Intro to COBIT Part 1 Threat Landscape Presented

Intro to COBIT Part 1 Threat Landscape Presented by George Grachis CISSP

Current Trends

UCLA Database Hacked n n Hacker attack at UCLA affects 800, 000 people POSTED: 2: 50 p. m. EST, December 12, 2006

UCLA says hacker invaded database for more than a year • Info exposed on about 800, 000 students, faculty, staff • Data included Social Security numbers, birth dates, addresses • UCLA: No evidence any data have been misused

Malware Defined

What is malicious code? As the name implies, it is software that is designed and developed with malicious intent. This includes gaining unauthorized access, network vandalism, theft of data or services, and destruction of software, data, or systems. We classify malicious code as : n n n Trojan Horses Worms Viruses

Trojan Horses A trojan horse is a generic term used to describe a computer program containing an apparent or actual useful function that also contains additional (hidden) functions that allows unauthorized collection, falsification, or destruction of data

Viruses A virus is a program that "infects" other programs by modifying them to include a copy of itself. A virus must have two functional elements: n n A search routine to locate new files or areas to infect and A copy routine so it can replicate itself into the file or area located by the search routine This is what distinguishes a virus from other forms of malicious code.

Worms are similar to viruses, but replicate in their entirety, creating exact copies of themselves, without needing a "carrier" program. Worms are normally found on computer networks and multi-user computers, and use inter-computer or inter-user communications (E-mail) as the transmission medium.

How does malicious code initially get in to a computer? Malicious code can invade a system through any of the normal means we use to communicate, transfer, or share software and data. This includes: Diskettes, tapes, CD-ROM, and any other portable media n n Infections also occur from the use of new diskettes, new (shrink wrapped) software, and new computer systems. Communications systems and services The primary means of infection today is by receiving infected files via e-mail as attachments

Propagation via e-mail n n n Built-in SMTP engines in malicious code allows the infected system to send infected e-mail without the owner’s knowledge Search files with extensions adb, asp, dbx, doc, eml, html, msg, oft, php, pl, rtf, sht, tbb, txt, uin, vbs, wab and / or others for e-mail addresses to send infected e-mail. Subject and Body are designed to entice a person to open and read the e-mail and attachment.

How does malicious code spread? n n n Sharing software through the use of media and transferring files across networks (to include the Internet), are the most common form of spreading malicious code. A virus or worm on a infected system will also propagate through network shares by dropping copies of itself to or infecting shared folders. Infections also occur from the use of new diskettes, new (shrink wrapped) software, and new computer systems

How is malicious code activated? Malicious code are only activated if it is executed. n n In the case of. COM, . EXE, . SYS, infected files it is easy to see how they are executed. Boot Sectors and master boot records are “executed” when the computer attempts to boot from a floppy diskette or hard drive. . DOC, . XLS, and other MS Office files aren’t “executed” in a strict sense. The macros that are a part of the file ARE executed, this is where the virus resides. Design flaws in application software can cause them to automatically execute e-mail attachments.

How can malicious code impact a system? n n n n Retrieve cached passwords / data files (e. g. theft of sensitive / privacy related information) Download and execute a file (typically to install a backdoor) Keystroke logging (e. g. theft of sensitive / privacy related information) Delete files / format hard drive Copy files (usually copies of itself for reactivation) Write to files (e. g. data corruption) / registry (e. g. control the infected system) Terminate processes (typically antiviral and firewall software) Open port(s) on the victim's computer, connect to a backdoor web server and achieve a level of control over the infected computer

What are the symptoms and indications of an infection?

