1. Dr. Richard Ford rford@fit.edu

2.  Szor 11  Virus Scanners – how they work, why they matter, how to write one…

3.  Look for “known” viruses  Basically, used to look for hex strings in files  Virus writers tried to make this more difficult… (as we saw last week)

4.  Generic/Specific  On-demand, on-access

5.  Look for an extracted sequence of bytes  Skill required to select a signature which won’t cause false positives!

6.  Exact identification…  How about boot sector virus detection?  Sometimes we have data in the string… so we have to use a wildcard  0400 B801 020E 07BB ??02 %3 33C9  Can be Boyer-Moore…  http://en.wikipedia.org/wiki/Boyer- Moore_string_search_algorithm http://en.wikipedia.org/wiki/Boyer- Moore_string_search_algorithm

7.  Try and pick a string which handles all variants of a virus…  Ideally, can detect variants we don’t know about  (but of course, the badguys have scanners too…)

8.  Store relative offset of the string  Helps with identification  Can also “bookmark” the location in a sector

9.  Most viruses only really modify the start/end of a host  So, you can speed up a string scanner by only scanning the “top and tail” of the file  Problem is…

10.  Use the COM entry/jmp point to work out where to scan  Use offsets in the EXE header  Use “fixed point” scanning (take an entry point of M, and scan at M+X for a string…)

11.  Don’t have to use DOS to access the disk  Can use the BIOS and skip past the DOS niceties  Also bypasses stealth on Int 21h

12.  Smart scanning (ignore NOPs in a signature)  Leads to the idea of Skeleton Detection (get rid of whitespace/deadspace)

13.  How?

14.  Not a very good name  Means “virus-specific detection algorithm”  Hard-coded detection methods released with the scan engine  Lead to “virus scanning language”  Ultimately, Java (!) like p-code

15.  As algorithmic scanning is expensive, needs a good pre-filter  Rule: be fast on clean files!  “Quick and dirty” rule out  Number of 0’s at the file end  Look for the types on certain segments  Check file characteristics  Why? Zmist requires 2 million p-code-based iterations!

16.  Most viruses have very simple encryption – say, constant XOR  Can “decrypt” top and tail of files for all possible keys and use a simple signature on the remainder…  Gives access to unencrypted virus, allowing for repair  Side benefit… detects “broken” decryption loops

17.  Implement an emulator for instructions!  Code optimization?

18.  Hard!  Geometric Detection  Focus on “interesting” instructions  Negative and Positive features  Emulator-based heuristics  Long list of Win32 Heuristics  Neural networks…

19.  Some revision and recap time to prepare for our midterm!