The Attack and Defense of Computers Dr 1

The Attack and Defense of Computers Dr. 許 富 皓 1

Virus [Internet Security Professional Reference ] 2

Virus Tutorial n Computer Virus Resources n Introduction of Famous Malware n Virus descriptions of viruses in the wild n 3

Virus n n A sequence of code that is inserted into other programs. A virus can create a copy of itself to inserted in one or more other programs. Virus cannot run on their own, and need to have some host program. e. g. Melissa virus, ILOVEYOU virus. 4

Virus n n n Boot sector viruses Master boot record viruses File infector viruses Multi-partite viruses Macro viruses (infect data files) 5

Floppy Disks & Hard Disks 6

Disk Structures n Units used in Floppy Disks and Hard Disks: Cylinder (for HDs) ¨ Heads ¨ Tracks ¨ Sectors ¨ n E. g. A 3 ½ inch high-density disk ¨ ¨ 512 bytes/sector 18 sectors/track 40 tracks/side Cluster n n Disk space allocation unit Each cluster contains one or more sectors. 7

Floppy Disk Structure 8

Disk Sectors Magnetic Disk Sector 9

Hard Disk Structure 10

Boot Record of a Floppy Disk [Sedory] n The first sector of any diskette normally contains the Boot Record for some OS. 11

Boot Record n Boot Record: ¨ Location: n sector 1, track 0, head 0. ¨ Contents: n n the bootstrap routine (a machine language program designed to load the operating system from other part of the disk. ) the BIOS Parameter Block (BPB), which identifies the floppy disk’s operating parameters, including the number of bytes per sector, sectors per cluster and track, and tracks per disk. ¨ The BPB allows an operating system to understand the format of a disk. 12

Content of a Floppy Boot Record [Sedory] • The bytes between the two dark blue bands are called the BPB (or BIOS Parameter Block). • Most of the Boot Record is executable code; from offsets 03 Eh through 19 Dh. • The code is followed by one long error message and the two system filenames: IO. SYS and MSDOS. SYS. • Finally, the sector ends with the Word-sized signature ID (or Magic number) of AA 55 hex (remember hex Words for Intel x 86 CPUs are stored in memory with the Lowest-byte first and the Highest-byte last to make processing quicker). 13

Hard Disk Partition and Master Boot Record n n n A single physical hard drive can be divided into several different partitions. The user can specify one of the partitions as the active partition (the one from which the user wants to boot. ) The Master Boot Record (MBR) is a structure stored on the first track, sector and head of the hard drive. The MBR contains a partition table, which denotes the allocation of all sectors and their respective partitions. Programs require the partition table on the hard disk to understand the disk’s characteristics. 14

Structure of a Master Boot Record [Wikipedia] 15

Functionality of a MBR Holding a disk's primary partition table. n Bootstrapping operating systems, after the computer's BIOS passes execution to machine code instructions contained within the MBR. n Uniquely identifying individual disk media, with a 32 -bit disk signature. n 16

Master Boot Code [DEW] The master boot record is the small bit of computer code that the BIOS loads and executes to start the boot process. n This code, when fully executed, transfers control to the boot program stored on the boot (active) partition to load the operating system. n 17

Load Boot Sector [Wikepedia] n On a IBM PC compatible machine the BIOS selects a boot device, then it copies the first sector from the device (which may be an MBR or any executable code), to address location 0 x 7 C 00. 18

Boot Sector Viruses 19

Boot Sector Viruses n If a disk has a boot record virus, the virus activates when the PC attempts to boot from the floppy disk or hard disk. ¨ Even if the PC can’t start up from an infected disk (such as when the floppy disk does not contain the proper DOS system files), it attempts to run the bootstrap routine, which is all a virus needs to activate. 20

Parasitical Place of Boot Sector Viruses n Most boot record viruses ¨ install themselves in the host computer’s memory and ¨ hook into the various system services provided by the computer’s BIOS and operating system. n n They remain active in RAM while a workstation remains on. As long as they stay in memory, they can continue to spread by infecting the floppy disks that a computer accesses. 21

Floppy Boot Record Viruses 22

Floppy Boot Record Viruses n Most floppy boot record viruses can infect ¨ the hard drive MBR ¨ the active partition boot record ¨ the floppy disk boot record n n The floppy disk serves as a carrier for the virus, allowing it to spread from one hard drive to another. After the virus places itself on the hard drive, it can then infect other floppy disks that inevitably make their way to other machines. 23

When and How Floppy Boot Record Viruses Get Control? n n Floppy boot record (FBR) viruses seize control of the computer during system reset. During the bootup sequence, the BIOS on most PCs determines whether a floppy disk is present in the floppy drive from which the computer is configured to boot. ¨ If the BIOS finds a disk in the drive, it assumes that the user wants to boot from this disk. ¨ After it locates the disk, the BIOS loads the floppy boot record into the computer’s memory and n executes its bootstrap program. n 24

The Boot Sequence from an Infected Floppy Diskette Virus reserves memory. Virus activities Virus copies itself to this memory Virus alters IVT to become proxy service provider Virus attempts to infect hard drive MBR or PBR. Virus loads original non-viral and executes the bootstrap routine Display Message stop No SYS files Bootstrap routine checks for DOS system files Bootstrap routine loads DOS system files and execute them A: prompt 25

BIOS Data Area n n All PCs contain a reserved region of memory known as the BIOS Data Area (BDA). During the initial stages of the computer’s bootup sequence (before control transfers to the bootstrap routine) the BIOS bootup program updates the BDA with information about the configuration and ¨ the initial state of the computer. ¨ n DOS relies on the information stored in the BDA of memory to properly use the peripherals and ¨ memory attached to the computer. ¨ n Almost all FBR viruses exploit DOS’s dependence on the BDA and update its contents to install themselves into memory. 26

Viruses Reserve Memory – Stage 1 27

Viruses Reserve Memory – Stage 2 28

Virus Copies Itself to Reserved Memory n After the virus reserves memory for itself by updating the BDA, it moves itself into the newly reserved memory and attempts to hook into the direct disk system services. 29

