0% found this document useful (0 votes)

2 views32 pages

Malware Overview in Network Security

The document discusses malware, focusing on its types, distribution methods, and the challenges adversaries face in executing their code. It explains the mechanics of viruses and worms, including historical examples like the Melissa Virus and Stuxnet, highlighting their propagation and infection strategies. Additionally, it addresses modern malware sophistication and the importance of defense strategies against such threats.

Uploaded by

dairwabar

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

0% found this document useful (0 votes)

2 views32 pages

Malware Overview in Network Security

Uploaded by

dairwabar

We take content rights seriously. If you suspect this is your content, claim it here.

Available Formats

Download as PDF, TXT or read online on Scribd

CSE543

Introduction to Computer and

Network Security
Module: Malware
Asst. Prof. Syed Rafiul Hussain

CSE543 - Introduction to Computer and Network Security Page 1

Malware
• Adversaries aim to get code running on your
computer that performs tasks of their choosing
‣ This code is often called malware
• Two main challenges for adversaries
‣ How do they get trick you into getting their malware onto
your computer?
‣ How do they get their malware to run?
• Other practical concerns of malware distribution
‣ Spread malware to as many systems as possible
‣ Hide malware execution
‣ Make malware difficult to remove

CSE543 - Introduction to Computer and Network Security Page 2

Viruses
• Is an attack that modifies programs on your host
• Approach
1. Download a program …
2. Run the program …
3. Searches for binaries and other code (firmware, boot sector)
that it can modify …
4. Modifies these programs by adding code that the program
will run

• What can an adversary do with this ability?

CSE543 - Introduction to Computer and Network Security Page 3
Viruses
• How does it work?
‣ Modify the file executable format

CSE543 - Introduction to Computer and Network Security Page 4

Viruses
• How does it work?
‣ Modify the file executable format
• What types of modifications?
‣ Overwrite the “entry point”
‣ Add code anywhere and
change “address of entry point”
• Add a new section header
• Patch into a section
‣ Add jump instruction to exploit
• All these were well known by 90s
CSE543 - Introduction to Computer and Network Security Page 5
Virus Infection
• Keeping with the virus analogy, getting a virus to run
on a computer system is called infecting the system
‣ Program that attaches itself to another (usually trusted, aka.
benign program)

CSE543 - Introduction to Computer and Network Security Page 6

Virus Infection
• Keeping with the virus analogy, getting a virus to run
on a computer system is called infecting the system
‣ Program that attaches itself to another (usually trusted
program)
‣ How can an adversary infect another’s computer?
• Tricking users into downloading their malware
‣ Need to also trick the user into running the malware
• Exploiting a vulnerable program to inject code
‣ By exploiting a running process, the malware can run
directly

CSE543 - Introduction to Computer and Network Security Page 7

An Easier Way
• Don’t really need to modify existing executable to
download and run code on a remote computer
‣ Since the mid-90s systems have provided methods for
you to get a remote system to run your code
‣ First, email attachments, then client-side scripts
• Enabled by phishing attacks (more later)
• In general, the idea is to get the user to run your code
(in email or via web link)
‣ Either run directly
‣ Or exploit a vulnerability in the platform (e.g., browser)

CSE543 - Introduction to Computer and Network Security Page 8

Melissa Virus (1999)
• Came through email including an MS Word attachment
• Emailed itself to the first 50 people in the Outlook’s
contact list
• Infected ~20% of computers, $1.2B in damages.

CSE543 - Introduction to Computer and Network Security Page 9

Worms
• A worm is a self-propagating program.
• As relevant to this discussion
1. Exploits some vulnerability on a target host (e.g., buffer
overflow)…
2. (often) embeds itself into a host …
3. Searches for other vulnerable hosts without human
interventions…
• A worm takes advantage of file or information transport features on your
system, which allows it to travel unaided.

4. Goto (1)
• Sometimes used to create botnets

CSE543 - Introduction to Computer and Network Security Page 10

The Danger
• What makes worms so dangerous is that infection
grows at an exponential rate
‣ A simple model:
• s (search) is the time it takes to find vulnerable host
• i (infect) is the time is take to infect a host
‣ Assume that t=0 is the worm outbreak, the number of hosts
infected at t=j is

2(j/(s+i))

‣ For example, if (s+i = 1), what is it at time j=32?

CSE543 - Introduction to Computer and Network Security Page 11
The result
5,000,000,000

