Understanding Malicious Software: Viruses, Worms, Trojans, and DDoS Attacks, Slides of Cryptography and System Security

Download Understanding Malicious Software: Viruses, Worms, Trojans, and DDoS Attacks and more Slides Cryptography and System Security in PDF only on Docsity!

Chapter 19 – Malicious Software What is the concept of defense: The

parrying of a blow. What is itscharacteristic feature: Awaiting the blow. — On War, Carl Von Clausewitz

Viruses and Other Malicious

Content

 computer viruses have got a lot of publicity  one of a family of malicious software  effects usually obvious  have figured in news reports, fiction,movies (often exaggerated)  getting more attention than deserve  are a concern though

Backdoor or Trapdoor

 secret entry point into a program  allows those who know access bypassingusual security procedures  have been commonly used by developers  a threat when left in production programsallowing exploited by attackers  very hard to block in O/S  requires good s/w development & update

Logic Bomb

 one of oldest types of malicious software  code embedded in legitimate program  activated when specified conditions met  eg presence/absence of some file  particular date/time  particular user  when triggered typically damage system  modify/delete files/disks, halt machine, etc

Zombie

 program which secretly takes over anothernetworked computer  then uses it to indirectly launch attacks  often used to launch distributed denial ofservice (DDoS) attacks  exploits known flaws in network systems

Viruses

 a piece of self-replicating code attached tosome other code  cf biological virus  both propagates itself & carries a payload  carries code to make copies of itself  as well as code to perform some covert task

Virus Structure

program V := {goto main;1234567;subroutine infect-executable := {loop: file := get-random-executable-file;if (first-line-of-file = 1234567) then goto loopelse prepend V to file; } subroutine do-damage := {whatever damage is to be done}subroutine trigger-pulled := {return true if condition holds}main: main-program := {infect-executable;if trigger-pulled then do-damage;goto next;} next: }

Types of Viruses

 can classify on basis of how they attack  parasitic virus  memory-resident virus  boot sector virus  stealth  polymorphic virus  metamorphic virus

Email Virus

 spread using email with attachmentcontaining a macro virus  cf Melissa  triggered when user opens attachment  or worse even when mail viewed by usingscripting features in mail agent  hence propagate very quickly  usually targeted at Microsoft Outlook mailagent & Word/Excel documents  need better O/S & application security

Worms

 replicating but not infecting program  typically spreads over a network  cf Morris Internet Worm in 1988  led to creation of CERTs  using users distributed privileges or by exploitingsystem vulnerabilities  widely used by hackers to create zombie PC's , subsequently used for further attacks, esp DoS  major issue is lack of security of permanentlyconnected systems, esp PC's

Morris Worm

 best known classic worm  released by Robert Morris in 1988  targeted Unix systems  using several propagation techniques  simple password cracking of local pw file  exploit bug in finger daemon  exploit debug trapdoor in sendmail daemon  if any attack succeeds then replicated self

Recent Worm Attacks

 new spate of attacks from mid-  Code Red - used MS IIS bug  probes random IPs for systems running IIS  had trigger time for denial-of-service attack  2 nd wave infected 360000 servers in 14 hours  Code Red 2 - installed backdoor  Nimda - multiple infection mechanisms  SQL Slammer - attacked MS SQL server  Sobig.f - attacked open proxy servers  Mydoom - mass email worm + backdoor

Virus Countermeasures

 best countermeasure is prevention  but in general not possible  hence need to do one or more of:  detection

• of viruses in infected system  identification
  • of specific infecting virus  removeal
    • restoring system to clean state

Anti-Virus Software

 first-generation  scanner uses virus signature to identify virus  or change in length of programs  second-generation  uses heuristic rules to spot viral infection  or uses crypto hash of program to spot changes  third-generation  memory-resident programs identify virus by actions  fourth-generation  packages with a variety of antivirus techniques  eg scanning & activity traps, access-controls  arms race continues