Dr. Richard Ford

 Szor 11  Virus Scanners – how they work, why they matter, how to write one…

 Look for “known” viruses  Basically, used to look for hex strings in files  Virus writers tried to make this more difficult… (as we saw last week)

 Generic/Specific  On-demand, on-access

 Look for an extracted sequence of bytes  Skill required to select a signature which won’t cause false positives!

 Exact identification…  How about boot sector virus detection?  Sometimes we have data in the string… so we have to use a wildcard  0400 B E 07BB ??02 %3 33C9  Can be Boyer-Moore…  Moore_string_search_algorithm Moore_string_search_algorithm

 Try and pick a string which handles all variants of a virus…  Ideally, can detect variants we don’t know about  (but of course, the badguys have scanners too…)

 Store relative offset of the string  Helps with identification  Can also “bookmark” the location in a sector

 Most viruses only really modify the start/end of a host  So, you can speed up a string scanner by only scanning the “top and tail” of the file  Problem is…

 Use the COM entry/jmp point to work out where to scan  Use offsets in the EXE header  Use “fixed point” scanning (take an entry point of M, and scan at M+X for a string…)

 Don’t have to use DOS to access the disk  Can use the BIOS and skip past the DOS niceties  Also bypasses stealth on Int 21h

 Smart scanning (ignore NOPs in a signature)  Leads to the idea of Skeleton Detection (get rid of whitespace/deadspace)

 How?

 Not a very good name  Means “virus-specific detection algorithm”  Hard-coded detection methods released with the scan engine  Lead to “virus scanning language”  Ultimately, Java (!) like p-code

 As algorithmic scanning is expensive, needs a good pre-filter  Rule: be fast on clean files!  “Quick and dirty” rule out  Number of 0’s at the file end  Look for the types on certain segments  Check file characteristics  Why? Zmist requires 2 million p-code-based iterations!

 Most viruses have very simple encryption – say, constant XOR  Can “decrypt” top and tail of files for all possible keys and use a simple signature on the remainder…  Gives access to unencrypted virus, allowing for repair  Side benefit… detects “broken” decryption loops

 Implement an emulator for instructions!  Code optimization?

 Hard!  Geometric Detection  Focus on “interesting” instructions  Negative and Positive features  Emulator-based heuristics  Long list of Win32 Heuristics  Neural networks…

 Some revision and recap time to prepare for our midterm!