1 / 23

CSE331: Introduction to Networks and Security

CSE331: Introduction to Networks and Security. Lecture 32 Fall 2002. Recap. Malicious Programs Viruses Boot Viruses, Memory Resident, Macros Today: Computer Virus Defenses Computer Worms. “I Love You” Virus/Worm. Infection Rate

Download Presentation

CSE331: Introduction to Networks and Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. CSE331:Introduction to Networksand Security Lecture 32 Fall 2002

  2. Recap • Malicious Programs • Viruses • Boot Viruses, Memory Resident, Macros • Today: • Computer Virus Defenses • Computer Worms CSE331 Fall 2002

  3. “I Love You” Virus/Worm • Infection Rate • At 5:00 pm EDT(GMT-4) May 8, 2000, CERT had received reports from more than 650 sites • > 500,000 individual systems • VBScript • Propagation • Email, Windows file sharing, IRC, USENET news CSE331 Fall 2002

  4. Love Bug • Signature • An attachment named "LOVE-LETTER-FOR-YOU.TXT.VBS" • A subject of "ILOVEYOU" • Message body: "kindly check the attached LOVELETTER coming from me." CSE331 Fall 2002

  5. Love Bug Behavior • Replaced certain files with copies of itself • Based on file extension (e.g. .vbs, .js, .hta, etc) • Changed Internet Explorer start page • Pointed the browser to infected web pages • Mailed copies of itself • Changed registry keys CSE331 Fall 2002

  6. Detecting Viruses • Scanning • Integrity checking • Heuristic detection CSE331 Fall 2002

  7. Virus Signatures • Viruses can’t be completely invisible: • Code must be stored somewhere • Virus must do something when it runs • Fragments of the virus code itself • Strings “kindly check the attached LOVELETTER” • Effects on the computing environment • Changes to the Windows registry • Propagation Behavior • Copying/modifying system files. CSE331 Fall 2002

  8. Virus Scanners • Search the system for virus signatures • Main memory • All files in file system • Should also check boot sector • When to scan? • On access (when a program is run) • On demand (at user’s request, or scheduled) • When e-mail is received? • Before web content is displayed? CSE331 Fall 2002

  9. Virus Scanning: Pros & Cons • Pros • Effectively detects known viruses before they can cause harm • Few false alarms • Cons • Can detect only viruses with known signatures • Signature set must be kept up to date • Virus writers can easily change virus signatures CSE331 Fall 2002

  10. Integrity Checks • Virus scanner computes hash or checksum of executable files • Assumed to be virus free! • Stores the hash information • Verifies new hash vs. saved one during scan CSE331 Fall 2002

  11. Integrity Checks: Pros & Cons • Pros • Can detect corruption of executables too • Reliable • Doesn’t require virus signatures • Cons • False positives (i.e. recompilation) • Can’t use it on documents (they change too often) • Not supported by most vedors CSE331 Fall 2002

  12. Heuristic Detection • Collection of ad hoc rules that identifies virus behavior or virus-like programs • Modification of system executables • Modification of “template documents” like normal.doc • Self-modifying and self-referential code • … CSE331 Fall 2002

  13. Heuristics: Pros & Cons • Pros • Perhaps able to detect unknown viruses • Cons • Heuristics are hard to develop • Too may false positives CSE331 Fall 2002

  14. Polymorphic Viruses • Virus writers know that virus signatures are the most effective way to detect viruses • Polymorphic viruses mutate themselves during replication to prevent detection • Virus should be capable of generating many different descendents • Simply embedding random numbers into virus code is not enough CSE331 Fall 2002

  15. Strategies for Polymorphic Viruses • Change data: • Use different subject lines in e-mail • Encrypt most of the virus with a random key • Virus first decrypts main body using random key • Jumps to the code it decrypted • When replicating, generate a new key and encrypt the main part of the replica • Still possible to detect decryption portion of the virus using virus signatures CSE331 Fall 2002

  16. Advanced Polymorphic Viruses • Randomly modify the decryption portion of the virus by: • Inserting no-op instructions: subtract 0, move value to itself • Reordering independent instructions • Using different variable/register names • Using equivalent instruction sequencesy = x + x vs. y = 2 * x CSE331 Fall 2002

  17. CERT Advice 1 • Use virus protection software • Use a firewall • Don't open unknown email attachments • Don't run programs of unknown origin • Disable hidden filename extensions • Keep all applications, including your operating system, patched CSE331 Fall 2002

  18. Cert Advice 2 • Turn off your computer or disconnect from the network when not in use • Disable Java, JavaScript, and ActiveX if possible • Disable scripting features in email programs • Make regular backups of critical data • Make a boot disk in case your computer is damaged or compromised CSE331 Fall 2002

  19. Internet Worms • November 2, 1988 • Robert T. Morris Jr. unleashed Internet worm • Graduate student at Cornell University • Convicted in 1990 of violating Computer Fraud and Abuse Act • $10,000 fine, 3 yr. Suspended jail sentence, 400 hours of community service • Son of the chief scientist at the National Computer Security Center -- part of the National Security Agency • Today he’s a professor at MIT CSE331 Fall 2002

  20. Morris Worm Transmission • Find user accounts on the target machine • Dictionary attack on /etc/passwd • If it found a match, it would log in and try the same username/password on other local machines • Exploit bug in fingerd • Classic buffer overflow attack • Exploit trapdoor in sendmail • Programmer left DEBUG mode in sendmail, which allowed sendmail to execute an arbitrary shell command string. CSE331 Fall 2002

  21. Morris Worm Infection • Sent a small loader to target machine • 99 lines of C code • It was compiled on the remote platform (cross platform compatibility) • The loader program transferred the rest of the worm from the infected host to the new target. • Used authentication! To prevent sys admins from tampering with loaded code. • If there was a transmission error, the loader would erase its tracks and exit. CSE331 Fall 2002

  22. Morris Worm Stealth • When loader obtained full code • It put into main memory and encrypted • Original copies were deleted from disk • (Even memory dump wouldn’t expose worm) • Worm periodically changed its name and process ID CSE331 Fall 2002

  23. Effects • Resource exhaustion • Denial of service • There was a bug in the loader program that caused many copies of the worm to be spawned per host • System administrators cut their network connections • Couldn’t use internet to exchange fixes! • 6,000 networks were shut down or disconnected • Down for several days • Damage estimates: $100,000 — $97 Million CSE331 Fall 2002

More Related