What do you look for? Note abnormal or unexpected activity such as: n n n Displays, music, or other sounds Slowdown in processing speed Unusual disk activity Strange error messages Unexpected or unexplained changes in file sizes Loss of programs or data These symptoms don't necessarily mean you are infected, only that you MIGHT be infected

Organized Crime

n n n Malicious code authors have formed groups and associations to facilitate the proliferation and development of their wares. Groups have appeared in most countries around the world, some of them even have an international constituency. The following slide will give you some idea as to some of the malicious code authoring groups that are or have been in existence

Malicious Code Authoring Groups 29 A (Spain) Australian Institute of Hackers (Australia) Alliance (International) A New Order of Intelligence (Sweden) Corea Virus Club (Korea) Digital Anarchy (Argentina) Diabolical Kreations (Paraguay) Death Virii Crew (Russia) No Mercy (Indonesia) Phalcon-Skism (USA/Canada) Triden. T (Netherlands) Taiwan Power Virus Organization (Taiwan) Youths Against Mc. Afee (USA) and dozens more. . .

Newsletters & e-Zines n n n 29 A 40 Hex Anaconda ARCV Newsletter AVCR Journal Censor Chaos AD Chiba City Times CPI Newsletter Crypt Newsletter Evolution n God@rky's V. H. N. Immortal EAS Virus Magazine Infected Moscow Infected Voice Infectious Disease Magazine Insane Reality Magazine Minotauro Magazine Nemesis Source Of Kaos n and many more. . . n n n n

Malicious code authors and groups have also prepared and developed tutorials covering virtually all aspects of malicious code development. The tutorials are also freely available on the Internet. The following slide shows just a sampling of some of the tutorials available.

Tutorials n n n n The Virus Writer's Handbook (Terminator Z) Virus Infection Tutorial 0. 3 (Pocket) Batch Viruses by Wavefunc Macro Virus Tutorial (Dark Night) Mutation Engines (JHB) Guide to improving Polymorphic Engines (Rogue Warrior) Argument for slow infection and slow polymorphism (Rogue Warrior) Infection on Compression (MGL/SVL) The SFT stealth tutorial (MGL/SVL) Self Checking Executable Files (Demogorgon) Upper Memory Residency (Intrus. O) Interleaved Encryption Technique (Stomach Contents) and many, many more. . .

Malware Applications

Why are there so many viruses, trojan horses, and worms? The availability of source code is also a main factor in proliferation. Many malicious code authors make their source code freely available through the Internet and electronic chat rooms.

Bots n n The word bot is an abbreviation of the word robot. Robots are frequently used in the Internet world. Spiders used by search engines to map websites and software responding to requests on IRC (such as eggdrop) are robots

IRC and BOTS n n IRC stands for Internet Relay Chat. It is a protocol designed for real time chat communication (reference to RFC 1459, update RFC 2810, 2811, 2812, 2813), based on client-server architecture. Most IRC servers allow free access for everyone.

Bots n n n An IRC server connects to other IRC servers within the same network. IRC users can communicate both in public on channels or in private (one to one). There are two basic levels of access to IRC channels: users and operators. A user who creates a channel becomes its operator. An operator has more priviledges than a regular user.

Bots n n n IRC bots are treated no different than regular users (or operators). Control over these bots is usually based on sending commands to a channel setup by the attacker, infested with bots. An important feature of such bots is the fact that they are able to spread rapidly to other computers

n n n Many zombie (bot infected computers) networks have been controlled with the use of proprietary tools, developed intentionally by crackers themselves. IRC is considered the best way to launch attacks, because it’s flexible, easy to use and public servers are readily available. IRC offers a simple method to control hundreds or even thousands of bots at once in a flexible manner. .

Sniffing & Key logging n n n Bots can also be effectively used to enhance the art of sniffing. Observing traffic data can lead to detection of an incredible amount of information. This includes user habits, TCP packet payload which could contain interesting information (such as passwords). The same applies to key logging – capturing all the information typed in by the user (e– mails, passwords, home banking data, Pay. Pal account info etc. ).

Identity Theft n n The above mentioned methods allow an attacker controlling a bot-net to collect an incredible amount of personal information. Such data can then be used to build fake identities, which can in turn be used to obtain access to personal accounts or perform various operations (including other attacks) shifting the blame to someone else.

