NYCU-LYX

6-Malicious Software

https://www.youtube.com/watch?v=X-ezH6QTil4

“A program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability (CIA) of the victim’s data, applications, or operating system or otherwise annoying or disrupting the victim.”

[SOUP13] Souppaya, M., and Scarfone, K. Guide to Malware Incident Prevention and Handling for Desktops and Laptops. NIST Special Publication SP 800-83, July 2013.

###

6.1  Types of Malicious Software (Malware)

Name Description
Advanced Persistent Threat (APT) Cybercrime directed at business and political targets, using a wide variety of intrusion technologies and malware, applied persistently and effectively to specific targets over an extended period, often attributed to state-sponsored organizations.
Adware Advertising that is integrated into software. It can result in pop-up ads or redirection of a browser to a commercial site.
Attack kit Set of tools for generating new malware automatically using a variety of supplied propagation and payload mechanisms.
Auto-rooter Malicious hacker tools used to break into new machines remotely.
Backdoor (trapdoor) Any mechanism that bypasses a normal security check; it may allow unauthorized access to functionality in a program, or onto a compromised system.
Downloaders Code that installs other items on a machine that is under attack. It is normally included in the malware code first inserted on to a compromised system to then import a larger malware package.
Drive-by-download An attack using code on a compromised website that exploits a browser vulnerability to attack a client system when the site is viewed.
Exploits Code specific to a single vulnerability or set of vulnerabilities.
Flooders (DoS client) Used to generate a large volume of data to attack networked computer systems, by carrying out some form of denial-of-service (DoS) attack.
Keyloggers Captures keystrokes on a compromised system.
Logic bomb Code inserted into malware by an intruder. A logic bomb lies dormant until a predefined condition is met; the code then triggers some payload.
Macro virus A type of virus that uses macro or scripting code, typically embedded in a document or document template, and triggered when the document is viewed or edited, to run and replicate itself into other such documents.
Mobile code Software (e.g., script and macro) that can be shipped unchanged to a heterogeneous collection of platforms and execute with identical semantics.
Rootkit Set of hacker tools used after attacker has broken into a computer system and gained root-level access.
Spammer programs Used to send large volumes of unwanted e-mail.
Spyware Software that collects information from a computer and transmits it to another system by monitoring keystrokes, screen data, and/or network traffic; or by scanning files on the system for sensitive information.
Trojan horse A computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms, sometimes by exploiting legitimate authorizations of a system entity that invokes it.
Virus Malware that, when executed, tries to replicate itself into other executable machine or script code; when it succeeds, the code is said to be infected. When the infected code is executed, the virus also executes.
Worm A computer program that can run independently and can propagate a complete working version of itself onto other hosts on a network, by exploiting software vulnerabilities in the target system, or using captured authorization credentials.
Zombie, bot Program installed on an infected machine that is activated to launch attacks on other machines.

A Broad Classification of Malware

Attack Kits

Attack Sources

6.2  Advanced Persistent Threat

Advanced Persistent Threat (APT) 是指由具有高技能和資源的組織或個人發起的長期、持續的攻擊。APT 攻擊的目標通常是敏感信息，例如企業機密、政府數據或國家安全信息。

APT Attacks

6.3  Propagation—Infected Content—Viruses

The Nature of Viruses

Viruses: Propagation via Infected Content

three states of a computer virus :

Virus lifetime:

A Simple Virus

A Compression Virus

Logic of the Compression Virus

Macro and Scripting Viruses (巨集病毒)

Macro and Scripting Viruses

Macro Virus Structure

Figure 6.1 Melissa Macro Virus Pseudo-code

macro Document_Open
    disable Macro menu and some macro security features
    if called from a user document
       copy macro code into Normal template file
    else
       copy macro code into user document being opened
    end if
    if registry key “Melissa” not present
       if Outlook is email client
          for first 50 addresses in address book
              send email to that address
              with currently infected document attached
          end for
      end if
        create registry key “Melissa”
   end if
   if minute in hour equals day of month
     insert text into document being opened
   end if
end macro

Viruses Classification

two orthogonal axes:

  1. the type of target the virus tries to infect
  2. method the virus uses to conceal(隱蔽) itself from detection by users and anti-virus software.

