Polymorphic VirusesPolymorphic VirusesA brief surveyA brief survey

Joseph Hamm

Shirlan Johnson

11-Sep-2002 CS 6265 Fall 2002

ContentsContents

Prologue Introduction The Evolution of Polymorphic Viruses Polymorphism Detection Epilogue

11-Sep-2002 CS 6265 Fall 2002

ProloguePrologue

1941– First theories for self-replicating programs

1980s – ©Brain (Pakistan) and Stoned (New Zealand)

attacks floppy boot sectors– Jerusalem(Israel) – first virus to infect other

than .COM & .EXE– Den Zuk (Indonesia) – first “antivirus” virus –

removes & inoculates against ©Brain

11-Sep-2002 CS 6265 Fall 2002

ProloguePrologue 1990s

– 1st virus exchange (VX) BBS (Bulgaria) goes online

– AT&T (1st successful critical infrastructure?) attack

– Dark Avenger releases 1st PME – MtE - enables other viruses to morph in over 4,000,000,000 different forms

– 1st polymorphic virus appear – Tequila (Switzerland)

– Nowhere Man releases Nowhere Utilities which include the Virus Creation Lab (VCL) w/ “Borland interface”

11-Sep-2002 CS 6265 Fall 2002

Polymorph Engine - 1Polymorph Engine - 1

What is a Polymorph Engine?

A program with the abilities to encrypt (or jumble up) another program or data and provide a unique decryptor for it and do this in such a way that no two encryptions of the same program or data will look alike.

11-Sep-2002 CS 6265 Fall 2002

Polymorph Engine - 2Polymorph Engine - 2

A PME typically consists of:

The random number generator. The junk code generator. The decryptor generator.

11-Sep-2002 CS 6265 Fall 2002

Polymorphism LevelsPolymorphism Levels Level 1

– Viruses having a set of decryptors with constant code, choosing one while infecting.

Level 2– Virus decryptor contains one or several constant

instructions, the rest of it is changeable. Level 3

– Decryptor contains unused functions- "junk" like NOP, CLI, STI etc.

Level 4 – Decryptor uses interchangeable instructions and changes

their order (instructions mixing).– Decryption algorithm remains unchanged.

11-Sep-2002 CS 6265 Fall 2002

Polymorphism Levels – Cont’d.Polymorphism Levels – Cont’d. Level 5

– Levels 1 - 4 are used, decryption algorithm is changeable, repeated encryption of virus code and even partial encryption of the decryptor code is possible.

Level 6– Permutating viruses. The main code of the virus is subject to

change. It is divided into blocks which are positioned in random order while infecting.

Level 7– Levels 1 – 6 plus Heuristic, Goat & Emulator counter-

measures

11-Sep-2002 CS 6265 Fall 2002

Sample Polymorphic Virus CodeSample Polymorphic Virus Code MOV DX,10 ;Real part of the decryptor! MOV SI,1234 ;junk AND AX,[SI+1234] ;junk CLD ;junk MOV DI,jumbled_data ;Real part of the decryptor! TEST [SI+1234],BL ;junk OR AL,CL ;junk main_loop: ADD SI,SI ;junk instruction, real loop! XOR AX,1234 ;junk

11-Sep-2002 CS 6265 Fall 2002

Polymorphic Behavior - 1Polymorphic Behavior - 1

11-Sep-2002 CS 6265 Fall 2002

Polymorphic Behavior - 2Polymorphic Behavior - 2

11-Sep-2002 CS 6265 Fall 2002

Polymorphic Behavior - 3Polymorphic Behavior - 3

11-Sep-2002 CS 6265 Fall 2002

Polymorphic Behavior - 4Polymorphic Behavior - 4

11-Sep-2002 CS 6265 Fall 2002

AV Polymorphic Response - 1AV Polymorphic Response - 1

Scan Strings– Work by searching for a pattern of bytes in FIXED

positions and a FIXED sequence.

Variable Scan Strings– Work by searching for a pattern of bytes in

VARIABLE positions but in a FIXED sequence.

Cryptanalysis– Works by finding part of the VIRUS BODY and

then performing some very basic cryptanalysis on it and then decrypting it (if possible).

11-Sep-2002 CS 6265 Fall 2002

AV Polymorphic Response - 2AV Polymorphic Response - 2

Generic Decryptor (Emulator)– Works by emulating instructions in the

polymorphic decryptor in order to make the virus decrypt itself and then it detects the virus by a standard scan string.

Heuristics– Searches for inconsistencies between the

code being analyzed and normal everyday code found in programs.

11-Sep-2002 CS 6265 Fall 2002

AV Strategy - 1AV Strategy - 1

11-Sep-2002 CS 6265 Fall 2002

AV Strategy - 2AV Strategy - 2

11-Sep-2002 CS 6265 Fall 2002

AV Strategy - 3AV Strategy - 3

11-Sep-2002 CS 6265 Fall 2002

AV Strategy - 4AV Strategy - 4

11-Sep-2002 CS 6265 Fall 2002

AV Strategy - 5AV Strategy - 5

11-Sep-2002 CS 6265 Fall 2002

Heuristic AV StrategyHeuristic AV Strategy

11-Sep-2002 CS 6265 Fall 2002

VX Response to AV Tactics - 1VX Response to AV Tactics - 1

Anti Scan String methods– Avoid the use of code common to every decryptor.

NOTE: Make enough alternatives so that it makes multiple variable scan strings not an option to AV!

Anti - Cryptanalysis– Simply add multiple encryption– A loop using a single XOR with byte/word is very

easy to crypt-analyze but a loop using XOR b/w, ADD b/w, SUB b/w, ROL b/w in one loop is VERY hard to crypt-analyze.

11-Sep-2002 CS 6265 Fall 2002

VX Advice to Next GenVX Advice to Next Gen If you are going to make a good engine

remember the following points:- It must not have fixed bytes in fixed positions.- It must not have fixed bytes in variable positions.- It must not be able to be decrypted by generic

decryption engines in AV software.- It helps if the code is heuristically "clean" but it is

not the “be all and end all” of an engine to be this way.

- Make sure it is very difficult to analyze by AV.- Make sure next to impossible to remove if it does

get caught.

11-Sep-2002 CS 6265 Fall 2002

EpilogueEpilogue

Polymorphic viruses represent yet another escalatory step in the conflict between those who seek to compromise (VX community) and those who defend (AV community) computer systems. As the techniques and strategies improve, one can expect the threat of polymorphic viruses to only increase.

11-Sep-2002 CS 6265 Fall 2002

References -1References -1 AVP Virus Encyclopaedia

– http://www.kav.ch/avpve/ History of Computer Viruses by Robert M. Slade

– http://www.bocklabs.wisc.edu/~janda/sladehis.html Understanding & Managing Polymorphic Viruses

– http://www.symantec.com/avcenter/whitepapers.html Virus Timeline & Scientific Papers

– http://researchweb.watson.ibm.com/antivirus/index.htm– http://www.cknow.com/vtutor/vthistory.htm

11-Sep-2002 CS 6265 Fall 2002

References -2References -2 VX Papers & Articles

– http://vx.netlux.org/lib_diff.shtml– Guide to improving Polymorphic Engines by Rogue Warrior

– A General Description of the Methods Behind a Polymorph Engine by The Black Baron

Viruses Revealed by David Harley, etc.

Questions?Questions?