dr richard ford n.
Download
Skip this Video
Loading SlideShow in 5 Seconds..
Malicious Code: History PowerPoint Presentation
Download Presentation
Malicious Code: History

Loading in 2 Seconds...

play fullscreen
1 / 34

Malicious Code: History - PowerPoint PPT Presentation


  • 116 Views
  • Uploaded on

Dr. Richard Ford. Malicious Code: History. What We’re Going to Talk About. Where viruses have been… How it all began Milestones in virus and antivirus history The Technology Race Between Black Hats and White Hats Where Things Are Today. Way Back in the ’50s. Bell Labs… Core Wars

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about 'Malicious Code: History' - jett


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
what we re going to talk about
What We’re Going to Talk About
  • Where viruses have been…
  • How it all began
  • Milestones in virus and antivirus history
  • The Technology Race Between Black Hats and White Hats
  • Where Things Are Today
way back in the 50s
Way Back in the ’50s
  • Bell Labs…
  • Core Wars
  • Two computer programs would “battle it out” in the “core” of a computer. The victor would be the last man standing
  • Mainstreamed in May 1984 in Scientific American
first things
First Things…
  • Where it all began:
    • Elk Cloner
    • “It will get on all your disks It will infiltrate your chips Yes it's Cloner! It will stick to you like glue It will modify ram too Send in the Cloner!”
    • Virus folklore tells us that this virus was actually an experiment gone wrong… readers beware
    • Attacked the Apple II
fred cohen theory
Fred Cohen: Theory
  • Fred’s work is really famous…
  • You can read some of his papers at http://www.all.net/resume/papers.html
  • Cohen postulated that one could construct a computer program that could “infect” other programs with a “possibly evolved” version of itself.
cohen example
Cohen: Example
  • The following pseudo-program shows how a virus might be written in a pseudo-computer language. The ":= symbol is used for definition, the ":" symbol labels a statement, the ";" separates statements, the "=" symbol is used for assignment or comparison, the "~" symbol stands for not, the "{" and "}" symbols group sequences of statements together, and the "..." symbol is used to indicate that an irrelevant portion of code has been left implicit.

program virus:= {1234567;

subroutine infect-executable:= {loop:file = get-random-executable-file;

if first-line-of-file = 1234567 then goto loop;

