Bài giảng Cryptography and Network Security - Chapter 11: Malicious software

Cryptography and Network Security

Chapter 11

Malicious Software

Phần mềm độc hại

Lectured by

Nguyễn Đức Thái

Outline

các loại phần mềm độc hại

. Types of Malicious Software

. Viruses

. Virus Countermeasures

Biện pháp đối phó Virus

. Worms

. Distributed Denial of Service Attacks

2

Phần mềm độc hại là phần mềm được cố tình hoặc

Key Points

chèn vào trong một hệ thống cho một mục đích gây hại

. Malicious software is software that is intentionally included

or inserted in a system for a harmful purpose.

lây nhiễm

. A virus is a piece of software that can “infect” other

Một virus là một phần của phần mềm mà có thể "lây nhiễm" các

chương trình khác bằng cách sửa đổi chúng; việc sửa đổi bao

programs by modifying them; the modification includes a

gồm một bản sao của các chương trình virus, sau đó có thể đi

copy of the virus program, which can then go on to infect

để lây nhiễm vào các chương trình khác.

other programs.

Một con sâu là một chương trình có thể tự tái tạo và gửi

. A worm is a program that can replicate itself and send copies

bản sao từ máy tính đến máy tính thông qua kết nối mạng.

from computer to computer across network connections.

• Upon arrival, the worm may be activated to replicate and propagate

Khi đến nơi, sâu có thể được kích hoạt để tái tạo và tuyên

again.

truyền lần nữa.

• In addition to propagation, the worm usually performs some

unwanted function.

Ngoài nhân giống, worm thường thực hiện một số chức năng

không mong muốn.

3

Key Points

. A denial of service (DoS) attack is an attempt to prevent

legitimate users of a service from using that service.

. A distributed denial of service (DDOS) attack is launched from

multiple coordinated sources.

Một sự từ chối dịch vụ (DoS) tấn công là một nỗ lực để ngăn chặn

người dùng hợp pháp một dịch vụ từ việc sử dụng dịch vụ đó

Một tấn công từ chối dịch vụ tấn công (DDOS) được khởi động từ

nhiều nguồn phối hợp

4

Intro

. Perhaps the most sophisticated types of threats to computer

systems are presented by programs that exploit

vulnerabilities in computing systems.

. Such threats are referred to as malicious software, or

malware.

. In this context, we are concerned with threats to application

programs as well as utility programs, such as editors and

compilers, and kernel-level programs.

Có lẽ các loại phức tạp nhất của các mối đe dọa hệ thống máy tính

được đại diện bởi các chương trình khai thác lỗ hổng trong hệ thống

máy tính

các mối đe dọa như vậy được gọi là các phần mềm có hại, hoặc

phần mềm độc hại

chúng ta đang quan tâm đến các mối đe dọa cho các chương trình ứng

dụng cũng như các chương trình tiện ích, chẳng hạn như biên tập và

trình biên dịch, và các chương trình hạt nhân cấp.

5

Types of Malicious Software

Phần mềm độc hại có thể được chia thành hai loại

. Malicious software can be divided into two categories:

• those that need a host program, and

• those that are independent.

. The former, referred to as parasitic, are essentially fragments

of programs that cannot exist independently of some actual

application program, utility, or system program. Viruses, logic

bombs and backdoors are examples

. Independent malware is a self-contained program that can be

scheduled and run by the operating system. Worms and bot

programs are examples

6

Types of Malicious Software

. We can also differentiate between those software threats

that do not replicate and those that do.

. The former are programs or fragments of programs that are

activated by a trigger. Examples are logic bombs, backdoors,

and bot programs.

. The latter consist of either a program fragment or an

independent program that, when executed, may produce one

or more copies of itself to be activated later on the same

system or some other system. Viruses and worms are

examples.

7

Types of Malicious Software

8

Backdoor

. A backdoor, also known as a trapdoor, is a secret entry point

into a program that allows someone who is aware of the

backdoor to gain access without going through the usual

security access procedures.

. Programmers have used backdoors legitimately for many

years to debug and test programs; such a backdoor is called a

maintenance hook

. This usually is done when the programmer is developing an

application that has an authentication procedure, or a long

setup, requiring the user to enter many different values to

run the application. To debug the program, the developer

may wish to gain special privileges or to avoid all the

necessary setup and authentication

9

Backdoor

. The programmer may also want to ensure that there is a

method of activating the program should something be

wrong with the authentication procedure that is being built

into the application.

. The backdoor is code that recognizes some special sequence

of input or is triggered by being run from a certain user ID or

by an unlikely sequence of events.

. Backdoors become threats when unscrupulous programmers

use them to gain unauthorized access

. It is difficult to implement operating system controls for

backdoors.

