1. Automated Web Patrol with Strider HoneyMonkeys Present by Zhichun Li

2. Overview… Problem @ hand. Proposed solution. Browser based vulnerabilities. The HoneyMonkey system. Evaluation. Questions & Discussion.

3. Problem @ hand… Several attacks exploit browser vulnerabilities and install malware software. E.g. –Download.Ject –Bofra –Xpire.info Current state –manual analysis –Unable to scale. –Do not provide a comprehensive picture.

4. Proposed solution… Active, client-side, VM – based honeypots called Strider HoneyMonkey. Performs large-scale, systematic & automated web patrol. Uses monkey programs of various OS level patches to mimic human browsing. Adopts a state-management methodology. Use of Strider Tracer.

5. Browser based vulnerability exploits… Code obfuscation URL redirection Vulnerability exploitation Malware installation

6. Code obfuscation… Dynamic code injection – document.write() function inside a script. Unreadable code – decoded using unescape() function. Custom decoding routine. Substring replacement using replace() function.

7. URL redirection… Primary URL Protocol redirection using HTTP 302 temporary redirect. HTML tags. Script functions including window.location.replace(). Secondary URL

8. Vulnerability exploitation… Exploiting of multiple browser vulnerabilities. Owing to its popularity IE is attacked a lot. Malware installation… Introduce some piece of arbitrary code on the victim machine in order to achieve a larger attack goal.

9. HoneyMonkey system… Automatically detect and analyze a network of websites that exploit browsers.

10. Exploit detection system… Stage 1 – scalable mode by visiting N- URLs. Stage 2 – perform recursive redirected analysis. Stage 3 – scan exploit URLs using fully patched VMs.

11. Exploit detection - XML report… Executable files created or modified outside the browser sandbox folders. Processes created. Windows registry entries created or modified. Vulnerability exploited. Redirect-URLs visited.

12. Redirection analysis… Stage 1 – act as front end content providers. Traffic redirection – tracked with a BHO – Browser Helper Objects. Recursive scanning. Construction of topology graphs based on traffic redirection. Identify web pages that actually perform the exploit and stop redirection.

13. Topology graphs…

14. Anti-Exploit Process… Generating Input URL Lists – source –Suspicious URLs for analysis. –Popular web sites – if attacked can potentially infect a large population. (measured search engines). –URLs of more localized scope – within organizations or based on history etc… Acting on output exploit-URL data –Stage 1 – output-exploit-URLs. –Stage 2 – output-traffic-redirection topology graph. –Stage 3 – output-zero-day exploit URLs & topology graphs.

15. Overview… Problem @ hand. Proposed solution. Browser based vulnerabilities. The HoneyMonkey system. Evaluation. Questions & Discussion.

16. Statistics of different patch level

17. Node ranking… Node ranking Connection counts no. of exploit URLs

18. Node ranking contd…

19. Zero day exploit detection… Two zero-day exploits discovered –Early July 2005, javaprxy.dll –Second in next hour. Important observations: –Monitoring easy-to-find exploit-URLs is effective. –Monitoring content providers with well known URLs is effective. –Monitoring highly ranked & advanced exploit URLs is effective.

20. Scanning Popular URLs Summary Statistics

21. Node ranking

22. Discussions… Identifying HoneyMonkeys –Targeting HoneyMonkey IP addresses. –Performing a test to determine if a human is present. –Detecting the presence of a VM or the HoneyMonkey code. Exploiting without triggering HoneyMonkey detection – code within browser sandbox. Randomizing the attacks. VSED – vulnerability specific exploit detector.

23. Pros… Automatic. Scalability. Non-signature based approach. Stage-wise. Zero-day exploits.