Hosting of Illegal Software n n Last, but not least, bot compromised computers can be used as a dynamic repository of illegal material (pirated software, pornography, etc. ). The data is stored on the disk of an unaware home or business Broadband user. Hours could be spent talking about the possible applications of bot-nets (for example pay per click abuse, phishing, hijacking HTTP/HTTPS connections etc. ). Bots alone are only tools, which can easily be adapted to every task which requires a great number of hosts under single control.

Different Types of Bots n n Many types of ready–made bots are available for download from the Internet. Each of them has its own special features. Let's have a look at the most popular bot outlining common features and distinctive elements.

Agobot n n Agobot is probably one of the most popular bots used by crackers. What is interesting about Agobot is its source code. Highly modular, it makes it simple to add new functions. Agobot provides many mechanisms to hide its presence on the host computer. They include: NTFS Alternate Data Stream, Antivirus Killer and the Polymorphic Encryptor Engine. Agobot offers traffic sniffing and sorting functionality. Protocols other than IRC can also be used to control this bot.

Hacker Tools

How easy is it to create a virus using an automated creation tool? An 8 year-old can do it! It’s as simple as making a few selections on the menu-driven creation tool. The following slides will take you through the process of using a menu-driven, automated creation tool to create a unique, custom made macro virus.

n n n n n Software For 2007 ! Guide to Hacking 2007 (NEW) Hacker Training Suite (NEW) Digital Cable Hacking CD (NEW) Chat System Hacker '07 (NEW) The Master Hacker PRO (NEW) Hackers Tool Chest PRO(NEW) Wi. Fi Wireless Hacking (NEW) Internet Spy PRO Password Stealers '07 CD(NEW) Smart Guide to Hacking(NEW) Serials & Reg Keys Expanded Special Edition Hackers(NEW) Virus & Trojans 2006 Internet Detective 2007 (NEW) Hardware For 2007 ! NEW Handheld Credit Card Reader SECTION: CREDIT & FINANCES Identity Fraud Book Portable Credit & Magnetic Card Reader/ Writer Windows Magnetic Strip Hacking Software The Ultimate Credit Card Hacking Bible Blank Magnetic Swipe Cards Credit Card Hacking Software CD Combo

Why is malicious code successful? n n n n Lack of training and awareness Using out-of-date anti-virus products Absence of or inadequate security controls Ineffective use of existing security controls Bugs and loopholes in system software Unauthorized use of software Network misuse

What’s Next n n Expect to see increased use of social networks that link users. These networks allow people with common personal or professional interests to find each other easily. The linking of users or networks also gives attackers a method to attack multiple users through one entity or through a web of the network.

n n As the use of RSS (Really Simple Syndication) becomes more prevalent, today’s software may not handle attacks well. Frequent updates of RSS, along with the embedding of downloads and encoding through a variety of XML formats, can lead to undetected infections.

n As more applications become embedded within browsers (for example, a spreadsheet program that can be loaded within the browser), the web will become more of an application platform, leading to more opportunities for security vulnerabilities and problems.

n n The use of “underground” business tools will also increase. We will see the types and availability of certain types of toolkits – such as those for vulnerability testing – getting better, which bodes well for both researcher and criminal. For example, new technology – fuzzers – can automatically run a series of tests (millions of tests) against an application, searching for errors in the code.

n n The blackhat and whitehat markets for zero-day threats will increase, and the number of entities offering “rewards” to researchers who find and report vulnerabilities will likewise also increase. We will also see increased organization, sharing, trading, and commerce in the underground with regards to zero-day exploit code.

Black Market n n n n $980. 00 -$4900 Trojan Program to steal online account information. $490. 00 Credit Card with PIN $78. 00 -$294 Billing data w SSN, Address. $147. 00 Drivers License $147. 00 Birth Certificate $98. 00 Social Security Card $6 Paypal Account w Logon & password

n n We will see more and more privacy issues connected to storage of personal, private, and confidential business data on the internet. As more and more people use the internet, more goods and services transactions will take place over the web Signing up for services, buying goods from web-based businesses, for example. As this happens, the danger of leaking data increases. For example, many companies offer 2 GB of free personal storage space.

End of Part 1