Interrupt Vector Table n The PC contains a memory structure, known as the Interrupt Vector Table (IVT), which is like a phone book that contains addresses for each of the services that the computer might need as it operates. ¨ The IVT contains the addresses of ROM BIOS service programs in the computer’s memory. ¨ When the operating system needs to request a service, it can look up the address of the corresponding service provider in the IVT phone book and determine where to send its request. 30

IVT Entry Example The computer’s ROM BIOS contains disk service routines that DOS calls upon to directly read from and write to floppy disks and hard drives. n One of the IVT phone book entries contains the address of the ROM BIOS disk service routines. n 31

Hook into the IVT Entry for Disk Service Provider n The FBR virus hooks into the system services by ¨ changing the contents of this entry and ¨ informing the computer and any subsequent operating system that it now is a proxy for the ROM BIOS disk service provider. n All requests to read and write to disks on the computer then are sent to the virus rather than to the original ROM BIOS disk services. 32

After the Hook Later, when the operating system makes a system service request, the IVT is consulted and the virus has the request sent to it. n The virus can then examine the request and, if it desires, infect the floppy disk being accessed. n After the virus performs its mischief, it can then redirect the request to the original ROM BIOS driver so that it can be properly serviced. n 33

The Fully-installed Boot Virus IVT BDA Stage 4 Top of RAM 34

Hook as a System Service Most FBR viruses attempt to install themselves as a memory-resident driver at this point in the bootup sequence. n In this way, the virus can monitor all disk service requests during the operation of the computer and infect additional floppy disks at will. n 35

Conceptual Hierarchy of Service Providers after the System is Infected Conceptual hierarchy of service providers after memory installation by the boot record virus Application Virus Resident Service Provider 36

The Original FBR n To complete its work, the FBR virus must retrieve the original FBR on the floppy disk and ¨ initiate the original bootup sequence as if the virus were not present. ¨ n n If the FBR virus installed itself in memory, infected the hard drive, and caused bootup on the floppy disk to fail, it might quickly be detected and removed. Most viruses maintain a copy of the original FBR in one of the sectors at the end of the floppy disk. After the virus installs itself in memory, it loads the original FBR into memory and executes the original bootstrap routine. The bootstrap routine then proceeds normally, completely oblivious to the presence of the virus. 37

Infect Non-bootable Disk n n Most floppy disks contain data and don’t carry the DOS operating system files; thus, after the virus transfers control to the original bootstrap routine, it displays a message such as “Non-system disk. ” At this point, the average user realizes that he or she accidentally booted from a data disk, removes the disk from the drive and reboots. This is why most FBR viruses infect the MBR or active Partition Boot Record of the hard drive during bootup. This infection guarantees that even if the floppy disk doesn’t contain the properating system files, the virus can still spread to the hard drive and eventually to other disks. 38

When and How the FBR Virus Infects New Items? n Most FBR viruses attempt to infect disks whenever they get a chance (although some viruses are more discriminating than others). ¨ n n If an infected floppy disk is in drive A: , the first opportunity presented to the FBR virus is during a system reset. Almost all FBR viruses also attempt to infect the hard drive’s MBR or active Partition Boot Record during the floppy boot process. The FBR virus also has an opportunity to infect after it installs itself in memory and designates itself as the proxy disk service provider. Any time thereafter when DOS or its programs attempt to access a floppy disk (or the hard drive), the operating system calls upon the virus. 39

Detect Infected Disk n Before a virus attempts to infect the floppy disk, it must determine whether the disk has already been infected. Most often, the virus does so by loading the target FBR into memory and comparing it to its own contents. ¨ If the FBR virus ascertains that the target floppy disk isn’t yet infected, it proceeds with the infection process. 40

WIN 32 PE Infection [Qozah][Rozinov] 41

The Most Common Executable File Formats under Windows n The portable executable file format (PE) is the format of the binary programs (exe, dll, sys, scr) for ¨ MS Windows NT ¨ Windows 95 ¨ Win 32 s 42

Components of a PE File 43

PE File Format for Executable Files [MSDN] 44

PE File Format [uglyhun. K ] 45

Struct IMAGE_FILE_HEADER typedef struct _IMAGE_FILE_HEADER { WORD Machine; WORD Number. Of. Sections; DWORD Time. Date. Stamp; DWORD Pointer. To. Symbol. Table; DWORD Number. Of. Symbols; WORD Size. Of. Optional. Header; WORD Characteristics; } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER; 46

An Example of Structure IMAGE_FILE_HEADER [Danehkar] 24 bytes 24=18 h 47

Struct IMAGE_OPTIONAL_HEADER { WORD Magic; BYTE Major. Linker. Version; BYTE Minor. Linker. Version; DWORD Size. Of. Code; DWORD Size. Of. Initialized. Data; DWORD Size. Of. Uninitialized. Data; DWORD Address. Of. Entry. Point; DWORD Base. Of. Code; DWORD Base. Of. Data; DWORD Image. Base; DWORD Section. Alignment; DWORD File. Alignment; WORD Major. Operating. System. Version; WORD Minor. Operating. System. Version; WORD Major. Image. Version; WORD Minor. Image. Version; WORD Major. Subsystem. Version; WORD Minor. Subsystem. Version; DWORD Win 32 Version. Value; DWORD Size. Of. Image; DWORD Size. Of. Headers; DWORD Check. Sum; WORD Subsystem; WORD Dll. Characteristics; DWORD Size. Of. Stack. Reserve; DWORD Size. Of. Stack. Commit; DWORD Size. Of. Heap. Reserve; DWORD Size. Of. Heap. Commit; DWORD Loader. Flags; DWORD Number. Of. Rva. And. Sizes; IMAGE_DATA_DIRECTORY Data. Directory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES]; }; 48

Some Fields of Struct IMAGE_OPTIONAL_HEADER (1) n Address. Of. Entry. Point ¨ A pointer to the entry point function, relative to the image base address. n n For executable files, this is the starting address. For device drivers, this is the address of the initialization function. The entry point function is optional for DLLs. When no entry point is present, this member is zero. Image. Base The preferred address of the first byte of the image when it is loaded in memory. ¨ This value is a multiple of 64 K bytes. ¨ The default value for DLLs is 0 x 10000000. ¨ The default value for applications is 0 x 00400000, except on Windows CE where it is 0 x 00010000. ¨ 49

