Malicious Software Malicious Software Han Zhang & Ruochen Sun.

Slides:



Advertisements
Similar presentations
Computer Security Patricia Roy Manatee Community College, Venice, FL ©2008, Prentice Hall Chapters 14 and 15 Operating Systems: Internals and Design Principles,
Advertisements

Chapter 19: Computer and Network Security Techniques Business Data Communications, 6e.
Lecture 13 Malicious Software modified from slides of Lawrie Brown.
Cryptography and Network Security Chapter 19 Fourth Edition by William Stallings.
Karlstad University Malware Ge Zhang Karlstad Univeristy.
Lecture 14 Malicious Software (cont) modified from slides of Lawrie Brown.
Malware Ge Zhang Karlstad Univeristy. Focus What malware are Types of malware How do they propagate How do they hide How to detect them.
Chapter 14 Computer Security Threats
Cryptography and Network Security Malicious Software Third Edition by William Stallings Lecturer: Dr. Saleem Alzoubi.
Chapter 14 Computer Security Threats Patricia Roy Manatee Community College, Venice, FL ©2008, Prentice Hall Operating Systems: Internals and Design Principles,
Malicious Software programs exploiting system vulnerabilities known as malicious software or malware program fragments that need a host program e.g. viruses,
1 Pertemuan 05 Malicious Software Matakuliah: H0242 / Keamanan Jaringan Tahun: 2006 Versi: 1.
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.
Guide to Operating System Security Chapter 2 Viruses, Worms, and Malicious Software.
Cryptography and Network Security Chapter 21
By:Tanvi lotliker TE COMPUTER
Henric Johnson1 Chapter 10 Malicious Software Henric Johnson Blekinge Institute of Technology, Sweden
Logical Security threats. Logical security Protects computer-based data from software-based and communications- based threats.
Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 7 – Malicious Software.
1 Ola Flygt Växjö University, Sweden Malicious Software.
1 Chap 10 Malicious Software. 2 Viruses and ”Malicious Programs ” Computer “Viruses” and related programs have the ability to replicate themselves on.
Chapter 15: Security (Part 1). The Security Problem Security must consider external environment of the system, and protect the system resources Intruders.
Network and Internet Security SYSTEM SECURITY. Virus Countermeasures Antivirus approach ◦Ideal solution: Prevention ◦Not allowing the virus to infect.
Malicious Code Brian E. Brzezicki. Malicious Code (from Chapter 13 and 11)
Malware  Viruses  Virus  Worms  Trojan Horses  Spyware –Keystroke Loggers  Adware.
The Utility Programs: The system programs which perform the general system support and maintenance tasks are known as utility programs. Tasks performed.
BY ANDREA ALMEIDA T.E COMP DON BOSCO COLLEGE OF ENGINEERING.
Malicious Software CIS 4361 Eng. Hector M Lugo-Cordero, MS Feb
Data Security and Encryption (CSE348) 1. Lecture # 27 2.
Lecture 14 Overview. Program Flaws Taxonomy of flaws: – how (genesis) – when (time) – where (location) the flaw was introduced into the system 2 CS 450/650.
1 Chapter 19: Malicious Software Fourth Edition by William Stallings Lecture slides by Lawrie Brown (Modified by Prof. M. Singhal, U of Kentucky)
CHAPTER 14 Viruses, Trojan Horses and Worms. INTRODUCTION Viruses, Trojan Horses and worm are malicious programs that can cause damage to information.
1 Chap 10 Virus. 2 Viruses and ”Malicious Programs ” Computer “Viruses” and related programs have the ability to replicate themselves on an ever increasing.
Virus Detection Mechanisms Final Year Project by Chaitanya kumar CH K.S. Karthik.
Chapter 11 Malicious Software
1 Figure 4-16: Malicious Software (Malware) Malware: Malicious software Essentially an automated attack robot capable of doing much damage Usually target-of-opportunity.
Viruses and Related Threats. 2 Summary  have considered:  various malicious programs  trapdoor, logic bomb, trojan horse, zombie  viruses  worms.
Fourth Edition by William Stallings Adapted form lecture slides by Lawrie Brown.
Chapter 10 Malicious software. Viruses and ” Malicious Programs Computer “ Viruses ” and related programs have the ability to replicate themselves on.
Week 10-11c Attacks and Malware III. Remote Control Facility distinguishes a bot from a worm distinguishes a bot from a worm worm propagates itself and.
BY FIOLA CARVALHO TE COMP. CONTENTS  Malicious Software-Definition  Malicious Programs Backdoor Logic Bomb Trojan Horse Mobile Code Multiple-Threat.
Viruses a piece of self-replicating code attached to some other code – cf biological virus both propagates itself & carries a payload – carries code to.
Malicious Software.
Chapter 19 – Malicious Software What is the concept of defense: The parrying of a blow. What is its characteristic feature: Awaiting the blow. —On War,
Computer Security Threats CLICKTECHSOLUTION.COM. Computer Security Confidentiality –Data confidentiality –Privacy Integrity –Data integrity –System integrity.
Cryptography and Network Security Chapter 19 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.
MALICIOUS SOFTWARE Rishu sihotra TE Computer
Page 1 Viruses. Page 2 What Is a Virus A virus is basically a computer program that has been written to perform a specific set of tasks. Unfortunately,
Malicious Programs (1) Viruses have the ability to replicate themselves Other Malicious programs may be installed by hand on a single machine. They may.
CSEN 1001 Computer and Network Security Amr El Mougy Mouaz ElAbsawi.
Information Systems CS-507 Lecture 32. Physical Intrusion The intruder could physically enter an organization to steal information system assets or carry.
Prof. Wenguo Wang Network Information Security Prof. Wenguo Wang Tel College of Computer Science QUFU NORMAL UNIVERSITY.
Attack Methods  Attacks  DoS (Denial of Service)  Malware.
Detected by, M.Nitin kumar ( ) Sagar kumar sahu ( )
Protecting Computers From Viruses and Similarly Programmed Threats Ryan Gray COSC 316.
Cosc 4765 Antivirus Approaches. In a Perfect world The best solution to viruses and worms to prevent infected the system –Generally considered impossible.
Company LOGO Malicious SW By Dr. Shadi Masadeh 1.
Cryptography and Network Security Chapter 21
MALWARE.
LECTURE 6 MALICIOUS SOFTWARE
Malicious Software.
Viruses and Other Malicious Content
BINF 711 Amr El Mougy Sherif Ismail
Cryptography and Network Security Chapter 21
NET 311 Information Security
Chap 10 Malicious Software.
Chap 10 Malicious Software.
Malicious Program and Protection
Presentation transcript:

