CSE484/CSEM584ComputerSecurity:

Malwareand

OnlineEcosystemStudies

TA:ThomasCrosleytcrosley@cs

WithmaterialfromFranzi,AdrianSham,andvarioussources

Reminders

•  Homework#3,dueMay23th,8pm(Tomorrow!)•  Lab#3dueJune3,8pm•  PreliminaryFinalProjectDueDate#2–  (This!)MondayMay30th,8pm

5/26/16 CSE484/CSEM584–Fall2015 2

Malware

5/26/16 CSE484/CSEM584–Fall2015 3

Malware

•  Maliciouscodeoftenmasqueradesasgoodsoftwareorattachesitselftogoodsoftware

•  Somemaliciousprogramsneedhostprograms–  Trojanhorses(maliciouscodehiddeninusefulprogram)

•  Otherscanexistandpropagateindependently– Worms,automatedviruses

•  Manyinfectionvectorsandpropagationmethods•  Modernmalwareoftencombinestechniques

5/26/16 CSE484/CSEM584-Spring2015 4

Viruses

•  Viruspropagatesbyinfectingotherprograms– Automaticallycreatescopiesofitself,buttopropagate,ahumanhastorunaninfectedprogram

–  Self-propagatingvirusesareoftencalledworms•  Manypropagationmethods–  Insertacopyintoeveryexecutable(.COM,.EXE)–  Insertacopyintobootsectorsofdisks

•  PCera:“Stoned”virusinfectedPCsbootedfrominfectedfloppies,stayedinmemory,infectedeveryinsertedfloppy

–  InfectcommonOSroutines,stayinmemory

5/26/16 CSE484/CSEM584-Spring2015 5

FirstVirus:Creeper

•  Writtenin1971atBBN•  InfectedDECPDP-10

machinesrunningTENEXOS•  JumpedfrommachinetomachineoverARPANET–  Copieditsstateover,triedtodeleteoldcopy

•  Payload:displayedamessage“I’mthecreeper,catchmeifyoucan!”•  Later,ReaperwaswrittentodeleteCreeper

5/26/16 CSE484/CSEM584-Spring2015 6

http://history-computer.com/Internet/Maturing/Thomas.html

VirusDetec\on

•  Simpleanti-virusscanners–  Lookforsignatures(fragmentsofknownviruscode)–  Heuristicsforrecognizingcodeassociatedwithviruses

•  Example:polymorphicvirusesoftenusedecryptionloops

–  Integritycheckingtodetectfilemodifications•  Keeptrackoffilesizes,checksums,keyedHMACsofcontents

5/26/16 CSE484/CSEM584-Spring2015 7

ArmsRace:PolymorphicViruses

•  Encryptedviruses:constantdecryptorfollowedbytheencryptedvirusbody

•  Polymorphicviruses:eachcopycreatesanewrandomencryptionofthesamevirusbody–  Decryptorcodeconstantandcanbedetected–  Historicalnote:“Crypto”virusdecrypteditsbodyby

brute-forcekeysearchtoavoidexplicitdecryptorcode

5/26/16 CSE484/CSEM584-Spring2015 8

SmarterVirusDetec\on?

•  Genericdecryptionandemulation–  EmulateCPUexecutionforafewhundredinstructions,

recognizeknownvirusbodyafterithasbeendecrypted–  Doesnotworkverywellagainstviruseswithmutating

bodiesandvirusesnotlocatednearbeginningofinfectedexecutable

5/26/16 CSE484/CSEM584-Spring2015 9

Virusesvs.Worms

5/26/16 CSE484/CSEM584-Spring2015 10

VIRUS•  Propagatesbyinfecting

otherprograms

•  Usuallyinsertedintohostcode(notastandaloneprogram)

WORM•  Propagatesautomatically

bycopyingitselftotargetsystems

•  Astandaloneprogram

Slammer(Sapphire)Worm

•  January24/25,2003:UDPwormexploitingbufferoverflowinMicrosoft’sSQLServer(port1434)–  Overflowwasalreadyknownandpatchedby

Microsoft…butnoteverybodyinstalledthepatch•  Entirecodefitsintoasingle404-byteUDPpacket– Wormbinaryfollowedbyoverflowpointerbacktoitself

