Computer Security Principles and Practice Introduction by William

Computer Security: Principles and Practice Introduction by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown & Susan Lincke Chapter 6 – Malicious Software = Malware

Study Sheet Ø Ø Ø Ø Define attacks: cracking, script kiddies, cyberterrorist, phishing, spearphishing, pharming, drive-by download. Define and provide examples for: social engineering, Denial Of Service. Define and describe DDOS, logic bomb, worm, virus, trojan horse, backdoor, botnet, handler, bot, spyware, adware, root kit, spamware, crimeware. Define and describe stealth virus, polymorphic virus, metamorphic virus, macro virus, boot sector virus, zero-day exploit, rate limiting, immune system Describe why ‘ethical’ hackers are not completely ethical. Define the 4 stages of viruses and worms Define 4 mechanisms antivirus software uses to recognize or control viruses and worms

FBI PRIORITIES 1. Protect the United States from terrorist attack 2. Protect the United States against foreign intelligence operations and espionage 3. Protect the United States against cyber-based attacks and high-technology crimes 4. Combat public corruption at all levels 5. Protect civil rights 6. Combat transnational/national criminal organizations and enterprises 7. Combat major white-collar crime 8. Combat significant violent crime 9. Support federal, state, local and international partners 10. Upgrade technology to successfully perform the FBI’s mission

The Problem of Network Security The Internet allows an attacker to attack from anywhere in the world from their home desk. They just need to find one vulnerability: a security analyst need to close every vulnerability.

Progress of Security Attacks Threat Type Year: Example Threats Experiment 1984: Fred Cohen publishes “Computer Viruses: Theory and Experiments” Vandalism Hactivism 1988: Jerusalem Virus deletes all executable files on the system, on Friday the 13 th. 1991: Michelangelo Virus reformats hard drives on March 6, M’s birthday. 2010: Anonymous’ Operation Payback hits credit card and communication companies with DDOS after companies refuse to accept payment for Wiki-Leaks. Cyber 2007: Zeus Trojan becomes ‘popular’; turns computers into zbots and spyware steals crime credit card (CC) numbers. 2008 -9: Gonzales re-arrested for implanting spyware on WLANs, affecting 171 M CC. 2013: In July 160 M CC numbers are stolen via SQL Attack. In Dec. 70 M CC numbers are stolen through Target stores. 2016 -7: Ransomware charges $522 to decrypt your disk; Petya/Not. Petya does not. 2017: Cryptocurrency coin mining Informatio 2007, 2008: Russia launches DDOS attack against Estonia, Georgia news, gov’t, banks n Warfare 2010: Stuxnet worm disables 1000 of Iran’s nuclear centrifuges. 2016 -7: N Korea Lazarus stole $81 M Bangladesh Centralbank, releases Wanna. Cry ransomware to fund military operations. Surveillanc 2012: Chinese affiliations attack U. S. businesses to steal intellectual property. e State 2013: Lavabit closes secure email service rather than divulge corporate private key to NSA without customers’ knowledge.

HISTORY OF CYBER-WAR YEAR FROM -> TO ATTACK DESCRIPTION 2007 Russia -> Estonia DOS attacks on gov’t, financial inst. , news 2008 Russia -> Georgia DOS attacks on Internet, gov’t websites 2008 US -> US Malware to top aides of pres. candidates 2009 China->Embassies, Ghost. Net malware: Command & Control foreign ministries software 2012 US, Israel -> Iran Stuxnet Worm disables nuclear facilities 2010 India <->Pakistan Hacker groups hit gov’t websites 2011 China -> Canada Spyware virus causes shutdown of economic agencies 2012 -> Iran, Middle East Flame cyber-espionage malware 2013 N. Korea -> S. Korea Dark Seoul Malware hits TV, banks; makes computers unusable.

2014 Ponemon Breach Cost by Industry Prob. of Breach Cost/rec Churn rate Communications Consumer Education Energy Financial Health care Hospitality Industry Media Pharmaceutical Public sector Research Retail Services Technology Transportation 15. 6% 19. 9% 21. 1% 7. 5% 17. 1% 19. 2% 19. 5% 9. 0% 19. 7% 16. 9% 23. 8% 11. 5% 22. 7% 19. 8% 18. 9% 13. 5% 219 196 254 237 236 316 93 204 183 209 172 73 125 223 181 286 1. 2 2. 6 2. 0 4. 0 7. 1 5. 3 2. 9 3. 6 1. 9 3. 8 0. 1 0. 7 1. 4 4. 2 6. 3 5. 5