4,500,000,000

4,000,000,000

3,500,000,000

3,000,000,000

2,500,000,000

2,000,000,000

1,500,000,000

1,000,000,000

500,000,000

CSE543 - Introduction to Computer and Network Security Page 12

The Morris Worm (1988)
• Robert Morris, a 23 doctoral student from Cornell
‣ Wrote a small (99 line) program
‣ Launched on November 3rd, 1988
‣ Simply disabled the Internet
• How it did it
‣ Exploited a buffer overflow in the “finger” daemon
‣ Used local /etc/[Link], .rhosts, .forward to identify hosts
that can be accessed without passwords
‣ Reads /etc/password to perform password cracking
‣ Scanned local interfaces for network information
‣ Covered its tracks (set is own process name to sh, prevented
accurate cores, re-forked itself)
• Morris claimed the worm was intended to gauge the size of the
internet but accidentally replicated itself.
CSE543 - Introduction to Computer and Network Security Page 13
Code Red
• Exploited a Microsoft IIS web-server vulnerability
‣ A vanilla buffer overflow (allows adversary to run code)
‣ Scans for vulnerabilities over random IP addresses
‣ Sometimes would deface the served website
• July 16th, 2001 - outbreak
‣ CRv1- contained bad randomness (fixed IPs searched)
‣ CRv2 - fixed the randomness,
• added DDOS of [Link]
• Turned itself off and on (spread 1st-19th of month, attack 20-27th,
dormant 28-31st)
‣ August 4 - Code Red II
• Different code base, same exploit
• Added local scanning (biased randomness to local IPs)
• Killed itself in October of 2001
CSE543 - Introduction to Computer and Network Security Page 14
Worms and infection
• The effectiveness of a worm is determined by how good it is at
identifying vulnerable machines
‣ Morris used local information at the host
‣ Code Red used what?
• Multi-vector worms use lots of ways to infect
‣ E.g., network, email, drive by downloads, etc.
‣ Others’ backdoors… - another worm, Nimda did this
• Lots of scanning strategies
‣ Signpost scanning (using local information, e.g., Morris)
‣ Random IP - good, but waste a lot of time scanning “dark” or
unreachable addresses (e.g., Code Red)
‣ Permutation scanning - instance is given part of IP space
• What is the fastest way to infect as many machines as possible?
CSE543 - Introduction to Computer and Network Security Page 15
Other scanning strategies
• The doomsday worm: a flash worm
‣ Create a hit list of all vulnerable hosts
• Staniford et al. argue this is feasible
• Would contain a 48MB list

‣ Do the infect and split approach

‣ Use a zero-day vulnerability 5,000,000,000

4,500,000,000

4,000,000,000

3,500,000,000

3,000,000,000

2,500,000,000

2,000,000,000

1,500,000,000

1,000,000,000

500,000,000

• Result: saturate the Internet in less than 30 seconds!

CSE543 - Introduction to Computer and Network Security Page 16
Worms: Defense Strategies
• (Network) Packet Filtering: look for unnecessary or unusual
communication patterns, then drop them on the floor
‣ This is the dominant method, sophisticated
• (Network) Heterogeneity: use more than one vendor for your
networks
Network
Shield
Traffic

Network Interface
Operating
System

• (Host) Patch Your Systems (auto): most, if not all, large worm
outbreaks have exploited known vulnerabilities (with patches)
• Network and Host Intrusion Detection Systems (more later)

CSE543 - Introduction to Computer and Network Security Page 17

Modern Malware
• Now malware has a whole other level of sophistication
• Now we speak of …
• Advanced Persistent Malware
‣ Target specific organizations for a singular objective
‣ Attempt to gain a foothold in the environment
(common tactics include phishing emails)
‣ Escalate privileges – use exploits and password
cracking to acquire administrator privileges
‣ Use the compromised systems as access into the
target network
‣ Collect information on surrounding infrastructure,
‣ Move laterally and deploy additional tools that help
fulfill the attack objective
‣ Cover tracks to maintain access for
future initiatives

CSE543 - Introduction to Computer and Network Security Page 18

Advanced
• More like a software engineering approach
• Growing demand for “reliable” malware
• Want malware to feed into existing criminal enterprise
• Online - criminals use online banking too
• Malware ecosystem
• Measuring Pay-per-Install: The Commoditization of
Malware Distribution, USENIX 2011
• Tool kits
• Sharing of exploit materials
• Combine multiple attack methodologies
• Not hard to find DIY kits for malware

CSE543 - Introduction to Computer and Network Security Page 19

Malware Lifecycle

CSE543 - Introduction to Computer and Network Security Page 20

Persistent
• Malware writers are focused on specific task
• Criminals willing to wait for gratification
• Cyberwarfare
• Low-and-slow
• Can exfiltrate secrets at a slow rate, especially if you
don't need them right away

• Plus can often evade or disable defenses

CSE543 - Introduction to Computer and Network Security Page 21

Threat
• Coordinated effort to complete objective
• Not just for kicks anymore
• Well-funded
• There is money to be made
• … At least that is the perception

CSE543 - Introduction to Computer and Network Security Page 22

Example: Sirefef
• Windows malware - Trojan to install rootkit
• See [Link]
[Link]
• Attack: “Sirefef gives attackers full access to your system”
• Runs as a Trojan software update (GoogleUpdate)
• Runs on each boot by setting a Windows registry entry
• Some versions replace device drivers
• Downloads code to run a P2P communication
• Steal software keys and crack password for software piracy
• Downloads other files to propagate the attack to other
computers

CSE543 - Introduction to Computer and Network Security Page 23

Example: Sirefef
• Windows malware - Trojan to install rootkit
• See [Link]
[Link]
• Stealth: “while using stealth techniques in order to hide its
presence”
• “altering the internal processes of an operating system so
that your antivirus and anti-spyware can't detect it.”
• Disable: Windows firewall, Windows defender
• Changes: Browser settings
• Join bot