•  Classicstacksmashcombinedwithrandomscanning–  Oncecontrolispassedtowormcode,itrandomly

generatesIPaddressesandsendsacopyofitselftoport1434

5/26/16 CSE484/CSEM584-Spring2015 11

SlammerPropaga\on

•  Scanrateof55,000,000addressespersecond–  Scanrate=therateatwhichwormgeneratesIP

addressesofpotentialtargets–  Upto30,000single-packetwormcopiespersecond

•  Initialinfectionwasdoublingin8.5seconds(!!)–  DoublingtimeofCodeRed(2001)was37minutes

•  Worm-generatedpacketssaturatedcarryingcapacityoftheInternetin10minutes–  75,000SQLserverscompromised– …inspiteofthebrokenpseudo-randomnumber

generatorusedforIPaddressgeneration

5/26/16 CSE484/CSEM584-Spring2015 12

05:29:00UTC,January25,2003

5/26/16 CSE484/CSEM584-Spring2015 13

[fromMooreetal.“TheSpreadoftheSapphire/SlammerWorm”]

30MinutesLater

5/26/16 CSE484/CSEM584-Spring2015 14

Sizeofcirclesislogarithmicinthenumberofinfectedmachines

[fromMooreetal.“TheSpreadoftheSapphire/SlammerWorm”]

ImpactofSlammer

•  $1.25Billionofdamage•  Temporarilyknockedoutmanyelementsofcritical

infrastructure–  BankofAmericaATMnetwork–  EntirecellphonenetworkinSouthKorea–  FiverootDNSservers–  ContinentalAirlines’ticketprocessingsoftware

•  Thewormdidnotevenhavemaliciouspayload…simplybandwidthexhaustiononthenetworkandCPUexhaustiononinfectedmachines

5/26/16 CSE484/CSEM584-Spring2015 15

SlammerAcermath

5/26/16 CSE484/CSEM584-Spring2015 16

•  SlammerpacketswereubiquitousintheInternetformanyyearsafter2003–  CouldbeusedasatestforInternetconnectivityJ–  Packetsprovidedamapofvulnerablemachines

•  VanishedonMarch10-11,2011

[CrossandValacek]

Evidenceofaclock-basedshutofftrigger

Botnets

•  Botnetisanetworkofautonomousprogramscapableofactingoninstructions–  Typicallyalarge(uptoseveralhundredthousand)group

ofremotelycontrolled“zombie”systems•  Machineownersarenotawaretheyhavebeencompromised

–  Controlledandupgradedfromcommand-and-control(C&C)servers

•  Usedasaplatformforvariousattacks–  Distributeddenialofservice,Spamandclickfraud–  Launchingpadfornewexploits/worms

5/26/16 CSE484/CSEM584-Spring2015 17

WhattoDoWithaBotnet?

•  Denialofservice(includingcyber-warfare)•  Spam•  Fakean\virussales,Ransomware•  Adver\singclickfraud•  Bitcoinmining– AccordingtoSymantec,onecompromisedmachineyields41UScentsayear…

5/26/16 CSE484/CSEM584-Spring2015 18

DistributedDenialofService(DDoS)

5/26/16 CSE484/CSEM584-Spring2015 19

The image cannot be displayed. Your computer may not have enough memory to open the image, or the

Victim

The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and then open the file again. If the red x still appears, you may have to delete the image and then insert it again. Attacker

Mastermachines

Zombiemachines

HowtoProtectYourself?

•  Nothingisperfectbut…– Keepyoursocwareupdated– Bevigilantforphishingaiacks– An\-virus– Firewalls–  Intrusiondetec\onsystems

5/26/16 CSE484/CSEM584-Spring2015 20

OnlineEcosystemStudies

5/26/16 CSE484/CSEM584–Fall2015 21

CAPTCHA

•  CAPTCHA(CompletelyAutomatedPublicTuringtesttotellComputersandHumansApart)

•  Ar\ficialIntelligencetechnologycansolve99.8%

5/26/16 CSE484/CSEM584–Fall2015 22hip://googleonlinesecurity.blogspot.com/2014/12/are-you-robot-introducing-no-captcha.html

reCAPTCHA

•  Useriskanalysis,providebeieruserexperience

5/26/16 CSE484/CSEM584–Fall2015 23

DirtyJobs–TheRoleofFreelanceLaborinWebServiceAbuse

Followingslidesby:Mar\Motoyama,DamonMcCoy,KirillLevchenko,StefanSavage,andGeoffreyM.VoelkerUC

SanDiego

hips://www.usenix.org/legacy/events/sec11/tech/slides/motoyama.pdf

[Motoyamaetal.]

