CS 492/592: Malware http://thefengs.com/wuchang/courses/cs492
Syllabus
Motivation How can I tell what the software I'm running is doing? A useful skill to have
Example #1: FBI Playpen 8/2014
Example #2: Stuxnet
Example #3: Shellshock
What is malware? Set of instructions that run on your computer and make your system do something that an attacker wants it to do
Why is it so prevalent? Unprecedented connectivity Vulnerable users Homogenous software and hardware Focus on time to market Mature malicious software industry Data and instruction mixing (see next)
Data vs. code Data is information that your CPU acts on Code tells your CPU to take action (danger!) To a computer, what’s the difference between code and data? …. Not much * Data & code are intermixed these days ELF, .exe, .html, .doc …. Adds flexibility (.doc), features (.html), and efficiency (.js)
Types of malware Viruses and worms Botnets Backdoors Self-replicating code that infects other systems manually or automatically Botnets Software that puts your computer under the remote control of an adversary to send spam or attack other systems Backdoors Code that bypasses normal security controls to provide continued, unauthorized access to an adversary Trojans, launchers Code that appears legitimate, but performs an unauthorized action
Types of malware Rootkits Information theft Ransomware Tools to hide the presence of an adversary Information theft Collects credentials (e.g. keystroke loggers) Steal files (credit card data exfiltration) Gather information on you, your habits, web sites you visit (e.g. spyware) Monitor activity (webcams) Ransomware Code that renders your computer or data inaccessable until payment received
Types of malware Resource or identity theft Scareware Adware Store illicit files (copyrighted material) Stepping stone to launder activity (frame you for a crime) Scareware Code that tricks users into buying products they do not need Adware Code that tricks users into clicking illegitimate advertisements Drive-by downloads Code automatically downloaded via the web
This course Learn tools and techniques to analyze what malicious software does
Ethics Explore only on your own systems or places you have permission to Do not break or break into other people's machines
But first… Course assumes an understanding of how software executes on a system Pre-requisites for the course Mastery of topics in CS 201 and CS 333 If you can not pass this exam, you will not be able to continue
Entrance exam Short test to ensure you have what you need to succeed in the course If you can not pass this exam, I will contact you with a recommendation that you find an alternate course Open slots in course will be offered to those on the waitlist who are best prepared for the course (based on exam results) 20 minutes
VM for course See handout Vanilla Windows XP VM image located on MCECS file server /stash/cs492/492_WinXP_x86.ova All software from book installed Contact support@cat.pdx.edu if you are not in the “vagrant” group
Installed software on your VM Install WinXP 32-bit instance with VirtualBox Guest Additions CD Install cygwin with sharutils, binutils, zip/unzip, and nc Install WinRAR or cygwin p7zip Install Sysinternals tools (Process Explorer, Process Monitor) (technet.microsoft.com) Install PEView (wjradburn.com) Install Resource Hacker (angusj.com) Install Dependency Walker (dependencywalker.com) Install IDA Pro 5.0 Freeware (hex-rays.com) Install Wireshark (wireshark.org) Install Apate DNS (mandiant.com) Install OllyDbg 1.10 (ollydbg.de) and its Phant0m plug-in (woodmann.com) Install WinHex (winhex.com) Install PEiD (softpedia.com) <= CAUTION, it is a zip file not an installer Install UPX (upx.sourceforge.net) Install Regshot (code.google.com/p/regshot/) Install labs from textbook (practicalmalwareanalysis.com) Encrypted zipfile (password: malware) Will set off Windows defender alarms Make two copies, a working one and a read-only one