Malicious Software Malicious Software Han Zhang & Ruochen Sun

Malicious Software

 Nilvo&feature=channel_video_title

Backdoor or Trapdoor  secret entry point into a program  allows those who know access bypassing usual security procedures  have been commonly used by developers  a threat when left in production programs allowing exploited by attackers  requires good s/w development & update

Logic Bomb  one of oldest types of malicious software  code embedded in legitimate program  activated when specified conditions met eg presence/absence of some file eg presence/absence of some file particular date/time particular date/time particular user particular user  when triggered typically damage system modify/delete files/disks, halt machine, etc modify/delete files/disks, halt machine, etc

Trojan Horse  program with hidden side-effects  which is usually superficially attractive eg game, s/w upgrade etc eg game, s/w upgrade etc  when run performs some additional tasks allows attacker to indirectly gain access they do not have directly allows attacker to indirectly gain access they do not have directly  often used to propagate a virus/worm or install a backdoor  or simply to destroy data

Mobile Code  program/script/macro that runs unchanged on heterogeneous collection of platforms on heterogeneous collection of platforms on large homogeneous collection (Windows) on large homogeneous collection (Windows)  transmitted from remote system to local system & then executed on local system  often to inject virus, worm, or Trojan horse  or to perform own exploits unauthorized data access, root compromise unauthorized data access, root compromise

Multiple-Threat Malware  malware may operate in multiple ways  multipartite virus infects in multiple ways eg. multiple file types eg. multiple file types  blended attack uses multiple methods of infection or transmission to maximize speed of contagion and severity to maximize speed of contagion and severity may include multiple types of malware may include multiple types of malware eg. Nimda has worm, virus, mobile code eg. Nimda has worm, virus, mobile code can also use IM & P2P can also use IM & P2P

Viruses  piece of software that infects programs modifying them to include a copy of the virus modifying them to include a copy of the virus so it executes secretly when host program is run so it executes secretly when host program is run  specific to operating system and hardware taking advantage of their details and weaknesses taking advantage of their details and weaknesses  a typical virus goes through phases of: dormant dormant propagation propagation triggering triggering execution execution