prepend virus to file; }

subroutine do-damage:= {whatever damage is to be done}

subroutine trigger-pulled:= {return true if some condition holds}

main-program:= {infect-executable; if trigger-pulled then do-damage; goto next;}

next:}

milemarker 1 brain
Milemarker 1: Brain
  • First virus that anyone really noticed
  • Basit and Amjad Farooq Alvi, of Lahore, Pakistan.
  • Simple Boot Infector – harkens back to the days of boot from floppy
lehigh virus
Lehigh Virus
  • Appeared in 1987
  • Introduced some important techniques:
    • Infected COMMAND.COM
    • Went resident in memory
    • Infected any disks that were accessed from the infected machine
    • Had an unpleasant trigger: trashed the FAT after four infections
jerusalem
Jerusalem
  • Appeared in 1988 ,reported by YisraelRadai
  • Memory-resident COM/EXE infector
  • Contained a big: infected itself over and over again…
  • Spawned MANY virus variants
    • What’s a virus variant?
christma exec
Christma.EXEC
  • 1987…
  • Written in REXX, a scripting language by IBM
  • Sent in SOURCE form by email
  • Required a user to run it
  • When it ran, sent itself to all your contacts
  • It was an early, human-driven WORM
the morris worm
The Morris Worm
  • 1988
  • See: ftp://coast.cs.purdue.edu/pub/doc/morris_worm/ for all the details you could ever need and more
  • Used multiple vulnerabilities
    • Sendmail bug
    • Fingerd bug
    • Via .rhosts files
    • Via password cracking
  • Infected a *lot* of hosts for the then fledgling Internet
aids trojan the law catches up
AIDS Trojan: The Law Catches Up
  • Trojan Disk sent out widely in 1992
  • Encrypted data on the fixed disk after a certain number of boots
  • License verbage:
  • "In case of breach of license, PC Cyborg Corporation reserves the right to use program mechanisms to ensure termination of the use of these programs. These program mechanisms will adversely affect other program applications on microcomputers. You are hereby advised of the most serious consequences of your failure to abide by the terms of this license agreement."
  • See: http://www.virusbtn.com/magazine/archives/pdf/1992/199201.PDF
the bulgarian virus factory
The Bulgarian Virus Factory
  • More of an Icon than a reality
  • But, for a time, the most complex viruses did come from Bulgaria
  • Many the work of one person, the mysterious “Dark Avenger”
  • Dark Avenger ultimately wrote a “fast infecting” virus and the infamous Mutation Engine (aka MtE or DAME)
tequila
Tequila
  • Welcome to Terry Tequila’s latest venture
  • 1991
  • First fully polymorphic, full stealth virus
michelangelo
Michelangelo
  • March 6th, 1992
  • Serious enough that there was actually a CERT Advisory: http://www.cert.org/advisories/CA-1992-02.html
  • A Boot Sector Virus with a payload
  • Quotes: “hundreds of thousands of computers” – John McAfee, also labeled with the number “five million”
  • “One out of four computers” – Reuters
  • In fact, total damage was low… very low: 10 to 20 thousand
  • For an interesting take on epidemiology, read: http://www.research.ibm.com/antivirus/SciPapers/Kephart/PREV/prevalence.gopher.html
slide16
MtE
  • Also in 1992
  • A linkable object, never distributed in source form
  • Caused massive variation in code structure of a computer virus
  • Caused a complete redesign of several antivirus products, and was the end of simple “signature scanning”
the virus creation lab
The Virus Creation Lab
  • Menu-driven virus creation for the masses!
  • Primarily simple COM infectors
  • Capable of basic encryption
  • The first of many…
the black baron
The Black Baron
  • Pathogen and Queeg
  • SMEG, the “Simulated Metamorphic Encryption Generator”
  • See: http://www.soci.niu.edu/~crypt/other/pyle.htm for the full story
  • Also, see http://www.computer-investigations.com/chist/chist01.html for an account of the investigation from an old friend, Jim Bates
  • Convicted under the UK’s Computer Misuse Act
concept
Concept
  • Appeared around 1996
  • First “data” infecting virus? Well, not really…
  • Written in Word Macros
  • Forced large-scale changes in the antivirus industry
  • Interestingly, everyone infected by concept saw one of these:
laroux
Laroux
  • Hot on the heels of Concept
  • Auto_open and Check_files
  • Simple example of what could be done
  • Infected PERSONAL.XLS, which is loaded whenever Excel is run
strange brew
Strange Brew
  • 1998
  • A virus that was written in Java that infects Java class files
  • Primarily a proof of concept
  • See: http://www.sophos.com/virusinfo/articles/java.html for a useful FAQ
  • What about the Sandbox?
melissa
Melissa
  • 1999 (see CERT advisory CA-1999-04)
  • A virus that propagated via Email attachments
  • Used MAPI to spread
  • Incredibly effecting technique
  • Poor David Smith! See: http://news.bbc.co.uk/1/hi/world/americas/1963371.stm
slide24
DDoS
  • DDoS = Distributed Denial of Service
  • Simple process:
    • Pwn a large number of machines
    • Install a remote control “bot” on them
    • Command them to attack a particular site
  • Why is this so dangerous?
codered
CodeRed
  • CERT advisory CA-2001-19
  • Common buffer overrun in IIS
  • Spread like WILDFIRE
  • Question: Why?
sql slammer
SQL.Slammer
  • Launched in January 2003
  • Utilized a buffer overrun in Microsoft’s popular SQL Server
  • Spread from machine to machine with a peak population doubling rate of 8.5 seconds
  • Infected 90% of all machines it would ever infect in 10 minutes
  • Actually impacted BGP Route Stability on the Internet!
the rise and rise of spyware
The Rise and Rise of Spyware
  • Windows makes it quite easy to write Spyware
  • Spyware can take over a machine and make it “unrecoverable” in many senses, without a reinstall
  • As Spyware becomes more “commercial” (in some senses of the word) it becomes a harder problem to fight
    • Blurred lines between legal and illegal
    • Context sensitivity and EULAs
blue pill
Blue Pill
  • The “undetectable” rootkit
  • Server virtualization used for gain?
  • How much of this is a real threat?
sony rootkit brouhaha
Sony “rootkit” brouhaha
  • Sony adds a “rootkit” to CDs in an attempt to manage its digital rights…
    • More complicated than it sounds, but interesting story
2007 cybercrime rates rise
2007: Cybercrime rates rise
  • For the first time, the UK cybercrime rate rises to meet the “real world” crime rate
2007 zero day attacks
2007: Zero-Day Attacks
  • Are everywhere:
    • PDF
    • Realplayer
    • IE
dlp becomes big business
DLP Becomes Big Business
  • 2007: Symantec acquires Vontu
    • Companies begin to focus on protecting data at rest and while in transit
viruses in space august 08
Viruses in Space: August 08
  • Autorun Worm found on the International Space Station
    • Password-stealing, but not mission critical
the future
The Future?
  • More viruses
  • More Worms
  • More Trojans
  • More software that Blurs the Lines