Some Fields of Struct IMAGE_OPTIONAL_HEADER (2) n Section. Alignment The alignment of sections loaded in memory, in bytes. This value must be greater than or equal to the File. Alignment member. ¨ The default value is the page size for the system. ¨ ¨ n File. Alignment ¨ ¨ n The alignment of the raw data of sections in the image file, in bytes. The value should be a power of 2 between 512 and 64 K (inclusive). The default is 512. If the Section. Alignment member is less than the system page size, this member must be the same as Section. Alignment. Size. Of. Image ¨ The size of the image, in bytes, including all headers. Must be a multiple of Section. Alignment. 50

An Example of Structure IMAGE_OPTIONAL_HEADER [Danehkar] 16 bytes 16=10 h 51

struct IMAGE_SECTION_HEADER typedef struct _IMAGE_SECTION_HEADER { BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; union { DWORD Physical. Address; DWORD Virtual. Size; } Misc; DWORD Virtual. Address; DWORD Size. Of. Raw. Data; DWORD Pointer. To. Relocations; DWORD Pointer. To. Linenumbers; WORD Number. Of. Relocations; WORD Number. Of. Linenumbers; DWORD Characteristics; } IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER; 52

Some Fields of struct IMAGE_SECTION_HEADER (1) n Virtual. Size The total size of the section when loaded into memory, in bytes. If this value is greater than the Size. Of. Raw. Data member, the section is filled with zeroes. ¨ This field is valid only for executable images and should be set to 0 for object files. ¨ ¨ n Virtual. Address The address of the first byte of the section when loaded into memory, relative to the image base. ¨ For object files, this is the address of the first byte before relocation is applied. ¨ n Size. Of. Raw. Data The size of the initialized data on disk, in bytes. This value must be a multiple of the File. Alignment member of the IMAGE_OPTIONAL_HEADER structure. ¨ If this value is less than the Virtual. Size member, the remainder of the section is filled with zeroes. ¨ If the section contains only uninitialized data, the member is zero. ¨ ¨ 53

Some Fields of struct IMAGE_SECTION_HEADER (2) n Pointer. To. Raw. Data A file pointer to the first page within the COFF file. ¨ This value must be a multiple of the File. Alignment member of the IMAGE_OPTIONAL_HEADER structure. ¨ If a section contains only uninitialized data, this member is zero. ¨ n Characteristics ¨ The characteristics of the image. IMAGE_SCN_CNT_CODE 0 x 00000020 The section contains executable code. IMAGE_SCN_CNT_INITIALIZED_DATA 0 x 00000040 The section contains initialized data. IMAGE_SCN_CNT_UNINITIALIZED_DATA 0 x 00000080 The section contains uninitialized data. 54

Example [Matt Pietrek] n n The following code shows a snippet of PEDUMP output for the. text and. data section of the Windows XP KERNEL 32. DLL. Section Table 01. text Virt. Size: 00074658 Virt. Addr: raw data offs: 00000400 raw data size: • • • 02. data Virt. Size: 000028 CA Virt. Addr: raw data offs: 00074 C 00 raw data size: n n 00001000 00074800 00076000 00002400 The. text section is at offset 0 x 400 in the PE file and will be 0 x 1000 bytes above the load address of KERNEL 32 in memory. Likewise, the. data section is at file offset 0 x 74 C 00 and will be 0 x 76000 bytes above KERNEL 32's load address in memory. 55

An Example of Structure IMAGE_SECTION_HEADER [Danehkar] 56

Inject Virus 57

Change Size-Related Fields Step 1: Find section header i which has the largest Pointer. To. Raw. Data value among all the section headers. In other words, its corresponding section is the last section in this file. Step 2: Added to the size of the virus. 40 bytes 40=28 h Step 3: according to the value of File. Alignment in structure IMAGE_OPTIONAL_HEADER, round Virtual. Size. Then save the result to this field. 58

Set the Entry Point Value and the New File Size Step 4: Virtual. Address + old value of Virtual. Size. Then save the result to Address. Of. Entry. Point 16 bytes 16=10 h 40 bytes 40=28 h Step 5: Add (new Size. Of. Raw. Data – old Size. Of. Raw. Data ) 59

Set the New Access Right 40 bytes 40=28 h Step 6: make it executable, code and writable, so we have to OR it with 0 x 00000020 (code), 0 x 20000000 ( executable ) and 0 x 80000000 ( writable ). Step 7: append the virus to this file. 60

COM, EXE, and SYS Infection 61

The Most Common Executable File Formats under DOS The most common executable file formats used under DOS are COM, EXE, and SYS. n COM and EXE files are used for standard DOS programs. n SYS files are used for system device drivers. n Although viruses have targeted each of these file formats, to date, reports of SYS file infections have been rare. n 62

Entry Points of DOS Program Files n A program file consists of ¨ data and ¨ machine language instructions interpreted directly by the computer’s CPU. n n n DOS program files contain one or two entry points, which are the locations in the program of the first instruction for the CPU to execute. All COM and EXE files have a single entry point. SYS files have two entry points. 63

Entry Points of DOS Program Files n n n The CPU’s interpretation of a program’s instruction must always start with the instruction at the entry point. This makes the entry point an area that viruses can modify and thereby gain control of the computer. After the virus completes its dirty work, it can then transfer control to the original program. 64

COM Files n n n The COM executable file has the simplest DOS program file format. The COM file’s simplicity makes it a major target for file infecting viruses. The contents of the COM file are loaded directly into memory and executed without modification. The operating system transfers control to the first instruction in the memory image of the file. This first instruction is the COM file’s single entry point. COM files have an upper size limit of approximately 64 KB 65

How a COM File Is Loaded into RAM and Executed 66

EXE Files – Component Sections n n The EXE executable file format is somewhat more complex than the COM file format. The EXE file consists of two primary sections. ¨ The first section is a header that tells DOS how to load the program. ¨ The second section of the EXE file, known as the program load image, contains the actual memory image of the program and n its data. n 67