VulnerabilityofWebServices•  Manywebservicestodayarefree/openaccess–  Supportedbyadver\singrevenue–  Reachingcri\calmassrequireslowbarriertoentry–  Pageviewsdrivenbyuser-generatedcontent

•  Videos,socialnetworkingupdates,blogs,etc•  However,opennessleavessitesvulnerabletoabuse–  Exploita\onoffreeresources

•  Sendingspamfromwebbasedemailaccounts– Unsanc\onedadver\singchannels

•  Spamminglinksonblogcomments

5/26/16 CSE484/CSEM584–Fall2015 25

[Motoyamaetal.]

AbuseLaborMarkets

•  Abuseisprofitable– Kanichetal.es\mated$7k/dayemailspamrevenue

•  Labormarketshaveevolvedtosupplyworkers– Onlinefreelancingsites

•  Whyoutsourceabusejobs?– Costeffec\ve:Lowwageregions– Agile:Workersareadeptandtechnicallycapable– Scale:~onemillionworkersonFreelancer.com

5/26/16 CSE484/CSEM584–Fall2015 26

[Motoyamaetal.]

Outsourcingjobs

•  Freelancer.com:oneofthelargestoutsourcingandoldestfreelancingsites– Claimsover2millionemployersandworkers– Userpopula\oncovers234countries/regions

•  Howitworks:– Buyer/employerspostjobs– Workersbidonjobs– Buyersselectworkers

5/26/16 CSE484/CSEM584–Fall2015 27

[Motoyamaetal.]

5/26/16 CSE484/CSEM584–Fall2015 28

[Motoyamaetal.]

5/26/16 CSE484/CSEM584–Fall2015 29

[Motoyamaetal.]

5/26/16 CSE484/CSEM584–Fall2015 30

[Motoyamaetal.]

CAPTCHASolving

5/26/16 CSE484/CSEM584–Fall2015 31

[Motoyamaetal.]

5/26/16 CSE484/CSEM584–Fall2015 32

[Motoyamaetal.]

ExampleJobs:Accounts

5/26/16 CSE484/CSEM584–Fall2015 33

[Motoyamaetal.]

OSNLinking•  Buyingfriends,Facebookfans/linesforwebsitepages,Twiierfollowers,YouTubesubs,etc

5/26/16 CSE484/CSEM584–Fall2015 34

[Motoyamaetal.]

Example:OnlineSocialNetworkLink

5/26/16 CSE484/CSEM584–Fall2015 35

[Motoyamaetal.]

Useraccounts

5/26/16 CSE484/CSEM584–Fall2015 36

[Motoyamaetal.]

SearchEngine-OrientedContent

5/26/16 CSE484/CSEM584–Fall2015 37

[Motoyamaetal.]

FreelanceAbuse(USENIX2011)

•  7yearsofdatafromFreelancer.com:accountcrea\on,socialnetworklinks,spamming,SEO

5/26/16 CSE484/CSEM584–Fall2015 38

[Motoyamaetal.]

Summary

•  Aiackersoutsourceabusejobs– ~30%ofFreelancer.comjobsabusive–  Jobsspannedrangeofcategoriesfromspammingtoaccountregistra\on

•  Qualityofproductishighlyvariable•  Large,cheaplaborpoolchangesthreatmodel– Automa\onisnottheonlyway– Largelyremovesdifficultyinexecu\ngabusetask

•  Outsourcedworkforceenablesnewaiacks5/26/16 CSE484/CSEM584–Fall2015 39

[Motoyamaetal.]

5/26/16 CSE484/CSEM584–Fall2015 40