Airborne Viruses. Cyrus Peikari, M.D. Airscanner Mobile Security. (C) 2003 Airscanner Corp. 1

Size: px

Start display at page:

Jasmin Webb
5 years ago
Views:

5 Vmyth or reality? In nature, viruses infect all organisms, even the tiniest bacteria. Likewise, computer viruses infect all platforms that reach a modicum of sophistication. (C) 2003 Airscanner Corp. 5

9 Scope of the problem Slammer and Code Red each estimated to have cost $2.5 billion (BBC) Worldwide virus cost between $10- $20 billion a year. (BBC, Computer Economics) Global AV software sales to rise from $2 billion in 2002 to just under $4 billion in (Frost & Sullivan) (C) 2003 Airscanner Corp. 9

10 Scope of potential wireless vectors Over 100 million wireless phones shipped each year (IDC) Smartphones represent a rapidly growing share of these Approx. 10 million PDAs shipped each year, incl. softphones (Brighthand) Windows CE.NET may increase the threat (distributed, wireless data) CE platform builder allows any programmer to add an operating system to toasters, bicycles, etc. (C) 2003 Airscanner Corp. 10

11 Airborne Viruses Inevitable According to Microsoft, there are currently no viruses for the Smartphone platform but even Microsoft admits it is only a matter of time. (CNN, October 15, 2003) Other platforms are already infected. (C) 2003 Airscanner Corp. 11

13 Liberty Crack Trojan First wireless Trojan. Spread via wireless . Liberty allows Nintendo GameBoy games to run on the Palm OS. Liberty authors released poisoned crack on IRC. Liberty crack virus deletes all applications from the PDA. (C) 2003 Airscanner Corp. 13

15 911 virus Mobile DoS Flooded Tokyo s emergency services number with SMS messages. Hit over 100,000 mobile phones Users were invited to visit a hostile web page Target web page activated script to dial 110 (C) 2003 Airscanner Corp. 15

17 SMS Format attacks Scandinavia: SMS virus locked out the handset buttons. Norway: service developer Web2WAP found exploit on Nokia phones caused by its software: keypad knocked out for 60 sec after a specially formatted SMS (C) 2003 Airscanner Corp. 17

19 Embedded Reverse Code Engineering (RCE) RCE is the fundamental skill required for anti-virus research. Allows you to dissect unknown, possibly hostile binaries. Embedded RCE is a virgin field. (C) 2003 Airscanner Corp. 19

20 Reverse Engineering Tools Hex Editor Needed to make changes to program files UltraEdit32 Disassembler Converts program file into ASM code IDA Pro Debugger Allows real time execution and walk through of code Microsoft embedded Visual C (C) 2003 Airscanner Corp. 20

21 Embedded RCE Tools Microsoft embedded Visual Tools (MVT): free download from IDA Pro: Airscanner Mobile Antivirus: Free tool with Anti-Virus, Anti-Trojan debugging features from (C) 2003 Airscanner Corp. 21

22 Windows CE Includes Pocket PC, Smartphone Truly multi-tasking, embedded OS. A stripped-down, fully functional version of Windows Powerful and robust, but even Microsoft admits it is utterly bereft of security features. Likely to be #1 target platform for embedded, mobile viruses. (C) 2003 Airscanner Corp. 22

23 CE Architecture ARM/X-scale processor support Protected Kernel. IMPORTANT: DLLs execute as part of the OS, rather than separately. You cannot use MVT to crack a DLL while program is running. In Windows CE, ROM can execute in place (XIP). (C) 2003 Airscanner Corp. 23

30 Airscanner virus and trojan debugging tool Free for personal use Open architecture allows you to plug in your own virus hex signatures. Process viewer for detecting memory resident viruses, Trojans and spyware. Integrated registry scanner for detecting installed malware. (C) 2003 Airscanner Corp. 30

32 Summary Examples of airborne viruses Embedded architecture review Reverse engineering tools Embedded RCE setup Please write with any questions or comments, or if you need additional materials: (C) 2003 Airscanner Corp. 32

How to Identify Advanced Persistent, Targeted Malware Threats with Multidimensional Analysis

White paper How to Identify Advanced Persistent, Targeted Malware Threats with Multidimensional Analysis AhnLab, Inc. Table of Contents Introduction... 1 Multidimensional Analysis... 1 Cloud-based Analysis...