Virus Classifications (By Target)

Virus Classifications (By Concealment Strategy)

6.4  Propagation—Vulnerability Exploit—Worms

To replicate itself, a worm uses some means to access remote systems. These include the following, most of which are still seen in active use:

Target Discovery

short scanning period ➝ difficult to detect

Worm Propagation Model

teacher doesn’t teach this section

The Morris Worm

A Brief History of Worm Attacks

Melissa 1998 e-mail worm: propagated to all of the email addresses known to the infected host; took only three days to infect over 100,000 computers
Code Red
 July 2001
 exploited a security hole in the Microsoft Internet Information Server (IIS) DDoS attacks against a government website by flooding
Infected nearly 360,000 servers in 14 hours
Code Red II
 August 2001
 Installed a backdoor for a hacker to remotely execute commands
Nimda
 September 2001
 had worm, virus and mobile code characteristics
spread using e-mail, Windows shares, Web servers, Web clients, backdoors
SQL Slammer
 Early 2003
 exploited a buffer overflow vulnerability in MS SQL server
compact and spread rapidly: infected 90% of vulnerable hosts within 10 mins
Sobig.F
 Late 2003
 exploited open proxy servers to turn infected machines into spam engines produced more than one million copies of itself within the first 24 hours
Mydoom
 2004
 mass-mailing e-mail worm
installed a backdoor in infected machines replicated up to 1,000 times per minute
Warezov

 2006
 (1) creates executables in system directories; (2) sends itself as an e-mail attachment; (3) can disable security related products and updating capability
Conficker (Downadup)
 November 2008
 exploits a Windows buffer overflow vulnerability most widespread infection since SQL Slammer
Stuxnet
 2010
 restricted rate of spread to reduce chance of detection
targeted industrial control systems (Iranian nuclear program)
propagation: USB drives, network file shares, zero-day vulnerability exploits
1st serious use of a cyberwarfare weapon against a nations physical infrastructure
Duqu
 2011
 Used code related to Stuxnet Targeted the Iranian nuclear program
Flame family
 2012
 Targeted Middle-Eastern countries
Very successful infection strategies: infected many countries, including the systems physically isolated from Internet
WannaCry
 2017
 Ransomware attack: encrypted files; demanded a ransom payment to recover Very fast propagation: infected > 100,000 systems over a period of hours to days Exploited a vulnerability in the SMB file sharing service on unpatched Windows

State of Worm Technology

Mobile Code (行動程式碼)

Reference: https://owasp.org/www-community/vulnerabilities/Unsafe_Mobile_Code

Mobile Phone Worms

Client-Side Vulnerabilities and Drive-by-Downloads

Clickjacking

6.5  Propagation—Social Engineering—Spam E-Mail, Trojans

Spam (Unsolicited Bulk) E-Mail

Trojan Horses

特洛伊木馬是一種惡意軟體，它看起來像是合法的軟體或有用的工具，但實際上執行了有害的操作。特洛伊木馬可以用來獲取敏感信息、安裝間諜軟體或執行其他惡意活動。

特洛伊木馬可以以多種方式傳播，包括：

特洛伊木馬可以執行各種有害操作，包括：

Mobile Phone Trojans

6.6  Payload—System Corruption

payload : what actions it will take on this system

Data Destruction and Ransomware (勒索病毒)

Real-World Damage

Ukraine Power Grid Cyberattack

Logic Bomb

6.7  Payload—Attack Agent—Zombie, Bots

Uses of Bots

Remote Control Facility

6.8  Payload—Information Theft—Keyloggers, Phishing, Spyware

Credential Theft, Keyloggers, and Spyware

Keylogger

Privacy Leakage of InputConnection Interface in Android

Chi-Yu Li, Hsin-Yi Wang, Wei-Ching Wang, Chun-Ying Huang, “Privacy Leakage and Protection of InputConnection Interface in Android,” IEEE TNSM, 2021.

