Download presentation
Presentation is loading. Please wait.
1
Stealing Passwords Remotely & Malware Analysis PacITPros May 8, 2012
2
Bio
3
Summary HTTP & HTTPS Passwords in RAM Windows Logon Passwords in RAM Java Attacks Evading Antivirus Malware Analysis Overview
4
HTTP & HTTPS Passwords in RAM
5
HTTP Web Login HTTP Authentication: Wikipedia
6
HTTP Web Login Password is transmitted over the Internet in plaintext Wireshark capture on next slide – Capture login – Statistics, Conversations – TCP tab – Follow Stream (with 13 packets)
8
Using HxD Freeware
10
Password Found
11
HTTPS Web Login
12
Password Found!
13
Windows Logon Passwords in RAM
14
Windows Login Password
15
Not Found Windows doesn’t store login passwords in cleartext in RAM
16
Windows Credential Editor Written by Hernan Ochoa, 2011
19
Passwords are Encrypted But the Keys are in RAM
20
Java Attacks
26
This Attack is Not Counted in Those Graphs The attack I am demonstrating does not rely on any of those vulnerabilities This is Java operating as intended Works on fully updated Java No patch can be expected
27
Social-Engineer Toolkit In BackTrack Linux
28
User Sees This Warning
29
Stolen Password!
30
Evading Antivirus
31
Effectiveness of AV Evasion
32
Countermeasures Disable Java Don’t use Adobe products Antivirus helps some Antivirus + Deep Freeze helps a LOT BUT DON’T TRUST ANY COUNTERMEASURE – They are all easily bypassed
33
Malware Analysis
34
Techniques Basic Static Analysis: File, Strings, and AV Basic Dynamic Analysis: RegShot, Wireshark, Process Monitor, LordPE Advanced Static Analysis: IDA Pro Advanced Dynamic Analysis: Debuggers (not included in this talk)
35
Basic Static Analysis
36
Harvesting Malware from Packet Captures with Wireshark
37
Save As
38
File
39
Strings
40
Basic Dynamic Analysis Run Malware in a Virtual Machine
41
Process Monitor
42
RegShot
43
RegShot Results
44
Process Monitor Results
45
Packed Executables.exe file lacks readable strings When executed, the file unpacks itself into RAM and runs there Solution: Analyze the RAM, not the hard disk file
46
LordPE
48
Advanced Static Analysis IDA Pro
49
Disassembler
50
Mind-Boggling Complexity
51
Skip Details
52
Module A: Compare, Jump
53
Module C: Usage Instructions
54
C Source Code
55
Solution
Similar presentations
