1. Why you should never use the internet

2. Overview  The Situation  Infiltration  Characteristics  Techniques  Detection  Prevention

3. The Situation: Shit Just Got Real  The players and the game has changed Criminal organizations* Governments**  Profit/Politically driven Cyber weapons FBI vs Coreflood  Professionally developed User manuals MaaS *may or may not be organized ** may or may not be criminals

4. Infiltration  Legitimate (compromised) hosts Direct: Wordpress hacked Indirect: Advertisements  Exploit Packs  Search Engine Optimization hacks Breaking news Celebrities (Snookie causes infections)  Social Facebook, Twitter, etc

5. Characteristics (the lines have blurred)  Virus  Trojan/Backdoor  Rootkit  Scam/Scareware/Randsomware  Password stealers  Worms

6. Techniques  API Hooking  Run-time Patching  Boot sector modification  Browser Content replacement

7. API Hooking  Allows malware to intercept Windows API calls  Can be done in user or kernel space, but in kernel space it’s much more powerful

8. API Hooking Program KERNEL MODE USER MODE DeleteFile[A|W] NtDeleteFile ZwDeleteFile System Service Descriptor Table SSDT

9. API Hooking: Example Program KERNEL MODE USER MODE DeleteFile[A|W] NtDeleteFile ZwDeleteFile System Service Descriptor Table SSDT fakeDelete

10. API Hooking  Allows rootkits to do a lot of nasty things Hide processes/files Hide networking (to a degree) Basically take over your system  Fairly straightforward to implement  However, it is easy to detect

11. Run-time Patching  Replaces API calls with your own by patching the API routine itself  Can achieve the same goals as API hooking, but harder to detect

12. Run-time Patching: Example Target Code

13. Run-time Patching: Example Detour JumpMalicious Code Target Code Jump Back

14. Run-time Patching  Very tricky to implement  Harder to detect You have to scan the memory space If it’s not permanent, an offline analysis isn’t very helpful

15. Boot Sector Modification  Changes boot sector code to load an alternative boot loader  This boot loader can change the way Windows boots, including disabling checks and protections  Can be difficult to remove (and detect)

16. Browser Content Replacement  Allows the malware to modify what you see and send in your web browser  Can replace forms, POST data, POST locations, hide data…  “View Source” does nothing: modifications are done in memory  HTTPS is not relevant

17. Browser Content Replacement: Zeus botnet  From the user manual: “Intercepting HTTP/HTTPS-requests from wininet.dll (Internet Explorer, Maxton, etc.), nspr4.dll (Mozilla Firefox) libraries: 1. Modification of the loaded pages content (HTTP-inject). 2. Transparent pages redirect (HTTP-fake). 3. Getting out of the page content the right pieces of data (for example the bank account balance). 4. Temporary blocking HTTP-injects and HTTP-fakes. 5. Temporary blocking access to a certain URL. 6. Blocking logging requests for specific URL. 7. Forcing logging of all GET requests for specific URL. 8. Creating a snapshot of the screen around the mouse cursor during the click of buttons. 9. Getting session cookies and blocking user access to specific URL.”

18. Detection  AV (loosing race)  Monitor outbound communications TCPView Netstat Border monitoring Outbound watching IDS (snort)  System Internals TCPView Procmon RootKitRevealer

19. Detection: GMER  Rootkit detector  Detects: Hidden processes, hidden files, hidden DLLs, hidden registry keys, hidden* SSDT, IAT, EAT hooks MBR modification Suspicious drivers …lots more

20. Detection: GMER

21. Prevention  Update software (not just Windows)  Windows 7 (x64)  EMET  Uninstall Adobe Reader  Chrome/Firefox  VMs/Linux/OSX

22. Further Information  Blogs F-secure: http://www.f-secure.com/weblog/ Sophos: http://nakedsecurity.sophos.com/ Inreverse: http://www.inreverse.net/http://www.inreverse.net/  Online tools Virus Total: http://www.virustotal.com/http://www.virustotal.com/ Anubis: http://anubis.iseclab.org/http://anubis.iseclab.org/  Samples: Malware domain list: http://www.malwaredomainlist.com/ http://www.malwaredomainlist.com/ Offensive Security: http://www.offensivecomputing.net/ http://www.offensivecomputing.net/

23. LayerOne  Hacker con at the Anaheim Marriott  May 28-29  Hardware Hacking, Lockpicking, Contests  $100 online, $140 at the door

24. References  2010 Websense Threat Report: http://www.websense.com/content/threat- report-2010-introduction.aspx?cmpid=prbloghttp://www.websense.com/content/threat- report-2010-introduction.aspx?cmpid=prblog  Verizon 2011 Data Breach Investigations Report: http://www.verizonbusiness.com/resources/reports/rp_data-breach- investigations-report- 2011_en_xg.pdf?&src=/worldwide/resources/index.xml&id= http://www.verizonbusiness.com/resources/reports/rp_data-breach- investigations-report- 2011_en_xg.pdf?&src=/worldwide/resources/index.xml&id  Microsoft Security Intelligence Report v10: http://www.microsoft.com/security/sir/ http://www.microsoft.com/security/sir/  Book: “The Rootkit Arsenal”, by Reverend Bill Blunden  Book: “Malware Analyst’s Cookbook”, by M. Ligh, S. Adair, B. Hartstein, M. Richard  Book: “Reversing: Secrets of Reverse Engineering”, by Eldad Eilam  MSDN Documentation: http://msdn.microsoft.com/en-us/library/default.aspxhttp://msdn.microsoft.com/en-us/library/default.aspx

25. Questions? seanbmcallister@gmail.com