-up messages.
 4. Doxware. It threatens to publish your stolen information online if you don’t pay
the ransom.
 5. RaaS. is a type of malware hosted anonymously by a hacker. These
cybercriminals handle everything from distributing the ransomware and
collecting payments to managing decryptors — software that restores data
access — in exchange for their cut of the ransom.
 6. Mac ransomware. Mac operating systems were infiltrated by their first
ransomware in 2016.
 Known as KeRanger infected Apple user systems through an app called
Transmission
 7. Ransomware on mobile devices

04/11/2022 59

04/11/2022 60

30
 04/11/2022

 Mitigation and Prevention

04/11/2022 61

 Malware Analysis
o The process of understanding the behavior and purpose of a
suspicious file or URL.
o The output of the analysis aids in the detection and mitigation of the
potential threat.

 The key benefit of malware analysis is that it helps incident

responders and security analysts:

o Pragmatically triage incidents by level of severity

o Uncover hidden indicators of compromise (IOCs) that should be
blocked
o Improve the efficacy of IOC alerts and notifications
o Enrich context when threat hunting

04/11/2022 62

31
 04/11/2022

 Static Analysis
o does not require that the code is actually run.
o examines the file for signs of malicious intent.
o can be useful to identify malicious infrastructure, libraries or
packed files.
o Limit: sophisticated malware can include malicious runtime
behavior that can go undetected
 Dynamic malware
o analysis executes suspected malicious code in a safe
environment called a sandbox.
o enables security professionals to watch the malware in action
without the risk of letting it infect their system or escape into the
enterprise network.
 Hybrid
04/11/2022 Analysis (includes both of the techniques above) 63

 Static Properties Analysis

o Static properties include strings embedded in the malware code, header details, hashes, metadata, etc.
o can indicate whether a deeper investigation using more comprehensive techniques is necessary and
determine which steps should be taken next.

 Interactive Behavior Analysis

o understand the sample’s registry, file system, process and network activities.
o conduct memory forensics to learn how the malware uses memory
o Behavioral analysis requires a creative analyst with advanced skills.
o The process is time-consuming and complicated => be performed effectively with automated tools.

 Fully Automated Analysis

o Will be quickly and simply assesses suspicious files.
o can determine potential repercussions \
o Fully automated analysis is the best way to process malware at scale.

 Manual Code Reversing

o analysts reverse-engineer code using debuggers, disassemblers, compilers and specialized tools to
decode encrypted data,
o determine the logic behind the malware algorithm and understand any hidden capabilities that the
malware has not yet exhibited.

04/11/2022 64

32
 04/11/2022

 Malware Detection

 Threat Alerts and Triage (Cảnh báo và thử thách mối đe dọa)
o teams can save time by prioritizing the results of these alerts over other
technologies.

 Incident Response
o aids in the efficiency and effectiveness of the effort in analysing root cause

 Threat Hunting
o Help threat hunters find similar activity, such as access to a particular
network connection, port or domain.

 Malware Research
o to gain an understanding of the latest techniques, exploits and tools used by
adversarie

04/11/2022 65

 Intruder
 Hacker: 4 phases
 Attack: many types
 Malicious Software: many types
 Malware Analysis

33
 04/11/2022

 Creating a Simple Virus:

o Message loop
o Restart the Computer
o To block/redirect website (HOSTS File)
o …..
 A Trojan:
o appears as an antivirus program to eat up the hard disk space
o appears as a backdoor for remote accessing
• Use metasploit exploit multi/handler to victim computer
 Backdoor
o After sending Trojan to victim as backdoor
 Keyloggers
o Record keypress of victim

04/11/2022 67

04/11/2022 68

34