Overview What is a worm? What is a worm? Origin? Origin? How does it propagate? How does it propagate? How does it take up resources of an infected node? How does it take up resources of an infected node? “Deworming” an infected machine “Deworming” an infected machine

Definition and Origin A worm is a program A worm is a program that can run by itself and that can run by itself and can propagate a fully working version of itself to other machines. can propagate a fully working version of itself to other machines. First worm that ever surfaced is RTM(1998) First worm that ever surfaced is RTM(1998) RTM=Robert T. Moris, author of the program. RTM=Robert T. Moris, author of the program. Propagated by exploiting vunerabilities in Unix systems. Propagated by exploiting vunerabilities in Unix systems. Compiled and run new instances of itself on these systems. Compiled and run new instances of itself on these systems. Other worms Other worms Raman worm (2000) Raman worm (2000) Code Red (September Windows) Code Red (September Windows) Nimda (2001) Nimda (2001) Apache Scalper (June 2002) Apache Scalper (June 2002)

Apache Scalper worm Appeared in June 2002 Appeared in June 2002 Turns system to a node of a P2P network Turns system to a node of a P2P network Features Features Launch denial of service attack. Launch denial of service attack. Send multiple messages (spam). Send multiple messages (spam). Run arbitrary commands on the compromised system. Run arbitrary commands on the compromised system. Upgrade the node worm program. Upgrade the node worm program. Communication by simple P2P networking protocol Communication by simple P2P networking protocol Internodes communication Internodes communication Communication between nodes and controlling program Communication between nodes and controlling program –Carried over UDP

The slapper worm Surfaced in Romania in Surfaced in Romania in Variant of the Apache Scalper worm. Variant of the Apache Scalper worm. Comparing source code. Comparing source code. Slapper worm more robust and efficient in it’s peer to peer network capabilities than Apache Scalper worm. Slapper worm more robust and efficient in it’s peer to peer network capabilities than Apache Scalper worm. Some fatures of apache removed Some fatures of apache removed –Self updating –Sending spam Distributed Denial of Service Agent Distributed Denial of Service Agent Backdoor Backdoor Propagation using UDP Propagation using UDP

Reliability layer Adds header to packet Adds header to packet Singned character (1=message,0=ack). Singned character (1=message,0=ack). Copy of sent messages in message queue for reliable communication. Copy of sent messages in message queue for reliable communication. Message in queue contains(last 128 messages) Message in queue contains(last 128 messages) Message ID Message ID Time of first sent and time of last sent. Time of first sent and time of last sent. Destination IP address Destination IP address UDP port number UDP port number –Protection against sending or receiving and acting on same message twice. –Deletion of message.

Initialization New node sends join network command to parent. New node sends join network command to parent. Parent responds with a your IP address command. Parent responds with a your IP address command. Broadcasting to other nodes. Broadcasting to other nodes. Empty list of known nodes in new node? Empty list of known nodes in new node? »Failure communication with parent Node sends join network request every 60 seconds Node sends join network request every 60 seconds Node split after complete failure to join network. Node split after complete failure to join network.

Routing Node wants to send a command or message to another node. Node wants to send a command or message to another node. Command encapsulated in “route” command. Command encapsulated in “route” command. Contains Contains –Destination’s IP address –Minimum number of hops(H) Bouncing Bouncing –0 16  destination IP else  two random nodes. –Anonymity. Segmentation Segmentation Route command sent to at least two nodes at every hop. Route command sent to at least two nodes at every hop. Destination node receives 2^H commands. Destination node receives 2^H commands. Duplicates command likely to be processed. Duplicates command likely to be processed. next next

Synchronisation and Broadcasting Broadcasting: Broadcasting: To announce the presece of a new node. To announce the presece of a new node. Destination IP set to zero. Destination IP set to zero. Broadcast segmentation Broadcast segmentation  2 random nodes Synchronisation: Synchronisation: To keep nodes up to date with present number of nodes in network. To keep nodes up to date with present number of nodes in network. Broadcasting of null route command approximately every 10 mins. Broadcasting of null route command approximately every 10 mins. Null route command contains present number of nodes in network. Null route command contains present number of nodes in network. Next Next

Exploit and propagate mod_ssl exploit OpenSSL (30/07/2002) mod_ssl exploit OpenSSL (30/07/2002) –Long SSL2 key argument -> buffer overflow In 3 months different versions In 3 months different versions –Slapper, Cinik, Unlock, Linux.DevNull –Discussion open source »Good for both use and abuse Brett Glass: Brett Glass: –“Upgrading may prevent your system from being taken over, but --> berserk network load, DoS”

Exploit 3 steps 3 steps –A] identify target »Sends invalid GET request ( » => Apache version + OS –B] locate heap in Apache process address space –C] “injected with a poison” (spawn /bin/sh) [B&C]: attack buffer must contain absolute address of the shell code (hardly predictable across all servers)

B] Buffer overflow Heap-located ( stack-based ) Heap-located ( stack-based ) –Global Offset Table »holds addresses of the library functions to call –Key argument > 8 bytes –Victim parses packet data »get_client_master_key() - libssl, no boundary check »Overwriting info following key_arg »In SSL_SESSION structure AND heap management data

B] Buffer Overflow to locate heap

B] Buffer overflow Heap-located ( stack-based ) Heap-located ( stack-based ) –Global Offset Table »holds addresses of the library functions to call –Key argument > 8 bytes –Victim parses packet data »get_client_master_key() - libssl, no boundary check »Overwriting info following key_arg »In SSL_SESSION structure AND heap management data

SSL_SESSION Structure on Heap

B] Buffer overflow => Location of heap revealed => Location of heap revealed key_arg[] buffer overflowed by 56 bytes (8+48), up to the session_id_length field key_arg[] buffer overflowed by 56 bytes (8+48), up to the session_id_length field Edit session_id_length -> 112 Edit session_id_length -> 112 –*cipher = encryption method –*ciphers = structure after SSL_SESSION

C] Second overflow (-> /bin/sh) 1. Corrupt heap management data 1. Corrupt heap management data after key_arg[] –24 bytes data (AAAAA..., p -> NULL, *cipher) –124 bytes shell code 2. Abuse free() to redirect control to shell code 2. Abuse free() to redirect control to shell code –~glibc

SSL_SESSION Structure after C]

Propagate Try to get root after [C] (setuid) Try to get root after [C] (setuid) Download sourcecode from parent Download sourcecode from parent Compile => party on Compile => party on Slapper == DDoS and Backdoor agent Slapper == DDoS and Backdoor agent