Crackers Cracker: Computer-savvy programmer creates attack software Script Kiddies: Know how to execute programs Criminals: Create & sell botnets -> spam Sell credit card numbers, … Nation States: Cyber-warfare, spying, extortion, DDOS System Administrators Some scripts are useful to protect networks… Get info from hacker bulletin boards Dark Web For Sale: Credit Cards Medical Insurance Identification Malware Crimeware or Attack Kit=$1 K-2 K 1 M Email addresses = $8 10, 000 PCs = $1000

Other Hackers/Crackers: Ø Cyberterrorists Ø Cyberwar: National governments attack IT Ø Espionage: Accused: Russia, North Korea, China, France, South Korea, Germany, Israel, India, Pakistan, US.

Advanced Persistent Threat Ø Advanced: Combination of custom & common malware l Target: Business or Gov’t data/operation Ø Persistent: Extended period attack until target is compromised Ø Threat: Organized, capable, well-funded attacker l Source: Gov’t or criminal enterprise

Who-What-How Cyber-attacks Who What How Organized Crime (50%) Point of Sale CC skimmers Ransomware 56% Cmd & Cntrll 36% DDOS Nation-States (12%) Insiders (28%) Ransomware Data Breach 93% Phishing Cmd & Cntrl Backdoor Malware Privilege misuse Collusion Partners abuse Verizon 2018 Data Breach Investigations Report

A Common Means of Attack

Social Engineering This is John, the System Admin. What is your password? I need a password reset. What is the passwd set to? Email: k has ABC Ban noticed a with problem ount… your acc What ethnicity are you? Your mother’s maiden name? and have some software patches I have come to repair your machine…

Phishing = Fake Email The bank has found problems with your account. Please contact …” ABC BANK Your bank account password is about to expire. Please login… Spearfishing John: Could you send Automated Services $1200? Joe (CEO)

Pharming = Fake web pages Pharming: Ø A fake web page may lead to a real web page Ø The fake web page looks like the real thing l Extracts account information www. abc. com Login Passwd www. abc. Bank. com Welcome To ABC Bank

Drive-By Download Ø A web site exploits a Games: vulnerability in the visitor’s browser when Ø Vampires and Wolfmen Ø Planet of the Apes the site is viewed Ø Dungeons and Dragons

Social Engineering 93% of Breaches Ø Prominent technique: email 96% • Gain Foothold • Techniques: • Malware>67% • Goals: • Financial 59% • Spying 41% Pretexting Phishing Ø • Dialogue • Obtain info, influence • Technique: • CEO impersonation • Human resources: W 2 info->fraudulent tax returns • Finance: transfer $ • Malware 10% • Goals: • Financial: 95% l l Malicious attachment Link to pharming website 78% do not click a single phish all year; Ø 4% phish acceptance rate Ø Verizon 2018 Data Breach Investigations Report

Attack Kit - Crimeware Ø Attack kit = Crimeware: Tools which generate malware automatically l with varied propagation and payload mechanisms Auto-rooter: Breaks into new machines remotely Ø Downloader: Original attack opens the door, then downloads the full attack software Ø Spammer program: Generates large volumes of unwanted email Ø

Exploit/Maintain Access Abnormal way to enter system, provided by Programmer or Vulnerability Backdoor Trojan Horse Useful utility also performs malicious function Bots Slave forwards/performs commands; spreads, list email addrs, DOS attacks Spyware/Adware Replaces system User-Level Rootkit executables: e. g. Login, ls, du to hide itself Spyware collects info: keystroke logger, collect credit card #s, Adware: insert ads, filter search results Kernel-Level Rootkit Replaces OS kernel: e. g. process or file control to hide

Root Kit Ø Upon penetrating a computer, a hacker installs a root kit Ø May enable: l l Easy entrance for the hacker (and others) Keystroke logger Eliminates evidence of break-in Ø Modifies the operating system Ø Requires new OS install, when detected Ø Backdo or entry Keystro ke Logg er H en d id r e s u

Rootkit System Table Mods

Other Malware Logic Bomb: Functional software has a built-in malicious attack or failure mechanism Ø E. g. , Software will malfunction if maintenance fee is not paid Ransomware: E. g. , Pay fee to decrypt software (or just pay fee) Trojan Horse: E. g. , Social Engineering: “Try this game…it is so cool” l Game also emails password file.