. Security measures must focus on the program development

and software update activities.

10

Logic bomb

. One of the oldest types of program threat, predating viruses

and worms, is the logic bomb.

. The logic bomb is code embedded in some legitimate

program that is set to “explode” when certain conditions are

met.

. Examples of conditions that can be used as triggers for a

logic bomb are the presence or absence of certain files, a

particular day of the week or date, or a particular user

running the application.

. Once triggered, a bomb may alter or delete data or entire

files, cause a machine halt, or do some other damage

11

Trojan horses

. A Trojan horse is a useful, or apparently useful, program or

command procedure containing hidden code that, when

invoked, performs some unwanted or harmful function.

. Trojan horse programs can be used to accomplish functions

indirectly that an unauthorized user could not accomplish

directly

• For example, to gain access to the files of another user on a shared

system, a user could create a Trojan horse program that, when

executed, changes the invoking user’s file permissions so that the files

are readable by any user.

• The author could then induce users to run the program by placing it in

a common directory and naming it such that it appears to be a useful

utility program or application

12

Trojan horses

Trojan horses fit into one of three models:

. Continuing to perform the function of the original program

and additionally performing a separate malicious activity

. Continuing to perform the function of the original program

but modifying the function to perform malicious activity (e.g.,

a Trojan horse version of a login program that collects

passwords) or to disguise other malicious activity (e.g., a

Trojan horse version of a process listing program that does

not display certain processes that are malicious)

. Performing a malicious function that completely replaces the

function of the original program

13

Mobile code

. Mobile code refers to programs (e.g., script, macro, or other

portable instruction) that can be shipped unchanged to a

heterogeneous collection of platforms and execute with

identical semantics .

. Mobile code is transmitted from a remote system to a local

system and then executed on the local system without the

user’s explicit instruction.

. Mobile code often acts as a mechanism for a virus, worm, or

Trojan horse to be transmitted to the user’s workstation.

. In other cases, mobile code takes advantage of vulnerabilities

to perform its own exploits, such as unauthorized data access

or root compromise

14

Multiple-Threat Malware

. Viruses and other malware may operate in multiple ways.

. A multipartite virus infects in multiple ways.

. Typically, the multipartite virus is capable of infecting

multiple types of files, so that virus eradication must deal with

all of the possible sites of infection

. A blended attack uses multiple methods of infection or

transmission, to maximize the speed of contagion and the

severity of the attack.

15

Multiple-Threat Malware

. An example of a blended attack is the Nimda attack,

erroneously referred to as simply a worm.

. Nimda uses four distribution methods:

• E-mail: A user on a vulnerable host opens an infected e-mail

attachment; Nimda looks for e-mail addresses on the host and then

sends copies of itself to those addresses.

• Windows shares: Nimda scans hosts for unsecured Windows file

shares; it can then use NetBIOS86 as a transport mechanism to infect

files on that host in the hopes that a user will run an infected file, which

will activate Nimda on that host.

• Web servers: Nimda scans Web servers, looking for known

vulnerabilities in Microsoft IIS. If it finds a vulnerable server, it attempts

to transfer a copy of itself to the server and infect it and its files.

• Web clients: If a vulnerable Web client visits a Web server that has

been infected by Nimda, the client’s workstation will become infected.

16

Viruses

. piece of software that infects programs

• modifying them to include a copy of the virus

• so it executes secretly when host program is run

. specific to operating system and hardware

• taking advantage of their details and weaknesses

17

Virus structure

A computer virus has three parts:

. Infection mechanism: The means by which a virus spreads,

enabling it to replicate. The mechanism is also referred to as

the infection vector.

. Trigger: The event or condition that determines when the

payload is activated or delivered.

. Payload: What the virus does, besides spreading. The payload

may involve damage or may involve benign but noticeable

activity.

18

Virus structure

19

Virus phases

A typical virus goes through the following four phases:

. Dormant phase: The virus is idle. The virus will eventually be activated

by some event, such as a date, the presence of another program or file, or

the capacity of the disk exceeding some limit. Not all viruses have this

stage.

. Propagation phase: The virus places a copy of itself into other

programs or into certain system areas on the disk. The copy may not be

identical to the propagating version; viruses often morph to evade

detection. Each infected program will now contain a clone of the virus,

which will itself enter a propagation phase.

. Triggering phase: The virus is activated to perform the function for

which it was intended. As with the dormant phase, the triggering phase

can be caused by a variety of system events, including a count of the

number of times that this copy of the virus has made copies of itself

. Execution phase: The function is performed. The function may be

harmless, such as a message on the screen, or damaging, such as the

destruction of programs and data files

20

Bài giảng Cryptography and Network Security - Chapter 11: Malicious software - Nguyễn Đức Thái