Malicious Software - Integrated Computer Security - Lecture Slides, Slides of Computer Security

Download Malicious Software - Integrated Computer Security - Lecture Slides and more Slides Computer Security in PDF only on Docsity! Lecture 13 Malicious Software Docsity.com Malware • [NIST05] defines malware as: “a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system or otherwise annoying or disrupting the victim.” Docsity.com Types of Malicious Software • propagation mechanisms include: – infection of existing content by viruses that is subsequently spread to other systems – exploit of software vulnerabilities by worms or drive-by-downloads to allow the malware to replicate – social engineering attacks that convince users to bypass security mechanisms to install Trojans or to respond to phishing attacks • payload actions performed by malware once it reaches a target system can include: – corruption of system or data files – theft of service/make the system a zombie agent of attack as part of a botnet – theft of information from the system/keylogging – stealthing/hiding its presence on the system Docsity.com Malware Evolution • 1980s – Malware for entertainment (pranks) – 1983: “virus” – 1988: Internet Worm • 1990s – Malware for social status / experiments – 1990: antivirus software • Early 2000s – Malware to spam • Mid 2000s – Criminal malware CS 450/650 Lecture 16: Malicious Codes 6 Docsity.com Malware Evolution CS 450/650 Fundamentals of Integrated Computer Security 7 Docsity.com Viruses • piece of software that infects programs – modifies them to include a copy of the virus – replicates and goes on to infect other content – easily spread through network environments • when attached to an executable program a virus can do anything that the program is permitted to do – executes secretly when the host program is run • specific to operating system and hardware – takes advantage of their details and weaknesses Docsity.com Virus Components •means by which a virus spreads or propagates •also referred to as the infection vector infection mechanism •event or condition that determines when the payload is activated or delivered •sometimes known as a logic bomb trigger •what the virus does (besides spreading) •may involve damage or benign but noticeable activity payload Docsity.com Virus Phases dormant phase • virus is idle • will eventually be activated by some event • not all viruses have this stage triggering phase • virus is activated to perform the function for which it was intended • can be caused by a variety of system events propagation phase •virus places a copy of itself into other programs or into certain system areas on the disk •may not be identical to the propagating version •each infected program will now contain a clone of the virus which will itself enter a propagation phase execution phase • function is performed • may be harmless or damaging Docsity.com Virus Classifications target • boot sector infector – infects a master boot record or boot record and spreads when a system is booted from the disk containing the virus • file infector – infects files that the operating system or shell considers to be executable • macro virus – infects files with macro or scripting code that is interpreted by an application • multipartite virus concealment strategy • encrypted virus – a portion of the virus creates a random encryption key and encrypts the remainder of the virus • stealth virus – a form of virus explicitly designed to hide itself from detection by anti-virus software • polymorphic virus – a virus that mutates with every infection • metamorphic virus a virus that mutates and Docsity.com Macro/Scripting Code Viruses • very common in mid-1990s – platform independent – infect documents (not executable portions of code) – easily spread • exploit macro capability of MS Office applications – more recent releases of products include protection • various anti-virus programs have been developed – so these are no longer the predominant virus threat Docsity.com Worms • program that actively seeks out more machines to infect – each infected machine serves as an automated launching pad for attacks on other machines • exploits software vulnerabilities in client or server programs • can use network connections to spread from system to system • spreads through shared media – USB drives, CD, DVD data disks Docsity.com \Alarm Pronagvation Model 5 5.5 Number of infected hosts x 105 Slow finish Fast spread —- phase Slow start 1 | 1 100 200 300 400 500 Time ¢ (minutes) 600 Docsity.com Morris Worm • earliest significant worm infection – released by Robert Morris in 1988 • designed to spread on UNIX systems – attempted to crack local password file to use login/password to logon to other systems – exploited a bug in the finger protocol which reports the whereabouts of a remote user – exploited a trapdoor in the debug option of the remote process that receives and sends mail • successful attacks achieved communication with the operating system command interpreter – sent interpreter a bootstrap program to copy worm over Docsity.com Recent Worm Attacks Melissa 1998 e-mail worm first to include virus, worm and Trojan in one package Code Red July 2001 exploited Microsoft IIS bug probes random IP addresses consumes significant Internet capacity when active Code Red II August 2001 also targeted Microsoft IIS installs a backdoor for access Nimda September 2001 had worm, virus and mobile code characteristics spread using e-mail, Windows shares, Web servers, Web clients, backdoors SQL Slammer Early 2003 exploited a buffer overflow vulnerability in SQL server compact and spread rapidly Sobig.F Late 2003 exploited open proxy servers to turn infected machines into spam engines Mydoom 2004 mass-mailing e-mail worm installed a backdoor in infected machines Warezov 2006 creates executables in system directories sends itself as an e-mail attachment can disable security related products Conficker (Downadup) November 2008 exploits a Windows buffer overflow vulnerability most widespread infection since SQL Slammer Stuxnet 2010 restricted rate of spread to reduce chance of detection targeted industrial control systems Docsity.com Sapphire/Slammer Worm • was the fastest computer worm in history – doubled in size every 8.5 seconds – infected more than 90 percent of vulnerable ~75K hosts within 10 minutes. CS 450/650 Lecture 16: Malicious Codes 25 Docsity.com Witty Worm • reached its peak activity after approximately 45 minutes – at which point the majority of vulnerable hosts had been infected • World • USA CS 450/650 Lecture 16: Malicious Codes 26 Docsity.com