EXE Files – the Header Section n The header includes two fields that identify the location of the EXE file’s single entry point in the program: the Code Segment (CS) and ¨ the Instruction Pointer (IP). ¨ n n The header also includes two size fields that specify the actual size of the executable program. When a virus infects an EXE file, it must increase the value in the size fields to equal the total of the executable program file size and the virus program size. ¨ For instance, when a virus that is 2 KB in size appends itself to a 10 KB file, it increases the value in these fields to 12 KB. 68

How an EXE File Is Loaded into RAM and Executed overlay data 69

SYS Files n n The SYS executable file format differs from both the COM and EXE file formats in that SYS files have two entry points. SYS format files are used primarily for device drivers. Like COM files, all SYS files must be 64 KB or less in size. The SYS file is composed of three major sections. The first portion of the SYS file contains the device header. Like the header of an EXE file, the device header contains entry point information and other fields. ¨ The second and third sections of the SYS file contain the two device driver modules, which contain all the machine language code in the program. ¨ 70

How a SYS File Is Loaded into RAM 71

Program Files and Viruses n Program files are often targeted by viruses for two primary reasons. ¨ Because each of the executable file types has a simple format, file viruses can piggyback themselves to program files with relative ease. ¨ Executable file types also are common targets for infection because of the frequency of their use. If a virus can infect an executable file, its capability to infect other programs increases. 72

Macro Facilities 73

Macro Facilities n n n Macro facilities enable a user to record a sequence of operations within the application. The user then uses a key combination to associate these operations. Later, pressing this key combination repeats the recorded steps. ¨ A given macro activated using a key combination, for example, might n n n open a file renumber the items within it then close the file. 74

Global Pool of Macros n n n Macro systems have evolved greatly over the years. Most old programs that supported macros had a “global pool” of macros that always were available for use, regardless of what file the user happened to be editing. Individual document or spreadsheet files could NOT contain their own, local, macros. 75

New Properties of Modern Macro Systems (1) n Modern macro systems differ from their predecessors in several key ways. ¨ First, users now can write entire complex programs in a macro language. n These programs have access to all the host application’s features and ¨ many of the operating system’s features. ¨ n For example, ¨ Microsoft products enable users to write macros in a language that resembles Visual Basic. § These macros can perform various tasks for the user, including popping up dialog boxes, altering files on the system, or inserting the date and time in a document. § They can also be used to write viruses! 76

New Properties of Modern Macro Systems (2) ¨ Second, the user can tote specific macros around in a document or spreadsheet data file. n For example, A user can create a macro for a specific spreadsheet and attach it directly to the spreadsheet file. ¨ Any time the file is used on a new machine, the accompanying macro is available for use. ¨ 77

Security Concerns of Modern Macro Systems n An inherent threat exists with modern macro system: just as normal macros can be attached and carried along with a given document or data file, so can macro viruses! 78

Cross-platform Compatibility n Modern macro languages, such as Word for Windows’ Word. Basic, are interpreted by the host application and ¨ often are compatible across different operating systems. ¨ 79

Cross-platform Compatibility Example n n A Word for Windows 6. 0 document that contains macros created on a PC, for instance, can be edited in Word for Macintosh. Because Word for Macintosh provides the same macro facilities as its DOS counterpart, the document’s macros also function on the Macintosh platform. 80

Cross-platform Macro Viruses n This cross-platform compatibility means that a macro virus can spread from computer to computer, as long as the destination computer supports a macro-capable, compatible version of the host application. 81

Microsoft Word [Shauna Kelly] [Better Solutions][ucsb] 82

Template n n n A template is a sample document that is used for the basis for a new document. Every Microsoft Word document is based on a template, whether you choose a template explicitly or not. A template determines the basic structure for a document and ¨ contains document specific settings such as ¨ n n fonts styles page layout macros etc. 83

Relationship between a Word File and Its Template n When you create a document, the file that is created initially is just a copy of its template. ¨ This means that subsequent changes to the template will not automatically be reflected in the document. ¨ Some changes made to the document, however, can be saved to the template. 84

Naming Rule of a Template File A Word template has the file extension (. dot) and every document is based on a template. n When you save a document as a Word template three-letter extension of. dot is added to the end of the name instead of . doc. n 85

Template Normal. dot n n n The Normal. dot template is the basis for any new blank documents you create. Normal. dot is a special global template created and used by Word. Whenever you create a new document by clicking (File > New) a copy of the file called Normal. dot is created and is presented as a new document. If you change something in the Normal. dot then all new documents will reflect those changes. If Word is unable to find your Normal. dot file or it is damaged then a new one will be created using the default settings. 86

What Happens When a Document Is Born? n When a document is created, it inherits three things from its parent template: ¨ styles: In Word, a style is a collection of formatting instructions. You use styles to format the paragraphs in your document. n So you would use the "Title" style for your title, "Body Text" style for body text, "Caption" style for the picture captions, and "Heading 1" for the major headings. ¨ content (e. g. text, pictures, a fax header, a form to fill in, the outline of your monthly management report, any content in headers and footers) ¨ page settings (e. g. margins, paper size, paper orientation, settings for headers and footers). 87

When a New Word Document Is Created … n The moment a document is created, it loses its connection with its parent with respect to styles, content and page settings. 88

Changing a Document Won't Change the Template It's Attached to You can change the margins in a document and the change won't affect the template. n You can add, delete or modify styles in a document, and it won't affect the template. n 89

Changing the Template Won't Change Documents Attached to the Template n n You can change the margin in a template, and it will affect documents you create from this template in the future. But it won't affect existing documents attached to that template. You can add, delete or modify styles in a template, and the change will affect documents you create from this template in the future. But it won't affect existing documents. 90

What Happens after a Document Is Born, While It Is Being Edited? n n Once a document has been created, the template to which it is attached takes on quite a different role. When a document is being edited, its template sits in the background and makes four things available to a document: ¨ two kinds of functionality: n macros n Auto. Texts ¨ two ways to access the functionality: n toolbars n keyboard shortcuts (that is, a keyboard way and a mouse way). 91