Spyware

Phishing and Identity Theft

Phishing

Spear-phishing

Reconnaissance, Espionage, and Data Exfiltration

6.9 Payload—Stealthing—Backdoors, Rootkits

Backdoor

Rootkit

Kernel Mode Rootkits

Virtual Machine and Other External Rootkits

6.10 Countermeasures

Malware Countermeasure Approaches

Host-Based Scanners and Signature-Based Anti-Virus

Host-based dynamic Malware analysis

Spyware Detection and Removal

Spyware is software that secretly installs itself on a computer without the user’s knowledge or consent to collect personal information or track online activity.

Rootkit Countermeasures

Rootkits are a type of malware that hides itself deep within a computer’s system, granting attackers unauthorized control.

###

Perimeter Scanning Approaches

Perimeter scanning involves monitoring a network’s borders to identify and block potential threats.

Distributed Intelligence Gathering Approaches

Distributed Intelligence (DI) gathering involves collecting information from various sources, such as sensors, social media, and open-source intelligence (OSINT).

Key Points:

6.11 Key Terms, Review Questions, and Problems

6.1 What are three broad mechanisms that malware can use to propagate?

  1. Replication: Malware copies itself to other systems, often through email attachments, infected websites, or removable media.
  2. Exploitation: Malware takes advantage of vulnerabilities in software to gain unauthorized access to a system.
  3. Social engineering: Malware tricks users into installing it or revealing sensitive information.

6.2 What are four broad categories of payloads that malware may carry?

  1. Destructive: Malware that damages or destroys data or systems.
  2. Data theft: Malware that steals sensitive information, such as passwords or financial data.
  3. Disruptive: Malware that disrupts normal operations, such as by launching denial-of-service attacks.
  4. Spyware: Malware that collects information about users’ activities without their knowledge or consent.

6.3 What characteristics of an advanced persistent threat give it that name?

  1. Stealth: Advanced persistent threats (APTs) are designed to be stealthy and avoid detection.
  2. Targeted: APTs are typically targeted at specific organizations or individuals.
  3. Resourceful: APTs have access to significant resources and can adapt to changing security measures.
  4. Persistent: APTs can maintain access to a system for extended periods of time.

6.4 What are typical phases of operation of a virus or worm?

  1. Infection: The virus or worm infects a single system.
  2. Propagation: The virus or worm replicates itself and spreads to other systems.
  3. Payload execution: The virus or worm executes its payload, which may be destructive, disruptive, or data theft-related.

6.5 What is a blended attack?

A blended attack is an attack that combines multiple attack vectors, such as phishing emails with malicious attachments.

6.6 What is the difference between a worm and a zombie?

A worm is a type of malware that can replicate itself and spread to other systems without human intervention. A zombie is a computer that has been infected with malware and can be controlled remotely by an attacker.

6.7 What does “fingerprinting” mean for network worms?

Fingerprinting is the process of identifying a network worm by analyzing its code or behavior.

6.8 What is a “drive-by-download” and how does it differ from a worm?

A drive-by-download is a type of attack that exploits vulnerabilities in web browsers to install malware on a computer. Unlike a worm, a drive-by-download does not replicate itself.

6.9 How does a Trojan enable malware to propagate? How common are Trojans on computer systems? Or on mobile platforms?

Trojans enable malware to propagate by tricking users into installing them. Trojans are relatively common on both computer systems and mobile platforms.

6.10 What is a “logic bomb”?

A logic bomb is a type of malware that is triggered by a specific event, such as a date or a time.

6.11 What is the difference between a backdoor, a bot, a keylogger, spyware, and a rootkit? Can they all be present in the same malware?

Yes, all of these types of malware can be present in the same piece of malware.

6.12 What is the difference between a “phishing” attack and a “spear-phishing” attack, particularly in terms of who the target may be?

A phishing attack is a type of attack that attempts to trick users into revealing sensitive information, such as passwords or credit card numbers. Spear-phishing is a more targeted form of phishing that is directed at specific individuals or group