Modern Computer Viruses
Author - Chas Tomlin
- IT Security Specialist in School of Electronics and Computer Science
- Member of Shadowserver
- Maintain a db of currently ~15,000 unique viruses and their associated network traffic.
Aim
- Take a look at current viruses/malware and how they propagate
- See what features modern viruses come with
- See what impact an infected machine might have on your network
- Learn to detect and prevent viruses
Four Installments:
- Infection
- Payload
- Impact
- Response
Focus on Windows viruses
Impact
- Depends on the environment
- User privileges
- Administrator
- Non privileged
- Location of the infected host
- Home user
- Business
- Government
Impact – User Privileges
- Viruses that spread using remote buffer overflows will typically gain complete control over un-patched systems.
- Drive by downloads can only infect the system as far as the context of the user that is logged in.
Home user - Impact
- Steal
- Bank login
- Email login
- Any login!!
- Credit Card details
- Software licenses/CD keys
- Attack
- DDoS
- Spam
- Proxy
- IP masking
Keyloggers
- SSL, Encryption stops attackers from grabbing login from the wire
- Keyloggers allow them to grab the plain text of what you are typing.
Steal - Software Licenses
- Some malware has the capability to search a system for software licenses, cd keys etc.
Impact Home User - DDoS
- Massive amounts of traffic ~ 20 Gb/s
- Enough to cause very large network disruption
- People are beginning to realise that this could have a severe impact on critical IT infrastructure
- Risks on and impact of traffic jam and other incidents on the information highways by Luc Beirens
Business - Impact
- Steal
- Interlectual property
- Source code
- Attack
- DDoS (more bandwidth)
- Spam (not ISP broadband net)
- Other systems behind firewall.
Inside Perimeter Firewall
Business Impact
Government - Impact
- Steal
- Passwords
- Documents
- Compromise national security
New trends
- Targeted attacks, moving away from mass email.
- Mostly using exploits in MS Office
- Not widely deployed, hard to detect
- New zero day MS Word exploit
- Received the payload at the end of last week.
- Based around the trojan poison ivy
GENERAL FEATURE LIST firewall bypassing, reverse connection, ARC4 encrypted communications, transparent compression of transfers and communications, full-featured file, registry, services and process manager, relay server, view installed applications (some support remote silent uninstallation), key logger, socks4/5 server, traffic sniffer, remote screen capture and web cam viewing, password manager (IE cached passwords, MSN passwords, Firefox cached passwords, wireless zero configuration passwords, LM/NTLM hashes), runs on restricted accounts.
<< | Viruses | >>