Templates and Existing Word Documents 92

Change Template [Kelly] n You can attach a new template to a Word document or ¨ change the template a Word document is associated with. ¨ n But nothing happens after you execute the operations, because: A document inherited styles, content and page settings from its parent template when it was first created. ¨ You're not creating a new document, so the styles, content and page settings in the newly-attached template will not affect the document at all. ¨ The newly-attached template will sit in the background, and make available the four things that templates make available to documents: ¨ n n Macros Auto. Texts Toolbars keyboard shortcuts 93

Global Template [ucsb] A global template is a template whose customizations will be available to all documents, no matter what template they're attached to. n Word allows a user to make a template “global”. That means that its macros etc. will be available to all templates. n Normal. dot is a global template. n 94

Word Macro (1) A macro is just the name given to a series of keystrokes that can be recorded and then played back in order to automate a task. n These keystrokes are then transferred into a series of commands which can then be rerun at any time. n 95

Word Macro (2) n n n Macros are simple computer programs where the code is often generated for you. These macros run completely within an application like Word and require no additional software. Macros ¨ can be used to play back your actions and ¨ can prevent you from having to perform tedious or repetitive tasks. 96

Where to Store Your Macro? [Better Solutions Limited] n There are two possible workbooks where you can store your macros: ¨ Normal. dot - Storing your macros here will mean that they are available every time Word is open and are not reliant on any one particular document. ¨ Document - This is the default location and is often the best place if you are relatively new to macros. n n A macro that has been saved into a specific document is only available when that particular document is open. The currently active document is also referred to as the current document or active document. 97

Macros [Shauna Kelly] n You can copy macros to and from documents and templates using Tools > Templates and Add-ins > Organizer. 98

Properties of Microsoft Word Macro n Microsoft Word’s macro system actually offers a global pool macro area, as well as document-specific macros. ¨ ¨ ¨ Users can establish a set of global macros available for use regardless of the document being edited. They also can use the local macros that accompany a specific document during editing of that document. In the Microsoft scheme, macros can copy themselves to and from the global and local pools. The global pool provides the macros with the capability to migrate from one document to another. Upon execution, a macro can copy itself from a local pool to the global pool. Later, executing the same macro lets it copy itself from the global pool to a new document—a nice feature, as long as the user initiates the actions and knows of the results. Viruses can target the above facility. 99

How Macros can Migrate from File to File Microsoft Word uses a template to create, edit, or assemble a document. The default template is called NORMAL. DOT. This global template contains information that gets pulled into your current document, such as default settings, shortcut keys, toolbars, custom menu settings, Auto. Text entries, and macros. 100

Auto-execution Facility (1) n n The Word for Windows macro system also includes an auto-execution facility that makes it attractive to viruses. Word for Windows has an Auto. Exec macro that launches (if it is present in the global pool) when a user starts the Word processor. ¨ This facility can serve to execute other macros and set up the user’s work environment—or a virus can exploit it to ensure that the virus macro executes upon Word for Windows startup. 101

Auto-execution Facility (2) n In addition to the Auto. Exec macro, Word for Windows contains numerous other macros that activate during a normal editing session without directly being activated by the user. ¨ Any time the user opens a new document file, for example, a macro known as Auto. Open executes from the document’s local macro pool (if present). n A virus could easily use this macro to copy itself to the global pool as soon as a user opens the document. 102

Key Factors for the Emergence of Macro Viruses (1) n First of all, many popular applications, such as desktop publishing, Word processing, and spreadsheet programs, include macro capabilities. ¨ Such widespread usage is attractive to a macro virus from the standpoint that chances for continued self-replication are high. n Secondly, it is far easier to write macro language programs than assemble language programs. The art of virus writing is no longer limited to the technically astute. 103

Key Factors for the Emergence of Macro Viruses (2) n Finally, executable program viruses rely upon a system’s CPU to directly execute its instructions, whereas macro viruses don’t. Because of this, macros are platform independent. ¨ For example, the same macro that runs in a Windows-based Word processing program can also function in its Macintosh and Unix counterparts. 104

Macro Viruses Infect data files. n Common viruses nowadays. n Macro viruses infect Microsoft Office Word, Excel, Power. Point and Access files. n Examples: n ¨ Melissa, ¨ WM. Nicd. Day, ¨ W 97 M. Groov. 105

The Evolution of Media Used by Viruses to Spread Themselves n n n In the 1980's, floppy disks where the primary vector for spreading computer viruses because that is how most people shared data. In the late 80's and early 90's, Bulletin Board Systems (BBS) became the primary source for infections. After 1995, almost all new viruses were being spread via e-mail, or by sharing files over the web. ¨ Network administrators have been able to respond to this threat by installing antivirus software on their e-mail servers and restricting internet sites on their firewalls. 106

USB Flash Drives [lab. Mice] n USB Flash drives are pocket sized ultra portable storage devices (about the size of a highlighter pen) that hold up to tens of GBs of data that can be instantly accessed from any PC with a USB port. 107

Security Concerns about Flash Drives n The use of USB Flash Drives can bypass ¨ the safeguards against e-mail viruses and ¨ firewalls. n Users can either ¨ bring in infected documents from home or ¨ take home a business document to an infected PC, update it, and return it to a corporate file server. 108

Bootable USB Flash Drive [Tech. Republic] [Shaher] n It is actually possible to install a bootable copy of Windows XP onto a flash drive and then boot a PC off of the flash drive. 109

Methods to Avoid Detection n Avoiding bait files and other undesirable hosts. ¨ Anti-virus programs ¨ Bait files (small programs or programs containing garbage instructions). n Stealth ¨ Virus intercept anti-viruses’ request to read infected file. n n n Self-modification Encryption with a variable key Polymorphic code. 110

Virus Sources VX Heavens source codes and viruses database. n The Virus Source Code Database Virus source code n 29 A Labs source codes and articles n Virus Database List of all computer virus. n 111

Complementary Material 112

Areas of a Disk [1][2] n Under DOS, A disk is divided into the following four areas: ¨ The boot record. ¨ The file allocation table (FAT). ¨ The root directory. ¨ The data area. n A hard drive has a fifth area: ¨ The partition table. 113

