Malware

31
History and Evolution of Malware How to fight malicious code Nikola Milošević [email protected] g

TAGS:

description

Nikola Milošević from OWASP local chapter Serbia held presentation on December 10th in University of Belgrade, School of Electrical Engineering about history and evolution of Malware, from Brain to Flame.

Transcript of Malware

Page 1: Malware

History and Evolution of MalwareHow to fight malicious code

Nikola Milošević[email protected]

Page 2: Malware

About Me

• My name is Nikola Milošević• OWASP Serbia local chapter leader• OWASP anty-malware project contributor• Interested in topic, wrote and analyzed some

keyloggers, spam bombers for self amusement and educational purposes

• Working at ManageWP,Prelovac Media

CompanyLogo

Page 3: Malware

What is malware?

• Malware, short for malicious (or malevolent) software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Page 4: Malware

How it started?

• Brain.A – January 1986.• Welcome to the Dungeon © 1986 Basit * Amjad (pvt) Ltd. BRAIN COMPUTER SERVICES

730 NIZAM BLOCK ALLAMA IQBAL TOWN LAHORE-PAKISTAN PHONE: 430791,443248,280530. Beware of this VIRUS.... Contact us for vaccination...

Page 5: Malware

Then it continued

• Stoned -1987• Cascade – 1987• Form - 1990• Omega – showing omega sign on Friday 13• Michelangelo – 1992• V-Sign – 1992• Walker...

Page 6: Malware

Mutation

• 1992. MtE or Mutation Engine• Creating polimorph viruses, hard to detect• Author – Dark Avenger

Page 7: Malware

GUI

• Virus Creation Labor

Page 8: Malware

Windows came out

• WinVir – 1992 – first capable of infecting PE files

• Monkey – again Master Boot Record• One_half – polimorphism, crypting• Concept – 1995 – infecting Office files

Page 9: Malware

Windows...

• Laroux (X97M/Laroux) 1996.• Boza (jan 1996.)• Marburg (1998)– Wargames CD– PC Power Play CD– Slow polimorphism– After 3 months he shows:

Page 10: Malware
Page 11: Malware

Mail worms...

• Happy99 (1998) - first mail virus• Melissa – macro virus+mail worm• LoveLetter (2001) – one of the bigest outbreak in history• Anakournikova – social engineering• Mimail (2003)

Page 12: Malware

Real worms

• Morris Worm (1988) – first internet worm• CodeRed (2000) – no user interaction– Spread around the globe in few hours(attacked

IIS)– After 19. days lunched DoS attacks (White House)

Page 13: Malware

Real worms 2

• Nimda – mail virus with attachemnt affecting Win 95,98,Me,NT4,2000– Worm affecting IIS using unicode exploit– Modifies website to offer downloading of infecting

files– Used end user machines to scan network– Can reach PC behing firewalls– Has bug that causes crashes or inability to spread

Page 14: Malware

Money, money, money

• In 2003 was found first virus made for financial gain

• Fizzer – sending spam– Attachment that takes over PC and send spam

Page 15: Malware

Malware authors

Page 16: Malware

Malware authors

Page 17: Malware

Getting destructive

• Slapper (September 13th 2002)– used OpenSSL vulnerability to spread. – Had backdoor that listened on port UDP2002.– Infected Linux hosts (Apache servers)

• Slammer (2003) – Attacks SQL Server, – never writes anything to HDD. – Generates trafic. – Root nameservers down (5 of 13)

Page 18: Malware

Getting destructive 2

• Blaster (august 2003)– Buffer overflow in DCOM RPC– SYN flood on windowsupdate.com (Aug 15 2003)– 2 messages :

• I just want to say LOVE YOU SAN!!soo much• billy gates why do you make this possible ? Stop making money and fix

your software!!

• Sasser (April 2004.)– Used buffer overflow in Local Security Authority Subsystem

Service– Spread over network– Crushed infected PC in minute

Page 19: Malware

Getting destructive 3

Page 20: Malware
Page 21: Malware
Page 22: Malware

Rootkits

• Sony BMG (2005)– First rootkit was created by SONY– Kelly Minogue, Ricky Martin and 50 more titles– Intension was copy protection– Hides files that stats with $sys$– Virus writers used it to hide– Great scandal– Bad PR handling by SONY

Page 23: Malware

Rootkits

• Mebroot (2008)– Uses browser explot (used Monica Beluci web site),

infects MBR– Hides as rootkit– Sends keystrokes to attacker, if it crashes sends trace to

attacker/creator

• Conficker(2008) – Created botnet– Spread using USB, NS, LAN– 9-15 million infected

Page 24: Malware

Ransomware

• Blackmailing

Page 25: Malware

Let the war begin

• Spyware, keyloggers• Cyber espionage, industrial espionage• German police released Troyan spyware in

