Des petits bugs aux virus Quelques travaux et études au Laboratoire de Haute Sécurité du Loria. Jean-Yves Marion

Size: px

Start display at page:

Download "Des petits bugs aux virus Quelques travaux et études au Laboratoire de Haute Sécurité du Loria. Jean-Yves Marion"

Calvin Poole
5 years ago
Views:

1 Des petits bugs aux virus Quelques travaux et études au Laboratoire de Haute Sécurité du Loria!!!

2 Advertising networks Web applications Compromised XSS SQL Injection Data User User browser http protocole Server Java/PHP Many boundaries and possible attacks Untrusted applications

3 The ingredients of an attack.

4 Vulnerabilities Exploit 0-day Buffer/Stack overflow A bug may be exploited in order! to take control of a system A bug-free system is a good security! Need of a trusted formalization! See CompCert project! See formalization in COQ of PHP SQL/Code injection

5 Social engineering You can t patch stupidity

6 Figure 2. Timeline of WALEDAC activities Figure 6. WALEDAC rips text off from Obama s website, Figure 2. Christmas ecard website Botnet Waledac

7 Watering hole attack Installation of! Remote Administration Tool

8 The defenses.

Samples and Signatures High Security lab

9 Samples and Signatures High Security lab Today downloaded binaries malicious attacks Network traces 8 Go of PCAP data 110 Go of netflow!!! Malware repository 6 millions of malware Telescope and Honeypots! Architecture multi-providers Loria

Anti-Malware 1. Difficult for a human analyst to understand a malware code Detection by syntactic signature 1. Ollydbg Pro : Efficient and easy to implement Cons 2.

10 Anti-Malware 1. Difficult for a human analyst to understand a malware code Detection by syntactic signature 1. Ollydbg Pro : Efficient and easy to implement Cons 2.IDA : Signatures Pro are quasi-manually constructed Cons : Vulnerable to malware protections Integrity checks Introduction Trace abstraction Behavior patterns Abstracting by reduction Trace automata Trace automata Pro : Too many updates in a modern system Regular abstraction Behavior analysis Malicious behavior detection Experiments Conclusion Pro : Could detect new attacks Cons : Difficult to implement J-Y Marion, le 20 Septembre 2012 what is a bad behavior? Trace language of a program: generally undecidable. Approximation by a regular language: using trace collection or static analysis. = A trace automaton is a finite state approximation of some trace language. IcmpSendEcho GetDriveType FindFirstFile FindNextFile GetLogicalDriveStrings GetDriveType FindFirstFile FindNextFile FindFirstFile FindNextFile 64 Require to monitor the system 12 / 22

11 Undecidable! Bad M False Positive M Good M Malware False negative

12 The problem

13 Anti Anti-Malware 1.Obfuscation 2.Cryptography Malware analysis is very hard 3.Self-modification 4.Anti-analysis tricks Goal : Rational approach to help Felix the cat!

Obfuscation mis-alignment telock 01006e7a fe 04 0b inc byte [ ebx+ecx ] 01006e7d eb ff jmp +1 01006e7e ff c9 dec ecx 01006e80 7 f e6 jg 01006e68 01006e82 8b c1 mov eax, ecx IDA fails because of jmp

14 Obfuscation mis-alignment telock 01006e7a fe 04 0b inc byte [ ebx+ecx ] 01006e7d eb ff jmp e7e ff c9 dec ecx 01006e80 7 f e6 jg 01006e e82 8b c1 mov eax, ecx IDA fails because of jmp E7A inc byte ptr [ ebx+ecx ] 01006E7D jmp short near ptr loc_1006e7d E7D ; 01006E7F BB [0x0 -> 0x2] (0x3) db 0x00C9h inc byte ; [ebx+ecx] BB [0x4 -> 0x5] (0x2) 0x4 dec ecx 01006E80 db 7Fh ; 01006E81 db 0E6h ; 01006E82 db 8Bh ; 01006E83 db 0C1h ; BB [0x3 -> 0x4] (0x2) BB [0x6 -> 0x7] (0x2) With Radare (TODO: recursive?), 0x3 the jmp telock 0x4 example is disassembl 0x6 jg 0x ee BB [0x8 -> 0x9] (0x2) 0x8 mov eax, ecx

15 A common protection scheme for malware Decrypt Decrypt Decrypt Wave 1 Wave 2... payload A run is a sequence of waves Self-modifying program schema

16 The best definition! of a malware? And a fascinating! challenge

PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG

PRESENTED BY: SANTOSH SANGUMANI & SHARAN NARANG Table of contents Introduction Binary Disassembly Return Address Defense Prototype Implementation Experimental Results Conclusion Buffer Over2low Attacks