Boot Record n Boot Record: ¨ Location: n sector 1, track 0, head 0. ¨ Contents: n n the bootstrap routine (a machine language program designed to load the operating system from other part of the disk. ) the BIOS Parameter Block (BPB), which identifies the floppy disk’s operating parameters, including the number of bytes per sector, sectors per cluster and track, and tracks per disk. ¨ The BPB allows an operating system to understand the format of a disk. 114

The Bootstrap Program n On board n On disk n n In a PC, when a machine is turned on, a routine called “The Power-On Self Test (POST)” verifies all hardware components are working properly. After everything is confirmed working well, POST loads up the boot record from the disk and checks for two signature bytes inside it. If the boot record signature is present, the execution control is transferred to the bootstrap program inside the boot record. Under DOS, the bootstrap program in turn loads the OS into the RAM from the disk and eventually transfers control to COMMAND. COM, the command interpreter. 115

Boot Sequence from Uninfected Floppy Diskette 116

Hard Disk Partition and Master Boot Record n n n A single physical hard drive can be divided into several different partitions. The user can specify one of the partitions as the active partition (the one from which the user wants to boot. ) The Master Boot Record (MBR) is a structure stored on the first track, sector and head of the hard drive. The MBR contains a partition table, which denotes the allocation of all sectors and their respective partitions. Programs require the partition table on the hard disk to understand the disk’s characteristics. 117

Boot Sequence from Uninfected Hard Drive -- (1) Floppy boot Process BBP print error message Stop 118

Boot Sequence from Uninfected Hard Drive -- (2) 119

8086/8088 INTERRUPTS, BIOS, and DOS 120

Interrupt [Gerhard Roehrl] n n n The 8086/88 microprocessors allow normal program execution to be interrupted by external events or by special instructions embedded in the program code. When the microprocessor is interrupted, it stops executing the current program and calls a procedure which services the interrupt. At the end of the interrupt service routine, the code execution sequence is returned to the original, interrupted program. 121

Interrupt Sources n An interrupt can be generated by one of three sources: ¨ Internal interrupts ¨ Hardware interrupt ¨ Software interrupt 122

Internal Interrupts n An interrupt can be generated as a result of a processor state violation, called an exception. ¨ An example would be a divide-by-zero interrupt produced when the div instruction is interpreted to have a zero divisor. n n Program execution is automatically interrupted and control transferred to an interrupt handler. Conditional interrupts such as this are referred to as internal interrupts. 123

Hardware Interrupt n An interrupt can also be generated by an external device requesting service. This happens when a device signals its request on either the non-maskable interrupt (NMI) or on the INTR interrupt input lines of the processor. The NMI interrupt is generally used to signal the occurrence of a catastrophic event, such as the immanent loss of power. ¨ The INTR interrupt is used by all other devices. ¨ n An interrupt caused by a signal applied to either the NMI or INTR input pin of a CPU is referred to as a hardware interrupt. 124

Software Interrupt n Interrupts may be generated as a result of executing the int instruction. n This is referred to as a software interrupt. 125

Functions of Software Interrupts (Only Apply to Real Mode) n Software interrupts produced by the INT assembler instruction have many uses. For example, ¨ test various interrupt service routines n You could use an INT 2 instruction to start the execution of an NMI interrupt service procedure. This would allow you to test the NMI procedure without needing to apply an external signal to the processors NMI input line. ¨ call commonly used procedures from many different programs n The Basic Input/Output System (BIOS) procedures of an IBM computer or compatible are a good example of this use of the INT instruction. 126

BIOS Procedures n One part of the BIOS is actually a collection of procedures which provides the fundamental I/O services that are needed for the operation of the computer. ¨ Each procedure performs a specific function such as reading a character from the keyboard n writing characters to the screen n reading information from disk. n 127

Using BIOS Procedures n n System I/O procedures are called with the INT instruction. There are 12 BIOS procedures in all, falling into 5 groups. ¨ For example with INT display services. n n 10 h you can access the video This interrupt includes 20 subroutines. Obviously, one of the INT 10 h parameters is a data value indicating which one of the twenty subroutines is required. ¨ ¨ the AH Register is loaded with the number of the subroutine. the AL, BX, CX, and DX registers are used to provide the parameters for this subroutines. 128

The 12 BIOS Service Routines Supported by the IBM PC (and Compatibles) Dec Hex Use Peripheral Devices Services 16 10 Video-display services 19 13 Diskette services 20 14 Communications services 21 15 Cassette-tape services 22 16 Standard keyboard services 23 17 Printer services Equipment Status Services 17 11 Equipment-list service 18 12 Memory-size service Time/Date Service 26 1 A Time and date services Print-Screen Service 5 Print-screen service Special Services 24 18 Activate ROM-BASIC language 25 19 Activate bootstrap start-up routine 129

Files Constituting DOS n n When you turn on your PC there are several jobs to do. One is to load the operating system from the system disk. If you use MS-DOS (Micro. Soft - Disk Operating System), three system files are loaded; ¨ IBMBIO. COM ¨ COMMAND. COM ¨ IBMDOS. COM 130

Comparing DOS and BIOS Services n n The file IBMDOS. COM contains DOS service routines. The DOS services, like the BIOS services, can be called by programs through a set of interrupts whose vectors are placed in the interrupt vector table. The ROM-BIOS routines can be thought of as the lowest-level system software available, performing the most fundamental and primitive input and output operations. ¨ The DOS service routines provide more sophisticated and efficient control over the I/O operations than the BIOS routines do, particularly for disk file operations. ¨ 131

Using DOS Interrupts (a. k. a. DOS Calls) n There are nine DOS interrupt services. ¨ Five of them, interrupts 20 h, 25 h, 26 h, 27 h, and 2 Fh are "true" DOS interrupt services, each one having a specifically-defined task associated with it. ¨ 22 h, 23 h, and 24 h: these three interrupts are used to hold segmented addresses. ¨ INT 21 h provides under one "umbrella" a set of universal functions we can use in our programs. n All of the DOS function calls are invoked by INT 21 h. ¨ Individual functions are selected in the same way as BIOS functions, placing the function number in the AH-Register. 132