Denial of Service Single-Message Do. S Attacks: Crash or disable system by attacking vulnerability Ø Flooder Do. S Attack: Flood victim with requests Ø l l l SYN Flooding: Flood victim host with TCP SYNs (which initiate session). Smurf Attack: Broadcast Pings to third parties with source address of victim host Amplification Attack: Uses Broadcast address (common in 2017) Rabbit or Bacteria: Reproduces exponentially, using up system resources Coin Mining: Your web browser mines cryptocurrencies (e. g. , Monero) for money for attacker

Covert Channel Exfiltrate information outside the organization Ø E. g. : manipulate bits in a jpeg or mpeg Ø E. g. : carry out info in a Lady Ga. Ga CD Ø E. g. : set bytes in an Excel spreadsheet Ø

Mobile Malware Mobile apps can be: Ø Adware: Displays advertisements on other apps Ø Chargeware: Charges for services without explicit notification Ø Riskware: Reduces device security Ø Spyware: Gathers information for another party Ø Trojans: Features useful and unadvertised malicious intent

Malicious Software Ø programs exploiting system vulnerabilities Ø known as malicious software or malware l program fragments that need a host program • e. g. viruses, logic bombs, and backdoors l independent self-contained programs • e. g. worms, bots l replicating or not Ø sophisticated threat to computer systems

Malware Propagation Classification Infection Of Executable (e. g. , Virus) Exploit of Software Vulnerability (SQL Attack, Worm) Social Engineering (E. g. , Phishing, Pretexting Watering hole, Trojans)

Botnets: Command Control Botnets: Bots Attacker Russia Handler Hungary Bots: Host illegal movies, music, pornography, criminal web sites, … Forward Spam for financial gain Sniffing traffic or Keylogging Zombies DDOS, spread bots Manipulate voting games Generate clicks for ads

Bots: Command & Control Ø program taking over other computers Ø hard to trace attacks Ø if coordinated form a botnet Ø characteristics: l remote control facility • via IRC/HTTP etc l spreading mechanism • attack software, vulnerability, scanning strategy Ø various counter-measures applicable

Bot Uses Ø DDOS attacks l E. g. , Internet Relay Chat overload Spamming Ø Spying Ø l l Ø Sniffing traffic Keylogging Malware abuse l l l Spread malware Install advertisement add-ons: pay-for-clicks Manipulating online games

Distributed Denial of Service Zombies Attacker Handler Victim China Russia United States Can barrage a victim server with requests, causing the network to fail to respond to anyone Bots Flooder

Virus A virus attaches itself to a program, file, or disk Ø When the program is executed, the virus too is executed Ø When the program is given away (floppy/email) the virus spreads Ø The virus may be benign or malignant but executes its load pay at some point (often upon contact) Dear John, This link is a cool web site Ø Program A Extra Code Program A infects

Viruses Ø piece of software that infects programs l l Ø modifying them to include a copy of the virus so it executes secretly when host program is run a typical virus goes through phases of: 1. 2. 3. 4. Dormant: Wait for file presence, date, event, … Propagation: Spreading technique Triggering: Complete full intention Execution: Harmless or harmful

Virus Structure Ø components: l l l infection mechanism - enables replication trigger - event that makes payload activate payload - what it does, malicious or benign Ø prepended / postpended / embedded Ø when infected program invoked, executes virus code then original program code Ø can block initial infection (difficult) Ø or propogation (with access controls)

Virus Structure

Compression Virus

Virus Target Classification Ø boot sector: Spreads when system is booted from disk containing virus Ø macro virus: Inserted in application file as script (e. g. , MS Word doc. ) Ø file infector: Infects executable in OS or shell Ø multipartite: Infects multiple ways/files l Difficult to clean, eradicate

Virus Concealment Strategies Ø encrypted virus: Uses a random key to encrypt virus, and stores key with virus Ø stealth virus: Hides via encryption, file sizing, virus location, rootkit Ø polymorphic virus: Mutates new virus with each infection Ø metamorphic virus: Changes itself with each iteration; also polymorphic

Macro Virus Ø became very common in mid-1990 s since l l l platform independent infect documents easily spread Ø exploit macro capability of office apps l l executable program embedded in MS Office doc often a form of Basic Ø more recent releases include protection Ø recognized by many anti-virus programs

E-Mail Viruses Ø more recent development Ø e. g. Melissa l l l exploits MS Word macro in attached doc if attachment opened, macro activates sends email to all on users address list does local damage had no Dormant phase -> faster propagation • 100 k computers in 3 days

Brain Virus Lodges in upper memory then sets upper memory bound below itself Ø Replaces interrupt vector for disk reads to screen disk read calls. Calls interrupt handler after screening. Ø Places itself in the boot sector and six other sectors on disk Ø Marks sectors as ‘bad’ so they will not get overwritten. Ø Variants erase disks or destroy file allocation table Ø

Virus Countermeasures Ø prevention - ideal solution but difficult Ø realistically need: l l l detection identification removal Ø if detect but can’t identify or remove, must discard and replace infected program Ø But what has cracker done in the mean time?