2010

Page 26: Malware

When the war get serious

• Stuxnet (2010)– Big game changer, first intended phisical sabotage

of industrial system– Spread over USB, used 5 exploits (4 was 0days)– When it was discovered it already did what it was

made for– Kills itself on June 24th 2012.– To do something PC has to be connected to

particular PLC that is connected to particular industry

Page 27: Malware

When the war get serious 2

• DoQu (September 2011)– Similar codebase as Stuxnet– Used for information retrieval and espionage of victim, but has injection and

rootkit capabilities– Written in higher languages, it is believed OO C, compiled with MS Visual Studio

2008

• Flame(2012)– Can spread using USB or LAN– Can record audio, video, skype calls, network trafic, steal files (Office, PDF,

txt)...– About 20MB!!! But modular, so attacker can add more modules– Written in Lua and C++– Remotly controled and killed– As DoQu and Stuxnet has valid stolen cerificate

Page 28: Malware

Quick classification

• Virus• Worm• Troyan horse• Malicious mobile code• Backdoor• User and Kernel level rootkits• Combination malware

Page 29: Malware

Malware analysis

• Its all about reverse engineering– Reverse engineer how malware works– Specifiy algorithm for protection– Develop protection

• Some malware analysis labs automated some processes

• Not everything can be automated

Page 30: Malware

Reverse engineering

• Dinamic reverse engineering– Have system diagnostic tools and loggers– Run the code– Observe what is happening to system, network,

files...

• Static reverse engineering– Decompile the code– Analyze it and find out what is code doing

Page 31: Malware

Questions


Anatomy of a Malware Attack: The New Malware Ecosystem

Anatomy of a Malware Attack: The New Malware Ecosystem

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Computer Virology and Mobile Malware Detection · 2019-03-14 · Outline •Introduction •Computer Virology • Malware taxonomy • Encrypted malware •Malware Detection •Mobile

Intrusion Detection and Malware Analysis - Malware collection

Intrusion Detection and Malware Analysis - Malware collection

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

Introduction to Mobile Malware. Outline ➢ Introduction ➢ Types of Malware ➢ Malware examples ➢ How Malware Spreads ➢ Prevention ➢ AndroRAT Hands-on Lab.

HTA-T07R Malware Hunting with the Sysinternals Toolsindex-of.co.uk/Malware/hta-t07r-license-to-kill-malware-hunting-with... · malware Professional antimalware analysis requires years

HTA-T07R Malware Hunting with the Sysinternals Toolsindex-of.co.uk/Malware/hta-t07r-license-to-kill-malware-hunting-with... · malware Professional antimalware analysis requires years

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Malware - courses.cs.washington.edu · 2015. 5. 15. · Malware • Malicious’code’often’masquerades’as’good’ software’or’attaches’itself’to’good’software’

Malware and Anti-Malware Seminar by Benny Czarny

Malware and Anti-Malware Seminar by Benny Czarny

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware … · 2011-08-16 · Malware Analysis and Antivirus Technologies: Kernel Malware & A Look at Malware

Windows Malware Firewall: Remove Windows Malware Firewall

Windows Malware Firewall: Remove Windows Malware Firewall

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

An Introduction To Keyloggers, RATS And Malware€¦ · Malware Malware has been a problem for ages, Malware is short form of malicious software. A Malware is basically a program

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Ch 12: Covert Malware Launching - samsclass.info · Practical Malware Analysis Ch 12: Covert Malware Launching Last revised: 4-10-17. Hiding Malware • Malware used to be visible

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Using optimization algorithms for malware deobfuscationsigurnost.zemris.fer.hr/ns/malware/2010_spasojevic/Diplomski_Spasojevic.pdf · Using optimization algorithms for malware deobfuscation

Reversing malware analysis training part8 malware memory forensics

Reversing malware analysis training part8 malware memory forensics

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile ...

Mobile Malware Network View - Black Hat · Mobile Malware Network View ... ... Windows Malware impacts mobile ...

Practical Malware Analysis: Ch 11: Malware Behavior

Practical Malware Analysis: Ch 11: Malware Behavior

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Malware Slums: Measurement and Analysis of Malware on ...homepage.cs.uiowa.edu/~mshafiq/files/malware... · Malware Slums: Measurement and Analysis of Malware on Traffic Exchanges

Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Reversing & Malware Analysis Training Part 8 - Malware Memory Forensics

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Intrusion Detection and Malware Analysis - Malware analysis · Intrusion Detection and Malware Analysis Malware analysis Pavel Laskov Wilhelm Schickard Institute for Computer Science

Malware) - psy.chula.ac.th · Hybrid Malware/Blended Threats อันตรายมากเพราะได้รวม ความสามารถของ ไวรัส

Malware) - psy.chula.ac.th · Hybrid Malware/Blended Threats อันตรายมากเพราะได้รวม ความสามารถของ ไวรัส