The Nine DOS Interrupts Dec Hex Description 32 20 Program terminate: come to normal ending 33 21 Function-call umbrella interrupt 34 22 Terminate address 35 23 Break address 36 24 Critical error-handler address 37 25 Absolute disk read 38 26 Absolute disk write 39 27 Terminate-but-stay-resident 47 2 F Print spool control (DOS-3 versions only) 133

Interrupt Vectoring n Two 16 bit data words are used to specify the location of a interrupt service routine. ¨ One word is used to load the CS register and points to the base address of the code segment containing the service routine. ¨ The second word is used to load the IP with the offset value for the desired routine within the specified code segment. n The base and offset words for all interrupt types are grouped together in an interrupt vector table. 134

BIOS (1) [wikipedia] n n BIOS, in computing, stands for Basic Input/Output System or Basic Integrated Operating System. BIOS refers to the firmware code run by an IBM compatible PC when first powered on. ¨ The primary function of the BIOS is to prepare the machine so other software programs stored on various media (such as hard drives, floppies, and CDs) can load to the PC n execute on the PC and n assume control of the PC. n ¨ This process is known as booting up. n Boot is short for bootstrapping. 135

BIOS (2) n BIOS can also be said to be a coded program embedded on a chip that recognizes and controls various devices that make up the PC. 136

BIOS Firmware Chips n n A computer system can contain several BIOS firmware chips. The motherboard BIOS typically contains code to access fundamental hardware components such as ¨ ¨ ¨ n the keyboard floppy drives ATA (IDE) hard disk controllers USB human interface devices storage devices. Plug-in adapter cards such as SCSI, RAID, Network interface cards, and video boards often include their own BIOS, complementing or replacing the system BIOS code for the given component. 137

BIOS Procedures in ROM Chips (1) n ROM chips accompany most hardware addons, such as hard drives, video boards, and so forth. ¨ These chips contain machine language programs (routines) that handle most of the common requests that operating systems and applications make. 138

BIOS Procedures in ROM Chips (2) n ROM-based software adheres to a well-known, published standard. ¨ If a program wants to write data to the hard drive, for example, it can call upon the routines on the hard drive ROM chips to perform the operation. ¨ Although the circuitry in each brand of hard drive might differ, this well-defined software interface allows programs to efficiently request services from hard drives and other peripherals without having to understand their internals. 139

BIOS Procedures in ROM Chips (3) n n ROM-based software is referred to as a BIOS procedures. If a program needs to request a service from a peripheral, such as reading data from the hard drive, it can call upon the BIOS procedure in the ROM chip to ¨ communicate with the specific device and ¨ service the request. similar to a device driver in Unix 140

An Example Physical Memory Layout of a PC linear address range 640 K 1 M real-mode address range memory type 0 - 3 FF 0000: 0000 -0000: 03 FF 400 - 4 FF 0040: 0000 -0040: 00 FF 500 - 9 FBFF 0050: 0000 -9000: FBFF 9 FC 00 - 9 FFFF 9000: FC 00 -9000: FFFF A 0000 - BFFFF A 000: 0000 B 000: FFFF video RAM C 0000 - C 7 FFF C 000: 0000 C 000: 7 FFF ROM C 8000 - EFFFF C 800: 0000 E 000: FFFF NOTHING F 0000 - FFFFF F 000: 0000 -F 000: FFFF use real-mode interrupt vector table (IVT) RAM BIOS data area (BDA) free conventional memory (below 1 M) extended BIOS data area (EBDA) VGA frame buffers video BIOS (32 K is typical size) ROM motherboard BIOS (64 K is typical size) 100000 - FEBFFFFF RAM free extended memory (1 M and above) FEC 00000 FFFF various motherboard BIOS, Pn. P NVRAM, ACPI, etc. 141

DOS Calls n The DOS operating system also offers system services to its applications. ¨ DOS installs its own system service provider software in memory to service common requests, such as opening a file or n writing data to a file. n ¨ The above DOS software works on top of the various BIOS Procedures and simplifies certain basic operations. 142

DOS Call Example n Assume an application requests a system service, such as opening a file. ¨ The application makes this request with a simple DOS call. ¨ DOS may make one or more low-level requests to the ROM service provider. ¨ Finally, the ROM service provider may interact with the hardware to service some requests. n Because the typical program doesn’t care about how data actually is stored on the hard drive, as long as it can access it, DOS abstracts this for the program and offers a simple way to open files. Similar to a system call in Unix 143

System Layering 144

An Example of System Layering [Raymond Wisman] C++ program: cout << "Hello world"; Machine : Call DOS video function 9 to output Code string "Hello world" DOS: Call BIOS video function by int 10 h BIOS: "Hello world" placed in hardware video memory Video hardware: "Hello world" display from video memory 145

Invoking a BIOS Procedure or DOS Call n Both BIOS procedures or DOS calls are invoked through the int instruction, ¨ e. g. int 20 h int 10 h 146

The Rise and Fall of the BIOS n n Older operating systems such as DOS relied on the BIOS to carry out most input-output tasks within the PC. A variety of technical reasons eventually made it inefficient—especially for more recent operating systems written for the Intel 80386 such as Linux and Microsoft Windows—to invoke the BIOS directly. ¨ Such operating systems instead used their own betterperforming native drivers and were also much easier to extend to support new hardware. As such, the BIOS was mostly relegated to bootstrapping to the point where the operating system's own drivers could take control of the hardware. 147

Hook TSRs into DOS System Services n n Memory-resident programs, called TSRs, can hook into the system service provider software (DOS calls) already resident in the computer’s memory and augment the services offered by the original system service provider software. The “hooking” program can ¨ service all requests on its own or ¨ pass on some or all requests to the original service provider. n It also can opt to modify information before passing it to a subservient service provider (one installed before the current service provider). 148

How Resident File Viruses Hook into the Operating System n Most programs that hook into DOS or ROM services do so for legitimate reasons. Unfortunately, memory-resident viruses also can hook into these system services to damage data or spread to floppy disks and files. 149

