Open Malicious Source Symantec Security Response Kaoru Hayashi

Agenda  What is Open Malicious Source  Characteristics  Protection  Conclusion

What is Open Malicious Source  Open Source qualities –Free redistribution –Ready access to source code –Modifiable by anyone –Designed for evolution  For malicious purposes

For example…  Beagle, Mydoom, Netsky and Sasser –Not open malicious source –Created by an author, closed group, or individuals who can obtain source code  Gaobot, Randex and Spybot –Open malicious source –Source codes are distributed widely –Updated / released by many

Is this topic new?  NO, but …  Programs developed from open malicious source are on the rise  Impact is intensifying

Number of Submissions: Worms

Number of Submissions: Worms from open malicious source

Number of new variants: Worms

Number of new variants: Worms from open malicious source

Characteristics  Easy to create  Purpose-oriented  Difficult to recognize

Characteristics: Easy to create  Easy to obtain from the Internet –Whole project files –New codes, samples,or tools –Free compiler  No special knowledge, tool, or code required  A wide range of people are creating their own bot

Characteristics: Easy to create Easy to obtain

Characteristics: Easy to create Sample: Spybot

Case: Spybot W32.Spybot.A  Discovered on 2003/04/16  Backdoor –Based on backdoor “Sdbot” –Supports 22 commands including:  Key logging  Killing processes  Stealing cached password  DoS attacks  Worm –Copies itself to C$, ADMIN$, and IPC$ shares –Dictionary attack (17 keywords)  , admin, root, server…. –Schedules a job to run Worm Backdoor

Case: Spybot W32.Spybot.DNC  Discovered on 2004/09/13 as the 3071 st variant  Backdoor –Supports over 90 commands including:  Upload / Download / Execute files  Run as HTTP server / SOCKS4 proxy  Steal 42 Game CD-KEYs  Access CMD.exe  Sniff packets  Access Web Camera Worm Backdoor Additional Code

Case: Spybot W32.Spybot.DNC  Worm –Dictionary attack  139 keywords per password –Uses other worms or Trojans  Beagle, Mydoom, Optix, Sub7, NetDevil Worm Additional Code Backdoor Additional Code

Case: Spybot W32.Spybot.DNC  Vulnerability Attack –MS (UPnP) –MS (SQL) –MS (WebDAV) –MS (DCOM RPC) –MS (Workstation) –MS (LSASS)  Packed with Runtime Packer Worm Additional Code Backdoor Additional Code Vulnerability Attack Polymorphic / Packer

Case: Randex and Gaobot Worm W32.Randex (discovered on 2003/06/04) Worm Backdoor W32.Gaobot (discovered on 2002/10/22) Worm Backdoor Vulnerability Attack Polymorphic / Packer Over 1600 variants Worm Backdoor Vulnerability Attack Polymorphic / Packer Over 1600 variants

Case: Randex, Gaobot and Spybot  Now they look very similar –Backdoor layer usually based on “Sdbot” –Same codes / concepts implemented in each layer –Further similar worms / backdoors exist: i.e., Kwbot, IRCBot Worm Backdoor Vulnerability Attack Polymorphic / Packer Worm Backdoor Vulnerability Attack Polymorphic / Packer Worm Backdoor Vulnerability Attack Polymorphic / Packer

Characteristics: Easy to create By a lot of people May: Gaobot author arrested in Germany May: Randex author arrested in Canada June, July, August: New variants created

Characteristics: Purpose  Not only for fun –Propagation –Proof of concept  For profit –Information theft –System control –DDoS zombies –Financial gain

Characteristics: Purpose  –Propagation  Mass mailing  P2P or share networks –Payload  Removes Beagle, Mydoom, Deadhat, and Welchia worms  W32.Gaobot.BIA –Propagation  Dictionary attack  Vulnerability attack –Payload  Logs keystrokes  Sniffs packets  Steals CD-KEYs  Steals cached password  Obtains system / network information  Gains full system control  SOCKS proxy  DDoS attack  and more….

Characteristics: Difficult to recognize  Slow and limited propagation –Differs from mass mailers, Blaster, and Code Red –Little public interest  Automatic copy / execution on remote computers - By using a scheduler or by exploiting vulnerabilities  Many new variants released over a short time period –Over 600 variants a month  New variants are target-specific –You may be the only infected one, worldwide.

How to stop  Stopping the development of new threats is almost impossible –Source codes are distributed widely –Authors are located around the globe –New codes, samples, and tools are released every day

How to protect  Anti-virus tools –Definitions, Heuristics, Behavior blocking ….  Firewall  IDS  Patch management  Password management  Security policy  Learning, Studying, Educating … Nothing new, nothing special. But we know maintaining all is not easy.

Conclusion  Malicious source is distributed widely  A lot of people are creating their own bot  Sharing source code results in more powerful threats  Main purpose is profit  No magic trick to secure protection

Thank You! Kaoru Hayashi