Anti-Virus Evolution Ø virus & antivirus tech have both evolved Ø early viruses simple code, easily removed Ø more complex viruses -> more complex countermeasures Ø 4 generations: l l first - signature scanners second – heuristics • Integrity checking & fragment recognition l l third - identify actions (e. g. , decompression) fourth - combination packages • Limit access control to system & files

Antivirus, Antispyware Antivirus Ø Scheduled scans Ø Antivirus updates Ø Real-time file access protection Ø E-mail protection Ø Popular: Norton, Mc. Afee, Panda, Fprot, AVG Antispyware Ø Real-time protection Ø Scheduled scans Ø Browser hijack protection Ø Auto updates Ø Popular: Spybot, Ad-aware, MS Windows Defender All-in-one also includes Ø URL Filter Ø Content inspection: packet content

Generic Decryption Ø runs executable files through GD scanner: l l l CPU emulator to interpret instructions virus scanner to check known virus signatures emulation control module to manage process Ø lets virus decrypt itself in interpreter Ø periodically scan for virus signatures Ø issue is how long to interpret and scan? l tradeoff chance of detection vs time delay

Digital Immune System

Behavior-Blocking Software

Worm Ø Worm: Independent program which replicates itself and sends copies from computer to computer across network connections. Upon arrival the worm may be activated to replicate. To Joe To Ann To Jill Email List: Joe@uwp. edu Ann@uws. edu Jill@uwm. edu

Worms Ø replicating program that propagates over net l Ø has phases like a virus: l l l Ø using email, remote exec, remote login dormant, propagation, triggering, execution propagation phase: automatically ‘scans’ for other systems, connects to it, copies self to it and runs fast spread phase: each infection spreads to n other nodes, exponentially may disguise itself as a system process

Morris Worm Ø one of best know worms Ø released by Robert Morris in 1988 Ø various attacks on UNIX systems l l l cracking password file to use login/password to logon to other systems exploiting a bug in the finger protocol exploiting a bug in sendmail to issue commands Ø if succeed have remote shell access

Morris Worm – cont’d Created by Robert Morris, convicted 1990, received $10 K fine & 3 years jail, 400 hours community service Ø Unintended Effect: Denial of service due to resource exhaustion: Worms created more worms (even on same machine) Once system penetrated Ø Send a bootstrap loader with 99 lines of C code to be executed on target machine Ø Downloader: Fetch rest of worm, verified by password Ø Stealth: encrypted itself, deleted original version, changed name periodically Ø

Worm Technology Ø Multiplatform: Unix, Windows, … Ø Multi-exploit: travels in multiple ways Ø Polymorphic: generations mutate Ø Metamorphic: self-mutating & polymorphic Ø Transport vehicles: auto-builds bots Ø Zero-day exploit: attacks a vulnerability before vulnerability is known

Worm Countermeasures Ø overlaps with anti-virus techniques Ø once worm on system A/V can detect Ø worms also cause significant net activity Ø worm defense approaches include: l l l signature-based worm scan filtering filter-based worm containment payload-classification-based worm containment threshold random walk scan detection rate limiting and rate halting • puts speed limit on scanning / fignerprinting actions

Proactive Worm Containment Looks for surges in the rate of frequency of outgoing connection attempts and the diversity of connections to remote hosts. When such a surge is detected, the software immediately blocks its host from further connection attempts.

Network Based Worm Defense

Summary: Malware Payload Classification Theft of Information: E. g. Keyloggers, spyware, pharming, exfiltration, ramscraper, stolen credentials Theft of Service Botnet, Denial of Service DDOS, adware, spammers, Command & control Stealth: Hide presence: Rootkit, backdoors, viruses/worms Corruption of System Or Files Virus, worm, rootkit, ransomware

Summary: Malware Controls Countermeasures: Ingress Monitor: Are traffic (flows) entering network valid? Ø Egress Monitor: Is traffic exiting network valid? Ø Host Scanner: Are actions on the computer suspicious? Ø Malware Countermeasure: Are actions by the program suspicious? Ø Distributed Intelligence: Host-based and perimeter sensors, intelligence analysis Ø