Examples Form. n Disk Killer. n Michelangelo. n Stoned. n 150

Master Boot Record Viruses 151

Master Boot Record Viruses n n The MBR contains a bootstrap program which according to the MBR’s partition table determines which partition is the active partition, and then load and transfer control to the active partition’s Partition Boot Record (PBR) to finish the loading of the DOS into memory. Examples: ¨ NYB, ¨ Anti. Exe, ¨ Unashamed. 152

Program File Viruses 153

Program File Viruses n n Program file viruses (hereafter called just file viruses ) use executable files as their medium for propagation. They target one or more of the three most common executable file formats used in DOS: COM files, EXE files, and SYS files. The basic file virus replicates by attaching a copy of itself to an uninfected executable program. The virus then modifies the new host program so that when the program executes, the virus executes first. 154

Examples Jerusalem n Cascade. n 155

Infection The file-infecting virus can only gain control of the computer if the user or the operating system executes a file infected with this virus. n In other words, infected files are harmless as long as they are not executed; they can be copied, viewed, or deleted without incident. n 156

Execution of a COM Program n n COM programs have the simplest format of any of the DOS executable file formats. They also have the simplest loading sequence: ¨ DOS reads the program directly into memory, ¨ then jumps to the first instruction (at the first byte) of the program image. ¨ When this action occurs, the program has complete control of the computer, until it relinquishes control back to DOS upon termination. 157

COM Infections n File viruses infect COM files by modifying the machine-language program at the start of the executable image. A virus can ensure that it gains control in at least four different ways, because execution in a COM file must begin at the first byte in the executable image. ¨ Prepending COM Viruses ¨ Appending COM Viruses ¨ Overwriting COM Viruses ¨ Improved Overwriting COM Viruses 158

Prepending COM Viruses n n n A virus can insert itself at the top of the COM file, moving the original program down after the viral code. The entire virus is then located at the top of the executable image, and is the first to execute when the program is loaded. This method of infection is known as prepending, because the virus affixes itself to the beginning of the host COM program 159

Prepending COM Virus Infection 160

Appending COM Viruses – Inject the Virus A virus can modify the machine-language program at the top of the executable image of the COM file to transfer control to the virus, which can be located elsewhere in the executable file. n The virus often attaches itself to the end of the infected program and changes the first few instructions at the top of the executable image so that they transfer control to the viral code. n 161

Appending COM Viruses – Handle the Original Code n n n Before the virus changes the first few program instructions, it must record what the host program’s original entry instructions were so that it can repair the host program after it has completed. Without preserving these instructions, when the virus transfers control to the host program, the PC would most likely crash or work incorrectly, foiling the virus’ attempts to remain undiscovered. This above method of infection is known as appending, because the virus affixes its bulk to the end of the host program 162

Appending COM Virus Infection 163

Overwriting COM Viruses n The third technique used to infect COM files is known as overwriting. Viruses that use this technique often are crudely written. They infect COM programs by entirely overwriting the start of the host program with the viral code. 164

Repair Files Infected by Overwriting COM Viruses n Overwriting COM Viruses don’t attempt to save a copy of the host’s bytes that have been overwritten. As a result, the original program can’t work after the virus executes. If a computer becomes infected with a virus of this type, the only way to repair the infected files is to restore them from backups created before the infection. 165

Tricks Used by Overwriting COM Viruses to Avoid Being Detected n After overwriting viruses infect program files, they either crash or display a bogus error message such as Not enough memory to execute program. Such error messages appear in an attempt to convince the user that the PC has a memory management problem rather than a virus. 166

Overwriting COM Virus Infection 167

Improved Overwriting COM Viruses The last method used to infect COM programs is known as improved overwriting. n Assuming the virus is V bytes long, the virus first reads the first V bytes of the host program and then appends this information to the end of the host program. The virus then overwrites the top of the COM program using the V bytes of viral code. n 168

Original Information of Infected Files n The host program can be repaired and executed normally after the virus completes its dirty work, because the information from the uninfected host program has been stored. 169

Improved Overwriting COM Virus 170

EXE Infections n n Although numerous methods are used to infect COM files, viruses use primarily one method to infect EXE format files. EXE files have a variable entry point specified by the Code Segment (CS) and Instruction Pointer (IP) fields of the file header. In the most common form of EXE infection, the virus performs the following sequence of actions: Records the host’s original entry point in itself, so it can later execute the host program normally. ¨ Appends a copy of itself to the end of the host program. ¨ Changes the entry point (using CS and IP fields) in the EXE header to point to the virus code. ¨ Changes other fields in the header, including the program’s loadimage size fields to reflect the presence of the virus. ¨ 171

EXE File before and after Infection 172

How and When the File-Infecting Virus Gets Control? n n n Simply stated, a file-infecting virus gains control of the computer when the user or operating system executes an infected program. When a user executes an infected program, DOS loads the entire program into memory, virus and all, and begins executing the program at its entry point. In infected files, the virus modifies the location of the entry point or the machine-code at the entry point so that the virus executes first. 173

Proliferation of File-Infecting Viruses n After the virus machine code begins executing, it can immediately seek out and infect other executable programs on the computer, or it can establish itself as a memory-resident service provider in the operating system. ¨ As a service provider, the virus can then infect subsequent executable files as the operating system or other programs execute or access them for any reason. 174

Categories of File-infecting Viruses n File-infecting viruses are categorized as being either direct action or memoryresident file infectors. ¨ The direct-action file infector ¨ The memory-resident file infector 175

The Direct-Action File Infector n The direct-action file infector infects other program files located somewhere on the path, or on the hard drive, as soon as an infected program executes. 176

The Memory-Resident File Infector n The memory-resident file infector loads itself into the computer’s memory using a method similar to that used by the boot infecting viruses. However, the virus must check to see whether it has already inserted itself in memory as a system service provider. ¨ The user may have many infected programs, each which represents a different opportunity for the virus to load itself in memory during a computing session. (Boot record viruses don’t concern themselves with this issue, as they only install themselves once during system bootup. The virus cannot inadvertently insert itself in memory as a service provider more than once. ) ¨ 177

Multi-Partite Viruses: n n Multi-partite viruses (a. k. a. polypartite ) infect both boot records and program files. Examples: ¨ One_Half, ¨ Emperor, ¨ Anthrax, ¨ Tequilla. 178