Virus Structure  components: infection mechanism - enables replication infection mechanism - enables replication trigger - event that makes payload activate trigger - event that makes payload activate payload - what it does, malicious or benign payload - what it does, malicious or benign  prepended / postpended / embedded  when infected program invoked, executes virus code then original program code  can block initial infection (difficult)  or propogation (with access controls)

Virus Structure

Compression Virus

Virus Classification  boot sector  file infector  macro virus  encrypted virus  stealth virus  polymorphic virus  metamorphic virus

Macro Virus  became very common in mid-1990s since platform independent platform independent infect documents infect documents easily spread easily spread  exploit macro capability of office apps executable program embedded in office doc executable program embedded in office doc often a form of Basic often a form of Basic  more recent releases include protection  recognized by many anti-virus programs

Viruses  more recent development  e.g. Melissa exploits MS Word macro in attached doc exploits MS Word macro in attached doc if attachment opened, macro activates if attachment opened, macro activates sends to all on users address list sends to all on users address list and does local damage and does local damage  then saw versions triggered reading  hence much faster propagation

Virus Countermeasures  prevention - ideal solution but difficult  realistically need: detection detection identification identification removal removal  if detect but can’t identify or remove, must discard and replace infected program

Anti-Virus Evolution  virus & antivirus tech have both evolved  early viruses simple code, easily removed  as become more complex, so must the countermeasures  generations first - signature scanners first - signature scanners second - heuristics second - heuristics third - identify actions third - identify actions fourth - combination packages fourth - combination packages

Generic Decryption  runs executable files through GD scanner: CPU emulator to interpret instructions CPU emulator to interpret instructions virus scanner to check known virus signatures virus scanner to check known virus signatures emulation control module to manage process emulation control module to manage process  lets virus decrypt itself in interpreter  periodically scan for virus signatures  issue is long to interpret and scan tradeoff chance of detection vs time delay tradeoff chance of detection vs time delay

Digital Immune System

Behavior-Blocking Software

Worms  replicating program that propagates over net using , remote exec, remote login using , remote exec, remote login  has phases like a virus: dormant, propagation, triggering, execution dormant, propagation, triggering, execution propagation phase: searches for other systems, connects to it, copies self to it and runs propagation phase: searches for other systems, connects to it, copies self to it and runs  may disguise itself as a system process  concept seen in Brunner’s “Shockwave Rider”  implemented by Xerox Palo Alto labs in 1980’s

Morris Worm  one of best know worms  released by Robert Morris in 1988  various attacks on UNIX systems cracking password file to use login/password to logon to other systems cracking password file to use login/password to logon to other systems exploiting a bug in the finger protocol exploiting a bug in the finger protocol exploiting a bug in sendmail exploiting a bug in sendmail  if succeed have remote shell access sent bootstrap program to copy worm over sent bootstrap program to copy worm over

Worm Propagation Model

Recent Worm Attacks  Code Red July 2001 exploiting MS IIS bug July 2001 exploiting MS IIS bug probes random IP address, does DDoS attack probes random IP address, does DDoS attack  Code Red II variant includes backdoor  SQL Slammer early 2003, attacks MS SQL Server early 2003, attacks MS SQL Server  Mydoom mass-mailing worm that appeared in 2004 mass-mailing worm that appeared in 2004 installed remote access backdoor in infected systems installed remote access backdoor in infected systems  Warezov family of worms scan for addresses, send in attachment scan for addresses, send in attachment

Worm Technology  multiplatform  multi-exploit  ultrafast spreading  polymorphic  metamorphic  transport vehicles  zero-day exploit

Mobile Phone Worms  first appeared on mobile phones in 2004 target smartphone which can install s/w target smartphone which can install s/w  they communicate via Bluetooth or MMS  to disable phone, delete data on phone, or send premium-priced messages  CommWarrior, launched in 2005 replicates using Bluetooth to nearby phones replicates using Bluetooth to nearby phones and via MMS using address-book numbers and via MMS using address-book numbers

Worm Countermeasures  overlaps with anti-virus techniques  once worm on system A/V can detect  worms also cause significant net activity  worm defense approaches include: signature-based worm scan filtering signature-based worm scan filtering filter-based worm containment filter-based worm containment payload-classification-based worm containment payload-classification-based worm containment threshold random walk scan detection threshold random walk scan detection rate limiting and rate halting rate limiting and rate halting

Proactive Worm Containment

Network Based Worm Defense

THANK YOU!